Documentation TODO - Revision history

JoshuaBrindle at 20:29, 27 November 2009

JoshuaBrindle — Fri, 27 Nov 2009 20:29:01 GMT

←Older revision		Revision as of 20:29, 27 November 2009
Line 9:		Line 9:
	Below are some specific pieces of documentation we'd like written. Copy Editing/general cleanup is also appreciated.		Below are some specific pieces of documentation we'd like written. Copy Editing/general cleanup is also appreciated.

-		+	* Use Cases (examples):
		+	** Building a Kiosk
		+	** Locking down access to a backend database server using network access controls
		+	** Using labeled networking to unify access control across multiple machines
		+	** Using SVirt or sandbox to run untrusted apps in separate domains
		+	** Any embedded/appliance work
		+	** Building assured pipelines
		+	** Anything with X access controls
	* Vendor documentation (Why a vendor might choose SELinux for a solution, what it provides and finally how to use it effectively)		* Vendor documentation (Why a vendor might choose SELinux for a solution, what it provides and finally how to use it effectively)
	* Pull userspace object manager docs from online papers and make a concise howto		* Pull userspace object manager docs from online papers and make a concise howto
Line 17:		Line 24:
	** Making new roles not based on others		** Making new roles not based on others
	** Locking down webapps by using CGI's (or FastCGI), separating CGI's from each other, user CGI's from system CGI's, etc		** Locking down webapps by using CGI's (or FastCGI), separating CGI's from each other, user CGI's from system CGI's, etc
		+	* Pull the guts out of the Fedora SELinux Docs and bringing them here (be sure to read licensing info)
	* What is UBAC?		* What is UBAC?
	* How to upgrade a system from a previously SELinux-disabled system (e.g. how to ensure any restored data like /home is correctly labeled)		* How to upgrade a system from a previously SELinux-disabled system (e.g. how to ensure any restored data like /home is correctly labeled)

JoshuaBrindle at 20:20, 27 November 2009

JoshuaBrindle — Fri, 27 Nov 2009 20:20:19 GMT

←Older revision		Revision as of 20:20, 27 November 2009
Line 1:		Line 1:
		+	This is the TODO list for documentation. The format should generally be short, consumable recipes for doing particular things, eg., letting apache talk to a database.
		+
		+	When longer explanations are required (eg., locking down a machine) they should be broken in to small, reusable pages with each targeting a narrow part of the problem. Then a main page can be written that links all the documents together into something cohesive.
		+
		+
		+	For those who have not used MediaWiki before you may need to read [http://www.mediawiki.org/wiki/Help:Formatting]
		+
		+
		+	Below are some specific pieces of documentation we'd like written. Copy Editing/general cleanup is also appreciated.
		+
		+
		+	* Vendor documentation (Why a vendor might choose SELinux for a solution, what it provides and finally how to use it effectively)
		+	* Pull userspace object manager docs from online papers and make a concise howto
		+	* Advanced recipes
		+	** Lock down users
		+	** Using roles
		+	** Making new roles not based on others
		+	** Locking down webapps by using CGI's (or FastCGI), separating CGI's from each other, user CGI's from system CGI's, etc
		+	* What is UBAC?
	* How to upgrade a system from a previously SELinux-disabled system (e.g. how to ensure any restored data like /home is correctly labeled)		* How to upgrade a system from a previously SELinux-disabled system (e.g. how to ensure any restored data like /home is correctly labeled)
-	* Update and organize the Fedora SELinux FAQ.
	* Explain how and when to use semanage fcontext, port, login and user.		* Explain how and when to use semanage fcontext, port, login and user.
	* Explain how to interpret an AVC message and how to get additional information via SYSCALL audit, including how to add a simple syscall audit filter to enable collection of PATH information.		* Explain how to interpret an AVC message and how to get additional information via SYSCALL audit, including how to add a simple syscall audit filter to enable collection of PATH information.
Line 6:		Line 24:
	* Write a HOWTO for how to iteratively generate policy using audit2allow and permissive domains.		* Write a HOWTO for how to iteratively generate policy using audit2allow and permissive domains.
	* A brief high-level user-oriented overview of SELinux which people can use to understand what SELinux does, how it's part of a defense in depth approach, the value it provides and what is involved in using it effectively (e.g. set expectations of benefit/cost).		* A brief high-level user-oriented overview of SELinux which people can use to understand what SELinux does, how it's part of a defense in depth approach, the value it provides and what is involved in using it effectively (e.g. set expectations of benefit/cost).
-	* Update FC5 FAQ
	* Translate danwalsh.livejounal.com in to a beginner user guide		* Translate danwalsh.livejounal.com in to a beginner user guide
	* Document all major policy domains, apache, samba, bind, ftp ... Basically man httpd_selinux, What are the types/booleans available for a particular domain, and how do I assign them		* Document all major policy domains, apache, samba, bind, ftp ... Basically man httpd_selinux, What are the types/booleans available for a particular domain, and how do I assign them
	* Document the use of the mount command for overriding file context.		* Document the use of the mount command for overriding file context.
	* Describe Leaked File Descriptors		* Describe Leaked File Descriptors
-	* Describe Audit2allow and how it can just Fix the machine
	* Document Network Labeling		* Document Network Labeling
	* Document Confined Users		* Document Confined Users

DaveQuigley at 17:59, 30 June 2008

DaveQuigley — Mon, 30 Jun 2008 17:59:16 GMT

←Older revision		Revision as of 17:59, 30 June 2008
Line 15:		Line 15:
	* Document Confined Users		* Document Confined Users
	* Document HOWTO write setroubleshoot plugins		* Document HOWTO write setroubleshoot plugins
		+	* Explain least privilege and how you can consider it and SELinux during application development.
		+	* Document some common tasks performed with apol that might be useful to users.

JamesMorris at 04:25, 30 June 2008

JamesMorris — Mon, 30 Jun 2008 04:25:07 GMT

←Older revision		Revision as of 04:25, 30 June 2008
Line 14:		Line 14:
	* Document Network Labeling		* Document Network Labeling
	* Document Confined Users		* Document Confined Users
		+	* Document HOWTO write setroubleshoot plugins

DanWalsh at 11:26, 23 June 2008

DanWalsh — Mon, 23 Jun 2008 11:26:20 GMT

←Older revision		Revision as of 11:26, 23 June 2008
Line 6:		Line 6:
	* Write a HOWTO for how to iteratively generate policy using audit2allow and permissive domains.		* Write a HOWTO for how to iteratively generate policy using audit2allow and permissive domains.
	* A brief high-level user-oriented overview of SELinux which people can use to understand what SELinux does, how it's part of a defense in depth approach, the value it provides and what is involved in using it effectively (e.g. set expectations of benefit/cost).		* A brief high-level user-oriented overview of SELinux which people can use to understand what SELinux does, how it's part of a defense in depth approach, the value it provides and what is involved in using it effectively (e.g. set expectations of benefit/cost).
		+	* Update FC5 FAQ
		+	* Translate danwalsh.livejounal.com in to a beginner user guide
		+	* Document all major policy domains, apache, samba, bind, ftp ... Basically man httpd_selinux, What are the types/booleans available for a particular domain, and how do I assign them
		+	* Document the use of the mount command for overriding file context.
		+	* Describe Leaked File Descriptors
		+	* Describe Audit2allow and how it can just Fix the machine
		+	* Document Network Labeling
		+	* Document Confined Users

JamesMorris at 14:08, 17 June 2008

JamesMorris — Tue, 17 Jun 2008 14:08:29 GMT

←Older revision		Revision as of 14:08, 17 June 2008
Line 5:		Line 5:
	* Write a HOWTO for writing simple policy modules.		* Write a HOWTO for writing simple policy modules.
	* Write a HOWTO for how to iteratively generate policy using audit2allow and permissive domains.		* Write a HOWTO for how to iteratively generate policy using audit2allow and permissive domains.
		+	* A brief high-level user-oriented overview of SELinux which people can use to understand what SELinux does, how it's part of a defense in depth approach, the value it provides and what is involved in using it effectively (e.g. set expectations of benefit/cost).

StephenSmalley at 12:51, 17 June 2008

StephenSmalley — Tue, 17 Jun 2008 12:51:28 GMT

←Older revision		Revision as of 12:51, 17 June 2008
Line 4:		Line 4:
	* Explain how to interpret an AVC message and how to get additional information via SYSCALL audit, including how to add a simple syscall audit filter to enable collection of PATH information.		* Explain how to interpret an AVC message and how to get additional information via SYSCALL audit, including how to add a simple syscall audit filter to enable collection of PATH information.
	* Write a HOWTO for writing simple policy modules.		* Write a HOWTO for writing simple policy modules.
		+	* Write a HOWTO for how to iteratively generate policy using audit2allow and permissive domains.

StephenSmalley at 12:42, 17 June 2008

StephenSmalley — Tue, 17 Jun 2008 12:42:30 GMT

←Older revision		Revision as of 12:42, 17 June 2008
Line 1:		Line 1:
	* How to upgrade a system from a previously SELinux-disabled system (e.g. how to ensure any restored data like /home is correctly labeled)		* How to upgrade a system from a previously SELinux-disabled system (e.g. how to ensure any restored data like /home is correctly labeled)
		+	* Update and organize the Fedora SELinux FAQ.
		+	* Explain how and when to use semanage fcontext, port, login and user.
		+	* Explain how to interpret an AVC message and how to get additional information via SYSCALL audit, including how to add a simple syscall audit filter to enable collection of PATH information.
		+	* Write a HOWTO for writing simple policy modules.

JamesMorris: New page: * How to upgrade a system from a previously SELinux-disabled system (e.g. how to ensure any restored data like /home is correctly labeled)

JamesMorris — Tue, 17 Jun 2008 12:02:02 GMT

New page: * How to upgrade a system from a previously SELinux-disabled system (e.g. how to ensure any restored data like /home is correctly labeled)

New page

* How to upgrade a system from a previously SELinux-disabled system (e.g. how to ensure any restored data like /home is correctly labeled)