In case you hadn’t noticed, Fedora 9 has been released. One of the many goodies to be included is SLIDE: the SELinux policy development IDE. This should be great news for application developers who want their projects to work well with SELinux.
It’s been possible for some time now to quickly develop a loadable policy module when an application clashes with the shipped SELinux policy. The technique is quite simple: parse the audit log and generate rules which allow the previously denied accesses. This is a form of “learning mode”, which risks encapsulating badness and being incomplete. It’s often handy for resolving local issues, but not necessarily the kind of thing that a developer would want to use for creating shippable and maintainable policy.
This is where SLIDE comes in. It’s an eclipse-based environment with deep knowledge of the SELinux policy infrastructure, facilitating policy development for everything from the simplest application through to the general system policy. It’s not “SELinux policy for Dummies”, but it does provide some useful high-level abstractions such as wizards. Developers who are interested in learning more about how to develop policy for their applications can now easily get started with SLIDE in Fedora 9. If not installed already, do so:
$ sudo yum install eclipse-slide selinux-policy-devel
SLIDE should then be available via Applications -> Programming -> Eclipse. Start a new project and follow the prompts to create a policy module for an application. The application doesn’t even need to exist—this is simply a good way to learn about the policy framework. Note that the location of reference policy is /usr/share/selinux/devel/include.
Here are some screenshots (click for larger images):
Creating a new policy module via the wizard.
Guided interface. These fields are automatically populated, while elements may be expanded out for greater control.
Automatically generated initial policy ready for building or further development.
It would be immensely useful now to have a simple worked tutorial to help people get started in a practical manner. I’m not sure if anyone is planning to do this currently, so if you’re looking for a way to dive in and contribute to the project, please get in touch via the mailing list. Otherwise, please wait until it falls from the sky.
Have fun!