Changeset 2205

Show
Ignore:
Timestamp:
06/04/08 15:05:23 (6 months ago)
Author:
dsugar
Message:

help updates

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • trunk/helpfiles/TableOfContents.xml

    r2202 r2205  
    5454        <topic label="Advanced Concepts" href="advanced/advanced.html"> 
    5555                <topic label="CDS Framework Language" href="advanced/main.html"> 
     56                        <topic label="Rdef" href="advanced/rdef.html" /> 
    5657                        <topic label="Dictionary" href="advanced/dictionary.html" /> 
     58                        <topic label="Text Language" href="advanced/policyfilesyntax.html" /> 
     59                        <topic label="System Resources" href="advanced/fsys.html" /> 
     60                        <topic label="Reference Policy Linkage" href="advanced/linkage.html" /> 
     61                        <topic label="Network Configuration" href="advanced/fnet.html" /> 
    5762                        <topic label="MLS" href="advanced/mls.html" /> 
    58                         <topic label="Reference Policy Linkage" href="advanced/linkage.html" /> 
    59                         <topic label="System Resources" href="advanced/fsys.html" /> 
    60                         <topic label="Text Language" href="advanced/policyfilesyntax.html" /> 
    61                         <topic label="Network Configuration" href="advanced/fnet.html" /> 
    6263                </topic> 
    6364 

  • trunk/helpfiles/advanced/custom.html

    r2072 r2205  
    2020In this case CDS Framework provides a way to customize the SELinux policy for any given CDS Framework policy object. 
    2121This means of customizing policy is only meant to be used as a very last resort.  
    22 The preferred way of customizing the resulting SELinux policy is to create new dictionary entries, create new base domains, base resources and abilities. 
     22The preferred way of customizing the resulting SELinux policy is to create new <a href='../advanced/dictionary.html'>dictionary</a> entries, create new <a href='../setup/basedomain.html'>base domains</a>, <a href='../setup/baseresource.html'>base resources</a> and <a href='../setup/abilities.html'>abilities</a>. 
    2323If those ways of customizing just won't do it, then this is the last way.   
    2424When right clicking on a domain, resource, entrypoint, access or enter there is a menu item <i>Add Custom Policy</i>. 
    …… 
    4343For domains and entrypoints the name of the of the template is 'cds_custom_' followed by the name of the system followed by the name of the domain or entrypoint. 
    4444For resources (and domains with resource definitions assigned) there will be multiple templates created, one for each resource definition.   
    45 This is because each resource type gets a different SELinux type during translations. 
     45This is because each resource type gets a different SELinux type during translation. 
    4646In this case the name of the templates is 'cds_custom_' followed by  the name of the system, followed by the name of the resource, followed by the name of the resource type. 
    4747For an access the name of the template is 'cds_custom_access_' followed by the name of the system, followed by the name of the domain, followed by the name of the resources, followed by the name of the resource type. 

  • trunk/helpfiles/advanced/dictionary.html

    r2072 r2205  
    2929<ul> 
    3030        <li> 
    31                 Keyword 'rdef' 
     31                Keyword <a href='../advanced/rdef.html'>'rdef'</a> 
    3232        </li> 
    3333         

  • trunk/helpfiles/advanced/filestructure.html

    r2202 r2205  
    3434                <li> 
    3535                        Configuration Directory (<i>conf</i>) -  This directory contains <a href='../advanced/linkage.html'>custom linkage (<i>.flnk</i>)</a>,  
    36                         , custom <a href='../advanced/dictionary.html'>dictionary (<i>.fdic</i>)</a> files, <a href='../advances/fnet.html'>network configuration (<i>cds.fnet</i>)</a> file 
    37                         and <a href='../advanced/mls.html'>MLS configuration (<i>framework_mls.xml</i>)</a> file.   
    38                         These types of files are displayed in the <a href='../setup/custom.html'>custom additions folder</a> in the <a href='../views/navigator.html'>framework navigator</a>. 
    39 <!-- 
    40                         To create these type of custom files, right click on the <i>conf</i> directory and choose the option to create a new <i>CDS Framework File</i>.  
    41                         Any dictionary files added to this directory will expand upon the existing dictionary of resource definitions that was specified during project creation, not replace the existing dictionary.                   
    42 --> 
    43                         In addition the file <a href='../advanced/mls.html'>framework_mls.xml</a> defines the MLS levels and is modified through the <a href='../settings/mls.html'>project properties</a>. 
     36                        and custom <a href='../advanced/dictionary.html'>dictionary (<i>.fdic</i>)</a> files which are displayed in the <a href='../setup/custom.html'>custom additions folder</a> in the <a href='../views/navigator.html'>framework navigator</a>. 
     37                        In addition the <a href='../advanced/fnet.html'>network configuration (<i>cds.fnet</i>)</a> file and <a href='../advanced/mls.html'>MLS configuration (<i>framework_mls.xml</i>)</a> files are in this directory.   
    4438                </li> 
    4539 

  • trunk/helpfiles/advanced/fnet.html

    r2202 r2205  
    66        <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> 
    77        <link rel="stylesheet" type="text/css" href="../help.css" /> 
    8         <title>MLS File Syntax</title> 
     8        <title>Network Configuration Syntax</title> 
    99<!-- 
    1010        $Date$ 
    …… 
    1717 
    1818<p> 
     19The Network Configuration (.fnet) file is how the CDS Framework Toolkit tracks information for network communication between all the systems defined in the project. 
     20In the network configuration file there are three pieces of information that are defined, these include the systems in the project, the network resources along with their rdef and the connections between the systems. 
     21</p> 
    1922 
     23<p> 
     24The basic structure of defining the network configuration is as follows: 
     25<ul> 
     26        <li> 
     27                The keyword <i>system</i> followed by the name of the system. 
     28        </li> 
     29        <li> 
     30                The keyword <i>networkresource</i> followed by the name of the resource.  Within the curly brackets defines information about the network resource.   
     31        </li> 
     32        <li> 
     33                The keyword <i>connection</i> followed by source, target and network resource - only for ipsec type network resources. 
     34        </li> 
     35</ul> 
     36</p> 
     37 
     38<p> 
     39Below is a sample of a network configuration for multiple systems 
     40</p> 
     41 
     42<pre> 
     431.  system guard; 
     442.  system translator; 
     453.  networkresource in { secmark }; 
     464.  networkresource guardcom { ipsec ( 3des-cbc "thisistheencryptionkey" ) ( hmac-md5 "authentication" ) }; 
     475.  connection guard.filterout { 192.168.15.6 } translator.filterin { 192.168.6.4 }  guardcom { 5485 }; 
     48</pre> 
     49 
     50 
     51<p> 
     52Lines 1 and 2 define the systems in the project, in this case they are named <i>guard</i> and <i>translator</i>. 
     53Lines 3 and 4 define network resources.   
     54The network resource on line 3 is named <i>in</i> is defined with the rdef <i>secmark</i> as shown in curly brackets.   
     55There is no additional information required for secmark type network resources. 
     56On line 4 the network resource named <i>guardcom</i> is defined with rdef <i>ipsec</i>.  in this case the additional information required is the encryption and authentication types and their associated keys. 
     57Finally line 5 defines connections between systems.  This is only for ipsec type network resoruces, secmark network resources get all the information from the <a href='../advanced/fsys.html'>System Resources (.fsys) file</a>. 
     58This line begins with <i>connection</i> then has source information which includes system name <i>guard</i> in this case followed by a dot then the source domain <i>filterout</i>.   
     59Then in curly brackets is ip number (or DNS) and optionally the port number.   
     60Next is the target information in the same format system name, domain name, and ip/port information.   
     61Finally is the name of the network resource used for communication and in curly brackets a unique esp number. 
     62</p>   
     63 
     64<p class='copyright'> 
     65&copy;2005 - 2008 Tresys Technology, LLC 
     66<br /> 
     67Patent Pending  
    2068</p> 
    2169 

  • trunk/helpfiles/advanced/fsys.html

    r2072 r2205  
    3838resource definition selected, a mapping to the physical location on the system may be required. As an example, when  
    3939creating an entry point, the entry point needs to be associated with an executable file. The physical location is therefore  
    40 needed for the particular executable file to be used.  Another instance where a specific location is needed is  
    41 upon creation of a domain that represents a running process.  A domain representing a running process is a domain  
    42 that has not been decomposed, meaning that the domain has no children associated with it.  The physical location for  
    43 the running process needs to be given.  The association between the files and the policy object examples  
    44 mentioned above are handled within this System Resource File (<i>.fsys</i> file). 
     40needed for the particular executable file to be used.   
     41</p> 
     42 
     43<p> 
     44In addition to specifying paths the system resources file is also used to specify local networking information.  
     45When using a secmark type network resource information about how to match incoming packets is specified.   
     46When using ipsec type networking information about the local network is specified. 
     47</p> 
     48  
     49<p> 
     50The association between the files and the policy object examples mentioned above are handled within this System Resource File (<i>.fsys</i> file). 
    4551</p> 
    4652 
    …… 
    4854 
    4955<p> 
    50 Each line in the System Resource File contains the path(s) for a single resource definition's location.  All  
    51 resource definitions defined within the CDS Framework's graphical policy that have a path or paths associated with  
    52 it are defined here.  The example below illustrates how these locations are defined within the System Resource  
    53 File. 
     56Each line in the System Resource File contains the appropriate information for a single resource definition's location.   
     57All resource definitions defined within the CDS Framework's graphical policy that have a path(s) or networking information associated with it are defined here.   
     58The example below illustrates how these locations are defined within the System Resource File. 
    5459</p> 
    5560 
    56 <p> 
    57 Example: 
    58 </p> 
     61<h3> 
     62Path Example: 
     63</h3> 
    5964 
    6065<p> 
    …… 
    7378</p>     
    7479    
     80    
     81<h3> 
     82Network Example: 
     83</h3> 
     84 
     85<p> 
     86&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<b><i>in { secmark { { eth0 } { 192.168.1.5/255.255.255.0 } { 1937 }  { eth2 } { 192.168.5.2/255.255.255.0 } { 1937 } { tcp } } }</i></b> 
     87</p> 
     88 
     89<p> 
     90The above example is a network resource <i>in</i> which uses the secmark rdef the data following is in the format described.   
     91First is local information network device, ip number and network mask finally the port(s).   
     92Next is remote network information in the same order network device, ip number and network mask followed by port(s). 
     93Lastly is the protocol - either tcp, udp or all. 
     94Most everything is optional.  The minimal information that must be specified is the local ip number or local network device. 
     95When data is not specified the empty curly brackets still must be in place. 
     96</p> 
     97 
     98<p> 
     99&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<b><i>guardcom { ipsec { { 192.168.1.2 } { 7623 } } }</i></b> 
     100</p> 
     101 
     102<p> 
     103The above example is a network resource <i>guardcom</i> which uses the ipsec rdef.   
     104The data required is only the local ip number (dns) and the port for incoming data.  The port is optional. 
     105</p> 
     106 
     107 
    75108<p class='copyright'> 
    76109&copy;2005 - 2008 Tresys Technology, LLC 

  • trunk/helpfiles/advanced/linkage.html

    r2072 r2205  
    7777 
    7878<pre> 
    79 1.  baseresource eth2 { 
    80 3.    read { 
    81 3.            default  { udp_read } 
    82 4.            udp_read { 
    83 5.                    corenet_udp_receive_eth2_if($) 
    84 6.            } 
    85 7.    } 
    86 8.    write { 
    87 9.            default  { udp_write } 
     79 1.  baseresource eth2 { 
     80 2.   read { 
     81 3.           default  { udp_read } 
     82 4.           udp_read { 
     83 5.                   corenet_udp_receive_eth2_if($) 
     84 6.           } 
     85 7.   } 
     86 8.   write { 
     87 9.           default  { udp_write } 
    888810.             udp_write { 
    898911.                     corenet_udp_send_eth2_if($) 

  • trunk/helpfiles/advanced/main.html

    r2202 r2205  
    2424<ul> 
    2525        <li> 
     26                <b>Dictionary (.fdic) File</b> - This file is used to translate CDS security architecture into SELinux policy. 
     27                See <a href='../advanced/dictionary.html'>Dictionary</a>. 
     28        </li> 
     29         
     30        <li> 
    2631                <b>Framework Policy (.fpol) File</b> - This file contains a textual representation of the graphical CDS system.   
    2732                This representation will be translated into SELinux security policy.   
    …… 
    3944                See <a href='../advanced/linkage.html'>Reference Policy Linkage</a>. 
    4045        </li> 
    41          
    42         <li> 
    43                 <b>Dictionary (.fdic) File</b> - This file is used to translate CDS security architecture into SELinux policy. 
    44                 See <a href='../advanced/dictionary.html'>Dictionary</a>. 
    45         </li> 
    46          
     46 
    4747        <li> 
    4848                <b>Network Configuration (.fnet) file</b> - This file is used to describe the network connections between the systems in the project. 

  • trunk/helpfiles/advanced/mls.html

    r2072 r2205  
    3939</p> 
    4040 
     41<p> 
     42This file is edited through the <a href='../settings/mls.html'>MLS Properties</a> page. 
     43</p> 
     44 
    4145<p class='copyright'> 
    4246&copy;2005 - 2008 Tresys Technology, LLC 

  • trunk/helpfiles/overview/editor.html

    r2072 r2205  
    3333</p> 
    3434 
     35<p> 
    3536Note that: 
    3637<ul> 
    3738        <li> 
    38                 Base Domain, Base Resource and User Domain items only can be created as top level items. 
     39                Base Domain, Base Resource, Network Resource, and User Domain items only can be created as top level items. 
    3940        </li> 
    4041        <li> 
    …… 
    5253        </li> 
    5354</ul> 
     55</p>  
    5456 
    5557<h2>Granting access</h2> 

  • trunk/helpfiles/settings/mls.html

    r2072 r2205  
    3737</p>  
    3838 
     39<p> 
     40This property page is displayed by right clicking on the project and selecting <i>Properties</i>. 
     41</p> 
     42 
    3943<p class='copyright'> 
    4044&copy;2005 - 2008 Tresys Technology, LLC