Info: Version 1.8.x is available.

Japanese Page

Last modified: $Date: 2024-03-30 20:25:00 +0900 (Sat, 30 Mar 2024) $

Phase 4: Tuning policy for your system.

This page describes how to tune TOMOYO Linux's policy.

Step 1: Patterning File Access Permissions

Append access permissions for files that are not necessarily accessed in the learning mode such as WWW contents for WWW service.

If you define

in the exception policy, you can simplify like

in the domain policy.

Step 2: Handling temporary files

You can not handle temporary files by simply using "learning mode" and "permissive mode". You need to interactively handle temporary files according to To remove redundant ACL entries.
But if you want to convert temporary files into patterns non-interactively, you can do it as shown below.

List up pathnames that can be temporary files.

We can consider that "/etc/mtab~numeric" and "/tmp/sh-thd-numeric" are temporary files, thus we make patterns for these pathnames. First, we need to consider what patterns to use. In these examples, numeric seems decimal digits. Thus, we use \$ pattern which matches one or more repetitions of decimal digits.

Append patterns to the exception policy.

Replace "/etc/mtab~numeric" and "/tmp/sh-thd-numeric" in the domain policy with '/etc/mtab~\$' and '/tmp/sh-thd-\$'

Step 3: Patterning Numeric Permissions

Make patterns for numeric parameters such as file's create mode and network's port numbers.
The following example permits /usr/sbin/httpd to accept connections from client's port 1024-65535.

If you define

in the exception policy, you can simplify like

in the domain policy.

Step 4: Patterning Network Access Permissions

Similarly, make patterns for IP addresses. Don't copy the following permissions.

If you define

in the exception policy, you can simplify like

in the domain policy.

Step 5: Adding conditions to ACLs (Optional)

You can add conditions to individual ACLs if necessary. By using this feature, you can enforce system's user ID based access control.

You can define the following path_group in the exception policy.

If you want to protect non-anonymous FTP service, by adding conditions in the following manner, you can forbid access to directories outside the user's home directory. To reduce damages when it is cracked, it is recommended that you should expose directories only under specific (such as "ftp") directory rather than exposing whole of home directories. If you use vsftpd, you can give like the following way.

If you want to protect Samba service, by adding conditions in the following manner, you can forbid access to directories outside the user's home directory. To reduce damages when it is cracked, it is recommended that you should expose directories only under specific (such as "samba") directory rather than exposing whole of home directories.

If you want to protect SSH service, by adding conditions in the following manner, you can forbid login as user "root".

Various conditions are supported. Please see Using conditional ACL. for details.

If you have configured audit logs at Phase 2: Initializing TOMOYO Linux., you can generate conditional ACL from audit logs by applying convert-audit-log before applying ccs-sortpolicy . But please be aware that conditional ACL automatically generated in this way is too restricted to apply for actual system. For example, you should not check process ID and inode numbers because they change every time. Please relax conditions as you need before applying automatically generated conditional ACL.

Return to index page.