TOMOYO

Fork

I'm new to Tomoyo and currently learning it, so thanks for good manuals, providing a start/core to work with (learning mode) and learn from and "easy-to-implement" tools. I started out with tomoyo-tools-2.5, and had the same issue there as I have currently. My Kernel is new, so I wanted to/had to move to tomoyo-tools-2.6. Unlike 2.5, 2.6 was not provided by my distro. I have no issues installing from source, and I'm sure it would have worked just fine, but even better I could "rpmbuild", which made it even better for my setup.
There were basically no dependencies needed, so the installation was about as smooth as it could have been. This is a great advantage of tomoyo over SELinux at least. I've tried to force SELinux onto Slackware (python2) which was an outright mess and in the end it was not worth it. I can imagine the process would not have been much smoother on other systems either. Not sure about apparmor, but knowing where they come from, I'm pretty sure they must have some/alot of dependencies. Anyways, getting tomoyo up and running is a breeze, provided you know how to deal with the Kernel. It's so easy that I'm quite impressed by how minimalistic these tools are.

Anyways, I guess it could have something to do with the way things are described in the documentation or me misunderstanding something. But from the documentation it seems that you are suppose to use tomoyo-tools with /sys/* directory. Or suppose to be able to at least. But maybe I misunderstood, because I'm just getting segmentation fauls with tomoyo-tools when trying to do that. So I figured it would work around this "issue" and use tomoyo tools with /etc/tomoyo folder instead. But that might be how it is meant to be done in the first place. But if it is, might I suggest to make this more clear in the documentation please.

Anyways, I'm still learning, and the more I learn, the more it seems that it is possible to really develop very complex policies, and that the tools to do so are very good. I'm just getting started and I'm already doing fairly complex things, and getting quite a good understanding of the potential of tomoyo, and I'm really liking it. That getting it up and running so easily, and it being so minimalistic is so great, considering that. The documentation is quite good too, especially the basics part, but perhaps it could need some more info in the advanced part. Not everything is easy to figure out for yourself, and some things are somewhat tomoyo-specific, so trying to figure them out can be a bit challenging if you lack the information. Why is tomoyo doing that, why is it behaving like this, why does it react like that, etc etc. Developing policy is basically a massive task if you really get into it, there are endless things you can do with it to tune it to your preferences, and developing solid policies for all domains is a big annd complex undertaking. I like the approach tomoyo is taking, providing you with a base to start with, a core to develop from, and the learning mode is not only for tomoyo, but also for the user!

I guess at some point I will start to understand the limitations, but until that I will develop policies in a very friendly MAC environment. And since 2.6, it supports co-MAC with SeLinux anyways, if limitations will ever become a real life issue. But I think for alot of people, tomoyo will do what they need, and if not, I guess it might also form a solid understanding of how MAC works for people who might want to try SELinux.

So, thanks for great software, and cheers! Everything is working very well, very smoothly, except that Segmentation fault issue with tomoyo-editpolicy. I can recreate it, or better said, it is recreated every time I use learning mode to develop a policy and then proceed to use editpolicy. I've tried to clear and recreate policies etc, but I always end up with this issue. In particular this issue happens when trying to delete entries, and it happens every time. So I can't use edipolicy to delete any enties. It could come up with other functions as well, but I'm not sure. I've gotten into the habit of editing policies manually and with patternize anyways. But it would be nice to be able to use editpolicy without any issues too!. I can view/review all domains and policies without issues, so that's basically what I'm using it for. Overall it's not a big deal for me, I can still go about learning and doing what I want to do with tomoyo, but it would be nice to not have these issues with editpolicy. But then again, it might be that I misunderstood how to use editpolicy. But, I didn't do anything "wrong" to cause this issue, it creates itself as policy is populated with learning mode without any input. I'm fairly sure it's only with the "delete" function, and it happens trying to delete anything anywhere.