[11:28:54] dquigley joins the room [13:15:38] trondmy joins the room [13:16:23] Good afternoon Trond. [13:17:38] Hi Dave! [13:18:11] spencer joins the room [13:18:29] oh, hey, I am here [13:18:36] Who's Spencer? [13:19:24] hello, trond [13:19:37] :-) [13:20:09] I think I've seen this Spencer once or twice. I think he is some guy who hangs around IETF NFSv4 meetings. [13:20:51] I never see him outside them any more... [13:23:37] beepy joins the room [13:38:19] I bet that was a fun sound [13:39:10] Yea it was nice on the ears. [13:40:02] He makes it sound so horrible :) [13:41:00] Who is this? [13:41:11] Tom Haynes... [13:41:12] tom is talking now [13:41:25] haha [13:41:47] david black [13:42:02] Yea I can recognize his voice now. I've just never heard Tom before. [13:42:11] :-) [13:42:48] He is absolutely correct there. [13:42:58] But that is how all MAC methods work [13:43:03] thats is how TX works [13:43:08] That is how SELinux works [13:43:13] That is how SMACK works [13:43:17] That is how everything out there is. [13:43:42] I will pass it along [13:43:51] That is also how the BSD MAC mechanisms work as well [13:43:58] so its the reality of the way the world works. [13:44:29] Minor correction trond. Apparmor and Tomoyo are not label based [13:44:37] A better comparison would be SELinux and SMACK [13:44:50] Apparmor and Tomoyo would never use this [13:45:45] Exactly [13:47:43] Do you have examples of such organizations? [13:48:14] I'm interested in addressing her concerns I'd just like to have a good idea. [13:48:27] Can she not name them because they are unnamed govt people? [13:48:32] yes [13:48:34] if so she can give me a POC [13:48:40] I can talk to them on the inside if necessary [13:49:21] ahh I think I'm starting to get the idea. [13:51:36] So to partially answer her question. I think she has a situation where you have things like labeled databases and she wants to know if we are attempting to use a unified labeling scheme between other labeled entities and nfs? Am I correct in that? [13:52:25] Eisler right? [13:52:30] yes [13:52:37] we may want to get the two of you connect, quigly [13:52:44] Yea I think that would be a good idea [13:53:01] I'm interested in talking with her and figuring out what some other usecases are [13:53:11] okay; will pass it along [13:53:27] spencer driving. i'm a passenger on this bus. [13:53:39] But thats security policy [13:54:05] Sounds good [13:54:28] Well that is if the the server wants to implement an enforcement mechanism [13:54:46] Yea the LFS [13:55:01] That is true [13:57:08] Yea [13:57:17] there is DOE vs DOD MLS labels [13:58:12] That sounds like another really good use of the labels [13:58:39] I could definitely see someone using the label field to hold that information and registering a LFS for it [13:58:50] and then having an enforcement mechanism on their machines to process them [13:59:19] one thing I considered with the labels and presented at Anaheim was some sort of regulatory compliance [13:59:25] which is the use case that she is touching on there [13:59:40] okay, good input overall today [13:59:42] I think 4.2 from the Labeled NFS perspective should be what I typed in an earlier email [13:59:44] got it. [13:59:50] let me copy and paste it here really quick for the record [14:00:05] Ok [14:00:07] Yea I agree [14:00:26] Well without RPCSEC_GSSv3 the server can't enforce policy in any reasonable way [14:00:46] So this is what we should add into 4.2 [14:01:02] For now I agree with David Black [14:01:05] I think thats a good approach [14:01:15] I agree [14:01:36] For now that is absolutely tre [14:01:37] true [14:01:39] later on we can fix that [14:01:40] but [14:01:47] for an initial pass I think that is an acceptabl [14:01:50] solution [14:02:03] Yea they do that by mapping labels from connections [14:03:40] What was the Lady's name that was speaking earlier? [14:03:55] uh, will need to get that [14:03:59] Not from connections but from RPCSEC_GSSv3 sessions [14:04:21] You can certainly add info in the filehandle to tell the server whether or not the [14:04:36] client went through the labeled nfs path or not. [14:04:37] We have use cases for that inside the DoD [14:05:01] We have someone authenticate with certain credentials so we want to say that they operate at a certain MLS level [14:05:13] so they have access to certain MLS levels on the system [14:05:40] The thing is though this is why we separated enforcement from mechaism [14:05:47] this is why its a tenant of SELinux as well [14:05:49] Kathleen Moriarty - EMC (RSA?) [14:05:56] Cool [14:05:57] Thanks [14:06:46] Computers work so much better with Car analogies :) [14:07:58] Yea there are quite a few nits and clarifications that need to be made [14:08:02] do we want one draft? [14:08:04] if so what is in it? [14:08:08] is it just the NFSv4.1 changes? [14:08:21] should it have any enforcement mode details or does it punt to another document [14:08:37] discuss on dive in call [14:08:40] thanks dave [14:08:43] Cool [14:09:06] is there some sort of virtual blue sheet for remote people? [14:09:16] nacho319 joins the room [14:09:32] nacho? [14:09:38] hi [14:10:48] Trying to hear David black in the background :) [14:11:01] Are the labels really authority based or classification based? [14:11:18] So it depends on the enforcing mechism [14:11:26] If we work on a set of "standard" labels, how much are you willing to contribute to that? [14:11:53] I'm willing to write and contribute review to drafts [14:12:04] I would need to see specific details about it. [14:12:24] beepy leaves the room [14:12:24] If it also helps I'm fully cleared so I can talk with internal customers about classified details as well [14:12:35] if you have such customers [14:13:03] any chance of asking david black to talk a bit closer to the microphone? [14:13:42] done [14:13:44] yea [14:13:44] oh, you guys are having the after meeting; like the after party [14:13:46] Thank you :) [14:14:00] not sure if it will help [14:14:10] So back to label type [14:14:22] SELinux labels are a combination of both. [14:14:36] SELinux labels really enforce several different models [14:14:38] one is an MLS component [14:14:46] so there is a sensitivity classification there. [14:14:47] I also work with the cloudbase folks and the CDS people related to that effort - they might have some interest here [14:14:54] Cool [14:16:21] The main aspect of SELinux is type enforcement though [14:16:40] which is a mechaism of describing program behavior within a system [14:16:51] so security labels for selinux have this form [14:17:04] user_component:role_component:type_component:MLS [14:17:45] David Black is 100% accureate with that statement [14:17:56] that something else is something like an EMC or NetApp storage appliance [14:18:11] Dave: I or T or something else? [14:18:35] I'm not sure I understand the question? [14:18:57] are you asking divisions? [14:19:32] Use to be R but now green. [14:19:38] R [14:19:41] ahhh [14:19:43] R23 [14:19:47] SELinux Team [14:19:48] really? [14:19:50] yea [14:19:57] okay [14:20:02] You blue? [14:20:11] SEI/CERT [14:20:11] or green as well working for blue? [14:20:15] Cool [14:20:26] Yea I use to be on the SELinux team at the agency [14:20:33] got it [14:20:41] I still work with them on this work [14:20:44] just on my own time instead [14:20:49] ahhh [14:21:12] I gotta run - good luck [14:21:12] trondmy leaves the room [14:21:16] Thanks [14:21:43] Drop me a note if I can help later; I used to work for someone NetApp acquired and I can drop by and visit you too [14:21:49] I agree with David black on the label translation part [14:21:51] it isn't easy [14:21:57] its semantic data as well [14:22:04] Cool [14:22:09] do you have an email I can use? [14:22:26] shoot me an email at dpquigl@davequigley.com and we can figure something out. [14:22:45] Label translation in SELinux will be more difficult [14:23:18] inacio@cert.org [14:24:12] nacho319 leaves the room [14:31:20] spencer leaves the room: Computer went to sleep [15:50:01] nico joins the room [15:50:11] hi Dave [17:18:29] nico leaves the room