http://blog.gmane.org/gmane.linux.tomoyo.user.english hourly 1 1901-01-01T00:00+00:00 http://gmane.org/img/gmane-25t.png http://gmane.org http://comments.gmane.org/gmane.linux.tomoyo.user.english/486 <pre>Thanks for quick reply. Currently I am learning things up and new to the world of masters like you. I am developing myself and I guess by the end of this year I would have achieved some of my targets about web, linux, cisco and I want to provide free articles, tutorials, documentations to the people who are new to tomoyo linux but at this stage I am very new to it. I will be playing with it. I am sorry my friends are users of winodows and I moved to linux a few months back so currently I do not have enough capabilities or resources and I have not maintained any repo ever. With time I would be developing things up and will start writing articles and videos on tomoyo linux and its uses, at the moment I am just playing with it. Thanks for you time and quick reply Pawan On Sat, May 12, 2012 at 11:00 PM, &lt; tomoyo-users-en-request-5NWGOfrQmneRv+LV9MX5uooqe+aC9MnS&lt; at &gt;public.gmane.org&gt; wrote: _______________________________________________ tomoyo-users-en mailing list tomoyo-users-en-5NWGOfrQmneRv+LV9MX5uooqe+</pre> Pawan Kumar 2012-05-14T09:49:52 http://comments.gmane.org/gmane.linux.tomoyo.user.english/484 <pre>Hi, Thanks for creating such a beautiful security system. I have seen tomoyo linux live cd for ubuntu, thanks for making our life easier. My question is, a big population of the world is using ubuntu and that too 64 bit, so how tomoyo linux addresses porting tomoyo linux on 64 bit ubuntu. Sorry, I am not aware of any manual way to do it for ubuntu 64 bit. If there is any link that can help people like me using 64 bit ubuntu 12.04 to be able to use tomoyo linux. it would be such a great help. It would be really great for us if more videos are posted on youtube that can help new users of linux start tomoyo linux with no problem at all. Things become much more easier when we see something visually than read any manual. It would be great if you can explain different situations that can help even the vast number of desktop users of the world to be able to make their system more secure. Thanks for giving your valuable time to make peoples life easier! Appreciate all your work! Is it available for 64 bit opensus</pre> Pawan Kumar 2012-05-12T23:07:36 http://comments.gmane.org/gmane.linux.tomoyo.user.english/477 <pre>Hello, I have been trying to find out why my tomoyo installation has broken itself. It was running locking down just the apache service, I rebooted my server for some maintenance and it failed to come backup. I logged into the console and it was waiting at boot for a tomoyo profile, I typed "disable" if I recall correctly and it booted. I then performed, tomoyo-editpolicy and apache was back to profile 1, when I tried to adjust it to profile 3, it just stayed on 1. A bit of investigation shows that the kernel doesn't know about profiles 2 &amp; 3. How do I go about resolving this? Thanks Cam INFO: Linux www.cam.com 2.6.32-5-amd64 #1 SMP Thu Mar 22 17:26:33 UTC 2012 x86_64 GNU/Linux root&lt; at &gt;www:~# cat /boot/grub/menu.lst ===== SNIP ===== kernel /boot/vmlinuz-2.6.32-5-amd64 root=/dev/xvda1 ro security=tomoyo initrd /boot/initrd.img-2.6.32-5-amd64 ====== SNIP ===== root&lt; at &gt;www:~# cat /sys/kernel/security/tomoyo/manager /usr/sbin/tomoyo-loadpolicy /usr/sbin/tomoyo-editpolicy /usr/sbi</pre> Cam McK 2012-05-10T07:20:05 http://comments.gmane.org/gmane.linux.tomoyo.user.english/474 <pre>Hi guys, I installed tomoyo linux on kubuntu 12.04* kernel 3.2.0-24-virtua*l ( yesterday, I had same problem on 3.2.0-24 generic kernel too). I followed this exactly Ubuntu 12.04 (generic-pae flavour) # echo 'deb http://tomoyo.sourceforge.jp/repos-1.8/Ubuntu12.04/ ./' &gt;&gt; /etc/apt/sources.list # apt-get update # apt-get install linux-generic-pae-ccs ccs-tools From: http://tomoyo.sourceforge.jp/1.8/chapter-3.html.en but I had no success and I got kernel panic error. Though I was able to boot into my previous kenel and things were fine. I want to use tomoyo linux on kubuntu. Any suggestions would be appreciated. Am I doing anything wrong here or is there any extra steps that I should take...? Its a recently installed kubuntu machine. Thanks for any suggestions pk _______________________________________________ tomoyo-users-en mailing list tomoyo-users-en-5NWGOfrQmneRv+LV9MX5uooqe+aC9MnS&lt; at &gt;public.gmane.org http://lists.sourceforge.jp/mailman/listinfo/tomoyo-users-en </pre> Pawan Kumar 2012-05-07T23:30:21 http://comments.gmane.org/gmane.linux.tomoyo.user.english/473 <pre>ccs-patch 1.8.3p7 fixes three bugs. (1) Regarding 2.6.0-2.6.11 kernels, TOMOYO needs to use spin_lock_bh()/spin_unlock_bh() rather than spin_lock_irq()/spin_unlock_irq() when a packet was dropped by TOMOYO. (2) Regarding RHEL 5.2-5.8 kernels, TOMOYO needs to protect skb_kill_datagram() call with lock_sock()/release_sock() when UDP packet was dropped by TOMOYO. (3) Regarding Ubuntu 12.04 kernel on Live CD, TOMOYO needs to accept manager programs which do not start with / because the pathname of /usr/sbin/ccs-editpolicy seen from Ubuntu 12.04 Live CD is squashfs:/usr/sbin/ccs-editpolicy rather than /usr/sbin/ccs-editpolicy . Unless you are using one of kernel versions listed above, this update will not be needed. ccs-patch-1.7.3p4 and ccs-patch-1.6.9p4 fixes the bugs (1) and (2). Live CD for Ubuntu 12.04 + TOMOYO 1.8.3p7 is now available. http://tomoyo.sourceforge.jp/1.8/ubuntu12.04-live.html This Live CD can be also used as Ubuntu 12.04 + TOMOYO 2.5 by appendin</pre> Tetsuo Handa 2012-05-05T13:50:03 http://comments.gmane.org/gmane.linux.tomoyo.user.english/467 <pre>Hello, I am a newbie in Tomoyo and looking for assistance. I am running linux-3.0.2 on my arm board which is having tomoyo 2.3 version. now my requirement is to run "audit" (Generate access granted logs/rejected logs) feature of tomoyo which is available in tomoyo 2.5 version (available with linux-3.2.2). I am looking for any direct patch available for this. If patch is available,please share that patch link to me. Thanks Nitin </pre> NITIN JHANWAR 2012-04-04T12:11:02 http://comments.gmane.org/gmane.linux.tomoyo.user.english/466 <pre>Hello, I am a newbie in Tomoyo and looking for assistance. I am running linux-3.0.2 on my arm board which is having tomoyo 2.3 version. now my requirement is to run "audit" (Generate access granted logs/rejected logs) feature of tomoyo which is available in tomoyo 2.5 version (available with linux-3.2.2). I am looking for any direct patch available for this. If patch is available,please share that patch link to me. Thanks Nitin </pre> NITIN JHANWAR 2012-04-04T12:08:44 http://comments.gmane.org/gmane.linux.tomoyo.user.english/465 <pre>CaitSith is an access restriction module for Linux 2.6.27 and later kernels. This module gives you ability to restrict access (e.g. opening files, executing programs) at the kernel level. This module is designed for ease of use. This module was derived from TOMOYO Linux 1.8.3, but usage of this module would be too different to imagine that this module was derived from TOMOYO Linux. Documentation http://caitsith.sourceforge.jp/ is under construction, sorry. Also, I uploaded other tarballs. ccs-patch-1.8.3-20120401.tar.gz and akari-1.0.26-20120401.tar.gz now support Linux 3.4-rc1 and Ubuntu 12.04. MD5: Filename: 000003289b6f9213b0e8c7c51607136e ccs-patch-1.6.9-20120401.tar.gz 77779ee24436324fdb45e232ca938063 ccs-patch-1.7.3-20120401.tar.gz aaaaca0e7b06e4e37cfa5a879cfb4736 ccs-patch-1.8.3-20120401.tar.gz 222233ff6cfb39d5c2258d91646c88a7 akari-1.0.26-20120401.tar.gz 8888e7faede611f1d951d616636d4e27 caitsith-patch-0.1-20120401.tar.gz eeeebbe3ff39cd369caf00807ee1d335 caitsi</pre> Tetsuo Handa 2012-04-01T14:07:17 http://comments.gmane.org/gmane.linux.tomoyo.user.english/459 <pre>Although there are several problems remaining, the next version of TOMOYO is taking a concrete shape. It is designed for simplicity. For example, since some people complain that "who can manage domains that exceed many hundreds?", I changed TOMOYO's domain management from mandatory to optional. For another example, since some people complain that "I want to use black listing because white listing is too much burden for me", I changed from allow-only rules to allow/deny rules which resembles network packet filtering rules. Due to large changes, the version number cannot be determined yet. It might be no longer TOMOYO. Installation instructions and policy specification is available at http://tomoyo.sourceforge.jp/testing/ . If you can prepare a system for evaluation (e.g. virtual machine), please try and give us feedbacks. </pre> Tetsuo Handa 2012-03-10T03:00:16 http://comments.gmane.org/gmane.linux.tomoyo.user.english/458 <pre>While reading AppArmor's patch, I noticed that TOMOYO's mount permission check becomes inaccurate when multiple mount flags are passed, for userspace can pass in arbitrary combinations of MS_* flags to mount() request. Two examples: If both MS_BIND and one of MS_SHARED/MS_PRIVATE/MS_SLAVE/MS_UNBINDABLE are passed, device name which should be checked for MS_BIND was not checked because MS_SHARED/MS_PRIVATE/MS_SLAVE/MS_UNBINDABLE had higher priority than MS_BIND. If both one of MS_BIND/MS_MOVE and MS_REMOUNT are passed, device name which should not be checked for MS_REMOUNT was checked because MS_BIND/MS_MOVE had higher priority than MS_REMOUNT. I fixed this bug by changing priority to MS_REMOUNT -&gt; MS_BIND -&gt; MS_SHARED/MS_PRIVATE/MS_SLAVE/MS_UNBINDABLE -&gt; MS_MOVE as with do_mount() does. Also, I changed to unconditionally return -EINVAL if more than one of MS_SHARED/MS_PRIVATE/MS_SLAVE/MS_UNBINDABLE is passed so that TOMOYO will not generate inaccurate audit logs, for commit 7a2e8a8f "VFS: Sa</pre> Tetsuo Handa 2012-03-03T13:38:40 http://comments.gmane.org/gmane.linux.tomoyo.user.english/456 <pre>Hello, Is there a patch available for making an Android 2.6.35 kernel with TOMOYO 1.8 support? I gather that 2.6.35 patch exists for the mainline kernel but the same patch does not work cleanly with the Android specific kernel. Also, although 2.6.35 ships with a TOMOYO LSM, I'd prefer 1.8 because of a superior feature set. Any suggestions? Regards, Bhargava Shastry _______________________________________________ tomoyo-users-en mailing list tomoyo-users-en-5NWGOfrQmneRv+LV9MX5uooqe+aC9MnS&lt; at &gt;public.gmane.org http://lists.sourceforge.jp/mailman/listinfo/tomoyo-users-en </pre> Bhargava Shastry 2012-02-17T15:07:26 http://comments.gmane.org/gmane.linux.tomoyo.user.english/452 <pre>Hello, I haven't come across an API for policy line deletion for TOMOYO 1.8. Is there any way to delete portions of domain policy other than doing it manually using ccs-editpolicy? I am thinking of using sed on the domain_policy.conf with the specific string to be deleted. Thanks, Bhargava Shastry _______________________________________________ tomoyo-users-en mailing list tomoyo-users-en-5NWGOfrQmneRv+LV9MX5uooqe+aC9MnS&lt; at &gt;public.gmane.org http://lists.sourceforge.jp/mailman/listinfo/tomoyo-users-en </pre> Bhargava Shastry 2012-02-12T15:03:47 http://comments.gmane.org/gmane.linux.tomoyo.user.english/445 <pre>I know that MAC isn't really the right place to do this, but I'm investigating all possibilities. Is it possible to have tomoyo log more information about binaries that are exec'd? I know that it tracks the execution chain for all process starting with init, but is it possible to attach more information to the log tomoyo stores about each execve like the time and uid that executed it? Actually, does tomoyo already log the uid? The other question is would it be possible/easy to extract this information with user-land tools? Cheers, peter </pre> Peter Moody 2012-01-26T19:16:40 http://comments.gmane.org/gmane.linux.tomoyo.user.english/440 <pre> In Tomoyo 2.5 (kernel 3.2.1) I am unable to add ACLs for sockets with null characters as per: http://tomoyo.sourceforge.jp/2.5/policy-specification/domain-policy-syntax.html.en Nothing happens when I add them through tomoyo-editpolicy. If I manually add them to the domain policy, they are removed on load. Using \? instead of \000 works. Policy violations involving \000 are correctly logged. The ACL in question: network unix stream connect \000/tmp/.X11-unix/X\$ </pre> Steven Allen 2012-01-14T18:38:18 http://comments.gmane.org/gmane.linux.tomoyo.user.english/437 <pre>Hi guys, I'm using Tomoyo 1.8.3 on linux 3.1, migrating from in-kernel Tomoyo 2.4, I have started using socket filtering which is pretty cool! I have found that Tomoyo generates logs like this: "network inet dgram send X.X.X.X 0" connection attempts on UDP port 0, for every outbound inet TCP connection the program makes. Is sending to UDP 0 still how the OS finds a free port? Even if I do not authorize these packets through in the policy, everything seems to work fine. Is this a known behaviour? Would you recommend allowing this activity? Could it not be misused to communicate externally on port 0? Cheers &amp; Best wishes! Milton </pre> Milton Yates 2012-01-11T20:56:28 http://comments.gmane.org/gmane.linux.tomoyo.user.english/436 <pre>Dear All, I am new to tomoyo linux. I have just gone through few pages in the documentation of version 2.5. I have one basic question. My understanding: Learning - through this mode i can develop policy for all domain in my system. Enforcing - through this mode i can enforce policy which i have developed earlier with learning mode Now My Use case below, I want to use this tomoyo for an embedded device which includes rich set of features like web browser.. In which End - User is allowed to install any game and play the same at any time. (game includes features like save current and resume it on next power cycle). Now My question: I want to restrict process read/write on File System for unknown processes. At the time of developing policy i will not be knowing the forked process which is created from my browser task. With the above scenario in my how shall i use tomoyo linux in enforcing mode? My objective is i don't want to allow (malicious activities) any unknown process which is forked from my M</pre> thiruhari 2012-01-11T15:44:13 http://comments.gmane.org/gmane.linux.tomoyo.user.english/430 <pre>Dear Tomoyo User, 1. Goo day and Happy New Year 2012.2. I am a Postgraduate Research Student working on implementation on Linux Security for Linux File-systems using Tomoyo Linux. I am attached to a research university in Malaysia.3. I need to enable IMA in kernel 2.6.32-generic-ccs as part of my work.4. Hence I need the entire Tomoyo kernel source to ensure that both IMA and Tomoyo in http://tomoyo.sourceforge.jp/cgi-bin/lxr/source/?v=linux-2.6.32.52-ccs-1.8.3 can be compiled into one single kernel.5. I had tried downloading the codes from no. 4 above using git , svn and cvs but no success.6. Highly appreciate if any one can tell me on how to download all codes from   http://tomoyo.sourceforge.jp/cgi-bin/lxr/source/?v=linux-2.6.32.52-ccs-1.8.3  ?   Thank you for your help. rgdsjyteh._______________________________________________ tomoyo-users-en mailing list tomoyo-users-en-5NWGOfrQmneRv+LV9MX5uooqe+aC9MnS&lt; at &gt;public.gmane.org http://lists.sourceforge.jp/mailman/listinfo/tomoyo-users-en </pre> TEH JIA YEW 2012-01-05T08:18:06 http://comments.gmane.org/gmane.linux.tomoyo.user.english/430 <pre>Dear Tomoyo User, 1. Goo day and Happy New Year 2012.2. I am a Postgraduate Research Student working on implementation on Linux Security for Linux File-systems using Tomoyo Linux. I am attached to a research university in Malaysia.3. I need to enable IMA in kernel 2.6.32-generic-ccs as part of my work.4. Hence I need the entire Tomoyo kernel source to ensure that both IMA and Tomoyo in http://tomoyo.sourceforge.jp/cgi-bin/lxr/source/?v=linux-2.6.32.52-ccs-1.8.3 can be compiled into one single kernel.5. I had tried downloading the codes from no. 4 above using git , svn and cvs but no success.6. Highly appreciate if any one can tell me on how to download all codes from   http://tomoyo.sourceforge.jp/cgi-bin/lxr/source/?v=linux-2.6.32.52-ccs-1.8.3  ?   Thank you for your help. rgdsjyteh._______________________________________________ tomoyo-users-en mailing list tomoyo-users-en-5NWGOfrQmneRv+LV9MX5uooqe+aC9MnS&lt; at &gt;public.gmane.org http://lists.sourceforge.jp/mailman/listinfo/tomoyo-users-en </pre> TEH JIA YEW 2012-01-05T08:18:06 http://comments.gmane.org/gmane.linux.tomoyo.user.english/430 <pre>Dear Tomoyo User, 1. Goo day and Happy New Year 2012.2. I am a Postgraduate Research Student working on implementation on Linux Security for Linux File-systems using Tomoyo Linux. I am attached to a research university in Malaysia.3. I need to enable IMA in kernel 2.6.32-generic-ccs as part of my work.4. Hence I need the entire Tomoyo kernel source to ensure that both IMA and Tomoyo in http://tomoyo.sourceforge.jp/cgi-bin/lxr/source/?v=linux-2.6.32.52-ccs-1.8.3 can be compiled into one single kernel.5. I had tried downloading the codes from no. 4 above using git , svn and cvs but no success.6. Highly appreciate if any one can tell me on how to download all codes from   http://tomoyo.sourceforge.jp/cgi-bin/lxr/source/?v=linux-2.6.32.52-ccs-1.8.3  ?   Thank you for your help. rgdsjyteh._______________________________________________ tomoyo-users-en mailing list tomoyo-users-en-5NWGOfrQmneRv+LV9MX5uooqe+aC9MnS&lt; at &gt;public.gmane.org http://lists.sourceforge.jp/mailman/listinfo/tomoyo-users-en </pre> TEH JIA YEW 2012-01-05T08:18:06 http://comments.gmane.org/gmane.linux.tomoyo.user.english/428 <pre>I'm evaluating tomyoo 2.3 in debian wheezy. Here are two scripts that I've found useful. Because I'm not sure whether or how this list supports attachments, I'm also pasting the scripts in-line. I have no idea whether these will work for version 2.5, but they are basically awk scripts, and should be easy to modify, as you wish. Hope its helpful. 1 _tomoyo-policy-sort ================ Helps identify what domains are in need of patternizing, and possibly be candidates for domain-transition. Usage hints: 1] No admin privileges are required to run the script. It DOES require read-access to a domain_policy file, and defaults to /etc/tomoyo/domain_policy.conf. 2] run the script with no parameters to see how may rules there are for each domain in /etc/tomoyo/domain_policy.conf, sorted by increasing number of rules,. So, the most likely candidates for patternizing will display at the end of the output. 3] run the script with the -d parameter to get the same output as above, but sorted by the last eleme</pre> Boruch Baum 2011-11-13T21:18:04 http://comments.gmane.org/gmane.linux.tomoyo.user.english/426 <pre>Hi, I've just started with Tomoyo 2.4 on a fresh install on Arch Linux, but I can't set a policy. I've followed the instructions on the wiki: setting the grub command line, executing /usr/lib/tomoyo/init_policy, and running tomoyo-editpolicy; however, if I try to set a policy on any process ("s" and entering "1" where it asks for the new profile number), it does not change, the profile number remains at 0. I've tried saving the policy and loading it at reboot, yet it still remains unchanged. I've also tried removing the program, deleting all the files within /etc/tomoyo/, and retrying but to no avail. Can any one shed some light on this please? Thanks, JD. </pre> JD 2011-12-26T18:18:29 Search the mailing list at Gmane query http://search.gmane.org/?group=$group=gmane.linux.tomoyo.user.english