Chapter 9: Advanced profile management

9.1. Profile initialization

The initialization procedure performed using /usr/lib/ccs/init_policy can be modified using command-line options to make development of policy easier depending on what functionality you wish to restrict. For example, for those wishing to restrict only file-related operations can pass the "--file-only-profile" option. The options you pass upon initialization do not constrain how policy can be developed, as the options merely change the default values for files created within the policy directory. These files can be modified using the policy editor at any later date to fit your needs. The following table summarizes the command-line options available:

If you executed /usr/lib/ccs/init_policy without the "--file-only-profile" option, the CONFIG lines in "/etc/ccs/profile.conf" will look like this:

0-COMMENT=-----Disabled Mode-----
0-PREFERENCE={ max_audit_log=1024 max_learning_entry=2048 enforcing_penalty=0 }
0-CONFIG={ mode=disabled grant_log=no reject_log=yes }
1-COMMENT=-----Learning Mode-----
1-PREFERENCE={ max_audit_log=1024 max_learning_entry=2048 enforcing_penalty=0 }
1-CONFIG={ mode=learning grant_log=no reject_log=yes }
2-COMMENT=-----Permissive Mode-----
2-PREFERENCE={ max_audit_log=1024 max_learning_entry=2048 enforcing_penalty=0 }
2-CONFIG={ mode=permissive grant_log=no reject_log=yes }
3-COMMENT=-----Enforcing Mode-----
3-PREFERENCE={ max_audit_log=1024 max_learning_entry=2048 enforcing_penalty=0 }
3-CONFIG={ mode=enforcing grant_log=no reject_log=yes }

If you executed /usr/lib/ccs/init_policy --file-only-profile, the CONFIG lines in "/etc/ccs/profile.conf" will look like this:

0-COMMENT=-----Disabled Mode-----
0-PREFERENCE={ max_audit_log=1024 max_learning_entry=2048 enforcing_penalty=0 }
0-CONFIG::file={ mode=disabled grant_log=no reject_log=yes }
1-COMMENT=-----Learning Mode-----
1-PREFERENCE={ max_audit_log=1024 max_learning_entry=2048 enforcing_penalty=0 }
1-CONFIG::file={ mode=learning grant_log=no reject_log=yes }
2-COMMENT=-----Permissive Mode-----
2-PREFERENCE={ max_audit_log=1024 max_learning_entry=2048 enforcing_penalty=0 }
2-CONFIG::file={ mode=permissive grant_log=no reject_log=yes }
3-COMMENT=-----Enforcing Mode-----
3-PREFERENCE={ max_audit_log=1024 max_learning_entry=2048 enforcing_penalty=0 }
3-CONFIG::file={ mode=enforcing grant_log=no reject_log=yes }

9.2. Profile syntax

9.2.1. Fields

Each profile contains 3 fields:

9.2.2. The CONFIG field

The following options are available in the CONFIG field:

The "mode" parameter of the CONFIG line can contain one of the following values:

By default, the CONFIG line specifies the default operation mode for all categories and functionalities. The absence of the CONFIG line is equivalent to "mode=disabled". The default configuration can be overwritten by using one or more CONFIG lines per profile and using category-specific configuration:

For example, only file and network operations could be restricted by adding a fourth profile:

4-COMMENT=-----Enforcing file and network-----
4-PREFERENCE={ max_audit_log=1024 max_learning_entry=2048 enforcing_penalty=0 }
4-CONFIG::file={ mode=enforcing grant_log=no reject_log=yes }
4-CONFIG::network={ mode=enforcing grant_log=no reject_log=yes }

It is also possible to mix different restriction modes within a single profile, such as enforcing network operations but staying in "Learning Mode" for file-related operations:

5-COMMENT=-----Learning file and Enforcing network-----
5-PREFERENCE={ max_audit_log=1024 max_learning_entry=2048 enforcing_penalty=0 }
5-CONFIG::file={ mode=learning grant_log=no reject_log=yes }
5-CONFIG::network={ mode=enforcing grant_log=no reject_log=yes }

Category-specific configuration can be further overwritten by functionality-specific configuration:

For example, you could create a profile for only restricting file execution:

6-COMMENT=-----Enforcing file::execute only-----
6-PREFERENCE={ max_audit_log=1024 max_learning_entry=2048 enforcing_penalty=0 }
6-CONFIG::file::execute={ mode=enforcing grant_log=no reject_log=yes }

For performance, permission checks for getting attributes for files and directories could be disabled while still enabling other permission checks for files:

7-COMMENT=-----Enforcing file operations without getattr-----
7-PREFERENCE={ max_audit_log=1024 max_learning_entry=2048 enforcing_penalty=0 }
7-CONFIG::file={ mode=enforcing grant_log=no reject_log=yes }
7-CONFIG::file::getattr={ mode=disabled grant_log=no reject_log=yes }

Note that the settings for "CONFIG::file::getattr" overwrite the settings for "CONFIG::file", which in turn overwrite the settings for "CONFIG" (which in this case has not been set and so is equivalent to "mode=disabled"). This allows fine-grained control over which operations you wish to restrict.

9.2.3. The PREFERENCE field

The PREFERENCE line holds the following options: