TOMOYO - Revision history

Williami: Update instructions, and various fixes to make it better English.

2010-08-25T15:23:09Z

Update instructions, and various fixes to make it better English.

← Older revision		Revision as of 15:23, 25 August 2010
Line 3:		Line 3:
	!Download Tools Source:		!Download Tools Source:
	\|http://jaist.dl.sourceforge.jp/tomoyo/43376/ccs-tools-1.7.2-20100401.tar.gz (for TOMOYO 1.7)		\|http://jaist.dl.sourceforge.jp/tomoyo/43376/ccs-tools-1.7.2-20100401.tar.gz (for TOMOYO 1.7)
	\|http://jaist.dl.sourceforge.jp/tomoyo/~~30298~~/~~ccs~~-tools-1.6.8-~~20100115~~.tar.gz (for TOMOYO 2.2)		\|http://jaist.dl.sourceforge.jp/tomoyo/41908/tomoyo-tools-2.2.0-20100225.tar.gz (for TOMOYO 2.2)
	\|-		\|-
	!Download Kernel Patch:		!Download Kernel Patch:
Line 15:		Line 15:
	== Dependencies ==		== Dependencies ==

	* None ~~(no more package required for LFS Linux.)~~		* None

	= Building TOMOYO aware kernels =		= Building TOMOYO aware kernels =

	== Kernel 2.6.33.3 with TOMOYO {{TOMOYO-Version}} ==		== Kernel 2.6.35.* with TOMOYO {{TOMOYO-Version}} ==

	Download ~~the~~ ccs-patch-{{TOMOYO-Version}}.tar.gz ~~file~~ and put it in kernel source ~~directory, Patch~~ the kernel ~~source~~:		Download ccs-patch-{{TOMOYO-Version}}.tar.gz and put it in the kernel source dir. Then patch the kernel:

	tar xzvf ccs-patch-{{TOMOYO-Version}}.tar.gz &&		tar xzvf ccs-patch-{{TOMOYO-Version}}.tar.gz &&
	patch -Np1 -i patches/ccs-patch-2.6.33.diff		patch -Np1 -i patches/ccs-patch-2.6.35.diff

	Run "make menuconfig" and ~~go to~~ "Security ~~options~~" ~~screen and select as below.~~		Run "make menuconfig" and enable these options in the "Security Options" section:

	[*] CCSecurity support		[*] CCSecurity support
Line 37:		Line 37:
	(1024) Default maximal count for reject log		(1024) Default maximal count for reject log

	~~Compile~~ and install ~~a new TOMOYO aware~~ kernel.		These can be built as modules if you use a initramfs. Now, compile and install the kernel with the instructions in the book.

	== TOMOYO 2.2.0 ==		== TOMOYO 2.2.0 ==
Line 54:		Line 54:
	[*] TOMOYO Linux Support		[*] TOMOYO Linux Support

	Compile ~~and install a new TOMOYO aware~~ kernel.		Again, these can be built as modules if you use an initramfs. Compile the kernel according to the book.

	= Building TOMOYO Tools =		= Building TOMOYO Tools =

	Download ~~the ccs~~-tools-1.6.8-~~20100115~~.tar.gz (for TOMOYO 2.2) or ccs-tools-1.7.2-20100401.tar.gz (for TOMOYO 1.7) ~~file~~ and put it ~~somewhere.~~		Download tomoyo-tools-2.2.0-20100225.tar.gz (for TOMOYO 2.2) or ccs-tools-1.7.2-20100401.tar.gz (for TOMOYO 1.7), depending on your version, and put it the source directory (either /sources or /usr/src).

	~~Change~~ directory ~~to ccstools~~/ .

	== Non-Multilib ==		== Non-Multilib ==
Line 110:		Line 108:
	== TOMOYO {{TOMOYO-Version}} ==		== TOMOYO {{TOMOYO-Version}} ==

	Run init_policy to perform initial configuration.		Run init_policy to perform the initial configuration.

	/usr/lib/ccs/init_policy		/usr/lib/ccs/init_policy

	You ~~will~~ get ~~initial configuration~~ files in /etc/ccs/ directory.		You should get various files in /etc/ccs/ directory.

	~~You can save~~ audit ~~logs if you do below steps.~~		If you want to, create an audit log in /var/log/tomoyo:

	cat > /etc/rc.d/init.d/ccs-auditd << EOF		cat > /etc/rc.d/init.d/ccs-auditd << EOF
Line 130:		Line 128:
	mkdir -p /var/log/tomoyo		mkdir -p /var/log/tomoyo

	~~You can~~ start ~~your~~ system from Learning Mode if you ~~do below steps.~~		Now, start the system from Learning Mode, so that you can apply future restrictions later if you want to:

	echo '<kernel>' > /etc/ccs/domain_policy.conf		echo '<kernel>' > /etc/ccs/domain_policy.conf
Line 137:		Line 135:
	== TOMOYO 2.2.0 ==		== TOMOYO 2.2.0 ==

	Run tomoyo_init_policy.sh to perform initial configuration.		Run tomoyo_init_policy.sh to perform the initial configuration.

	/usr/lib/ccs/tomoyo_init_policy.sh		/usr/lib/ccs/tomoyo_init_policy.sh

	You ~~will~~ get initial configuration files in /etc/tomoyo/ directory.		You should get initial configuration files in /etc/tomoyo/ directory.

	~~You can~~ start ~~your~~ system from Learning Mode if you ~~do below steps.~~		Now, start the system from Learning Mode, so that you can apply future restrictions later if you want to:

	echo '<kernel>' > /etc/tomoyo/domain_policy.conf		echo '<kernel>' > /etc/tomoyo/domain_policy.conf
Line 155:		Line 153:
	Without CCS= parameter or <name> is "default", /etc/ccs/profile.conf will be loaded.		Without CCS= parameter or <name> is "default", /etc/ccs/profile.conf will be loaded.
	You can use CCS=ask to let user select from available profiles in /etc/ccs/ at boot time		You can use CCS=ask to let user select from available profiles in /etc/ccs/ at boot time
	You can use CCS=disable to boot as usual Linux (i.e. without TOMOYO protection).		You can use CCS=disable to boot as usual Linux (i.e. without TOMOYO protection). This is just an example:

	root=/dev/hda8 ro vga=791 video=neofb:ywrap,mtrr acpi=off CCS=default		root=/dev/hda8 ro vga=791 video=neofb:ywrap,mtrr acpi=off CCS=default
Line 163:		Line 161:
	Same as TOMOYO {{TOMOYO-Version}}, except that the policies are loaded from /etc/tomoyo/ directory.		Same as TOMOYO {{TOMOYO-Version}}, except that the policies are loaded from /etc/tomoyo/ directory.

	But, be sure to add security=tomoyo parameter.		But, be sure to add the security=tomoyo parameter. This is, again, just an example:

	root=/dev/hda8 ro vga=791 video=neofb:ywrap,mtrr acpi=off CCS=default security=tomoyo		root=/dev/hda8 ro vga=791 video=neofb:ywrap,mtrr acpi=off CCS=default security=tomoyo

Kumaneko at 01:09, 4 May 2010

2010-05-04T01:09:45Z

← Older revision		Revision as of 01:09, 4 May 2010
Line 19:		Line 19:
	= Building TOMOYO aware kernels =		= Building TOMOYO aware kernels =

	== Kernel 2.6.33.2 with TOMOYO {{TOMOYO-Version}} ==		== Kernel 2.6.33.3 with TOMOYO {{TOMOYO-Version}} ==

	Download the ccs-patch-{{TOMOYO-Version}}.tar.gz file and put it in kernel source directory, Patch the kernel source:		Download the ccs-patch-{{TOMOYO-Version}}.tar.gz file and put it in kernel source directory, Patch the kernel source:

Kumaneko at 13:02, 12 April 2010

2010-04-12T13:02:54Z

← Older revision		Revision as of 13:02, 12 April 2010
Line 2:		Line 2:
	\|-		\|-
	!Download Tools Source:		!Download Tools Source:
	\|http://jaist.dl.sourceforge.jp/tomoyo/43376/ccs-tools-1.7.1-~~20100110~~.tar.gz (for TOMOYO 1.7)		\|http://jaist.dl.sourceforge.jp/tomoyo/43376/ccs-tools-1.7.2-20100401.tar.gz (for TOMOYO 1.7)
	\|http://jaist.dl.sourceforge.jp/tomoyo/30298/ccs-tools-1.6.8-20100115.tar.gz (for TOMOYO 2.2)		\|http://jaist.dl.sourceforge.jp/tomoyo/30298/ccs-tools-1.6.8-20100115.tar.gz (for TOMOYO 2.2)
	\|-		\|-
Line 19:		Line 19:
	= Building TOMOYO aware kernels =		= Building TOMOYO aware kernels =

	== Kernel 2.6.33.1 with TOMOYO {{TOMOYO-Version}} ==		== Kernel 2.6.33.2 with TOMOYO {{TOMOYO-Version}} ==

	Download the ccs-patch-{{TOMOYO-Version}}.tar.gz file and put it in kernel source directory, Patch the kernel source:		Download the ccs-patch-{{TOMOYO-Version}}.tar.gz file and put it in kernel source directory, Patch the kernel source:
Line 58:		Line 58:
	= Building TOMOYO Tools =		= Building TOMOYO Tools =

	Download the ccs-tools-1.6.8-20100115.tar.gz (for TOMOYO 2.2) or ccs-tools-1.7.1-~~20100110~~.tar.gz (for TOMOYO 1.7) file and put it somewhere.		Download the ccs-tools-1.6.8-20100115.tar.gz (for TOMOYO 2.2) or ccs-tools-1.7.2-20100401.tar.gz (for TOMOYO 1.7) file and put it somewhere.

	Change directory to ccstools/ .		Change directory to ccstools/ .

Kumaneko at 15:30, 26 March 2010

2010-03-26T15:30:31Z

← Older revision		Revision as of 15:30, 26 March 2010
Line 19:		Line 19:
	= Building TOMOYO aware kernels =		= Building TOMOYO aware kernels =

	== Kernel 2.6.32.8 with TOMOYO {{TOMOYO-Version}} ==		== Kernel 2.6.33.1 with TOMOYO {{TOMOYO-Version}} ==

	Download the ccs-patch-{{TOMOYO-Version}}.tar.gz file and put it in kernel source directory, Patch the kernel source:		Download the ccs-patch-{{TOMOYO-Version}}.tar.gz file and put it in kernel source directory, Patch the kernel source:

	tar xzvf ccs-patch-{{TOMOYO-Version}}.tar.gz &&		tar xzvf ccs-patch-{{TOMOYO-Version}}.tar.gz &&
	patch -Np1 -i patches/ccs-patch-2.6.32.diff		patch -Np1 -i patches/ccs-patch-2.6.33.diff

	Run "make menuconfig" and go to "Security options" screen and select as below.		Run "make menuconfig" and go to "Security options" screen and select as below.

Kumaneko at 07:23, 14 February 2010

2010-02-14T07:23:09Z

← Older revision		Revision as of 07:23, 14 February 2010
Line 3:		Line 3:
	!Download Tools Source:		!Download Tools Source:
	\|http://jaist.dl.sourceforge.jp/tomoyo/43376/ccs-tools-1.7.1-20100110.tar.gz (for TOMOYO 1.7)		\|http://jaist.dl.sourceforge.jp/tomoyo/43376/ccs-tools-1.7.1-20100110.tar.gz (for TOMOYO 1.7)
	\|http://jaist.dl.sourceforge.jp/tomoyo/30298/ccs-tools-1.6.8-~~20091111~~.tar.gz (for TOMOYO 2.2)		\|http://jaist.dl.sourceforge.jp/tomoyo/30298/ccs-tools-1.6.8-20100115.tar.gz (for TOMOYO 2.2)
	\|-		\|-
	!Download Kernel Patch:		!Download Kernel Patch:
Line 19:		Line 19:
	= Building TOMOYO aware kernels =		= Building TOMOYO aware kernels =

	== Kernel 2.6.32.2 with TOMOYO {{TOMOYO-Version}} ==		== Kernel 2.6.32.8 with TOMOYO {{TOMOYO-Version}} ==

	Download the ccs-patch-{{TOMOYO-Version}}.tar.gz file and put it in kernel source directory, Patch the kernel source:		Download the ccs-patch-{{TOMOYO-Version}}.tar.gz file and put it in kernel source directory, Patch the kernel source:
Line 58:		Line 58:
	= Building TOMOYO Tools =		= Building TOMOYO Tools =

	Download the ccs-tools-1.6.8-~~20091111~~.tar.gz (for TOMOYO 2.2) or ccs-tools-1.7.1-20100110.tar.gz (for TOMOYO 1.7) file and put it somewhere.		Download the ccs-tools-1.6.8-20100115.tar.gz (for TOMOYO 2.2) or ccs-tools-1.7.1-20100110.tar.gz (for TOMOYO 1.7) file and put it somewhere.

	Change directory to ccstools/ .		Change directory to ccstools/ .

Kumaneko at 12:24, 10 January 2010

2010-01-10T12:24:03Z

← Older revision		Revision as of 12:24, 10 January 2010
Line 2:		Line 2:
	\|-		\|-
	!Download Tools Source:		!Download Tools Source:
	\|http://jaist.dl.sourceforge.jp/tomoyo/43376/ccs-tools-1.7.1-~~20091111~~.tar.gz (for TOMOYO 1.7)		\|http://jaist.dl.sourceforge.jp/tomoyo/43376/ccs-tools-1.7.1-20100110.tar.gz (for TOMOYO 1.7)
	\|http://jaist.dl.sourceforge.jp/tomoyo/30298/ccs-tools-1.6.8-20091111.tar.gz (for TOMOYO 2.2)		\|http://jaist.dl.sourceforge.jp/tomoyo/30298/ccs-tools-1.6.8-20091111.tar.gz (for TOMOYO 2.2)
	\|-		\|-
Line 58:		Line 58:
	= Building TOMOYO Tools =		= Building TOMOYO Tools =

	Download the ccs-tools-1.6.8-20091111.tar.gz (for TOMOYO 2.2) or ccs-tools-1.7.1-~~20091111~~.tar.gz (for TOMOYO 1.7) file and put it somewhere.		Download the ccs-tools-1.6.8-20091111.tar.gz (for TOMOYO 2.2) or ccs-tools-1.7.1-20100110.tar.gz (for TOMOYO 1.7) file and put it somewhere.

	Change directory to ccstools/ .		Change directory to ccstools/ .

Kumaneko at 08:26, 20 December 2009

2009-12-20T08:26:45Z

← Older revision		Revision as of 08:26, 20 December 2009
Line 19:		Line 19:
	= Building TOMOYO aware kernels =		= Building TOMOYO aware kernels =

	== Kernel 2.6.32~~-rc6~~ with TOMOYO {{TOMOYO-Version}} ==		== Kernel 2.6.32.2 with TOMOYO {{TOMOYO-Version}} ==

	Download the ccs-patch-{{TOMOYO-Version}}.tar.gz file and put it in kernel source directory, Patch the kernel source:		Download the ccs-patch-{{TOMOYO-Version}}.tar.gz file and put it in kernel source directory, Patch the kernel source:

Kumaneko at 11:43, 12 November 2009

2009-11-12T11:43:20Z

← Older revision		Revision as of 11:43, 12 November 2009
Line 2:		Line 2:
	\|-		\|-
	!Download Tools Source:		!Download Tools Source:
	\|http://jaist.dl.sourceforge.jp/tomoyo/43376/ccs-tools-1.7.1-20091111.tar.gz		\|http://jaist.dl.sourceforge.jp/tomoyo/43376/ccs-tools-1.7.1-20091111.tar.gz (for TOMOYO 1.7)
			\|http://jaist.dl.sourceforge.jp/tomoyo/30298/ccs-tools-1.6.8-20091111.tar.gz (for TOMOYO 2.2)
	\|-		\|-
	!Download Kernel Patch:		!Download Kernel Patch:
Line 57:		Line 58:
	= Building TOMOYO Tools =		= Building TOMOYO Tools =

	Download the ccs-tools-1.6.8-20091111.tar.gz ~~file from http://jaist.dl.sourceforge~~.~~jp/tomoyo/30298/~~ccs-tools-1.6.8-20091111.tar.gz and put it somewhere.		Download the ccs-tools-1.6.8-20091111.tar.gz (for TOMOYO 2.2) or ccs-tools-1.7.1-20091111.tar.gz (for TOMOYO 1.7) file and put it somewhere.

	Change directory to ccstools/ .		Change directory to ccstools/ .

Kumaneko at 11:38, 12 November 2009

2009-11-12T11:38:32Z

← Older revision		Revision as of 11:38, 12 November 2009
Line 2:		Line 2:
	\|-		\|-
	!Download Tools Source:		!Download Tools Source:
	\|http://jaist.dl.sourceforge.jp/tomoyo/~~30298~~/ccs-tools-1.6.8-~~20090623~~.tar.gz		\|http://jaist.dl.sourceforge.jp/tomoyo/43376/ccs-tools-1.7.1-20091111.tar.gz
	\|-		\|-
	!Download Kernel Patch:		!Download Kernel Patch:
	\|http://jaist.dl.sourceforge.jp/tomoyo/~~30297~~/ccs-patch-{{TOMOYO-Version}}.tar.gz		\|http://jaist.dl.sourceforge.jp/tomoyo/43375/ccs-patch-{{TOMOYO-Version}}.tar.gz
	\|-}		\|-}

Line 18:		Line 18:
	= Building TOMOYO aware kernels =		= Building TOMOYO aware kernels =

	== Kernel 2.6.~~30.1~~ with TOMOYO {{TOMOYO-Version}} ==		== Kernel 2.6.32-rc6 with TOMOYO {{TOMOYO-Version}} ==

	Download the ccs-patch-{{TOMOYO-Version}}.tar.gz file and put it in kernel source directory, Patch the kernel source:		Download the ccs-patch-{{TOMOYO-Version}}.tar.gz file and put it in kernel source directory, Patch the kernel source:

	tar xzvf ccs-patch-{{TOMOYO-Version}}.tar.gz &&		tar xzvf ccs-patch-{{TOMOYO-Version}}.tar.gz &&
	patch -Np1 -i patches/ccs-patch-2.6.30.diff		patch -Np1 -i patches/ccs-patch-2.6.32.diff

	Run "make menuconfig" and go to "~~File systems~~" screen and select as below.		Run "make menuconfig" and go to "Security options" screen and select as below.

	[*] ~~SAKURA (Domain-Free Mandatory Access Control) support~~		[*] CCSecurity support
	~~[*] TOMOYO (Domain-Based Mandatory Access Control)~~ support
	(2048) Default maximal count for learning mode		(2048) Default maximal count for learning mode
			(/sbin/ccs-init) Default policy loader
			(/sbin/ccs-start) Alternative activation trigger
	(/sbin/modprobe /sbin/hotplug) Built-in domain initializer programs		(/sbin/modprobe /sbin/hotplug) Built-in domain initializer programs
	[*] Auditing interface support		[*] Auditing interface support
	(1024) Default maximal count for grant log		(1024) Default maximal count for grant log
	(1024) Default maximal count for reject log		(1024) Default maximal count for reject log
	~~<M> SYAORAN (Tamper-Proof Device Filesystem) support~~

	Compile and install a new TOMOYO aware kernel.		Compile and install a new TOMOYO aware kernel.
Line 57:		Line 57:
	= Building TOMOYO Tools =		= Building TOMOYO Tools =

	Download the ccs-tools-1.6.8-~~20090623~~.tar.gz file and put it somewhere.		Download the ccs-tools-1.6.8-20091111.tar.gz file from http://jaist.dl.sourceforge.jp/tomoyo/30298/ccs-tools-1.6.8-20091111.tar.gz and put it somewhere.

	Change directory to ccstools/ .		Change directory to ccstools/ .
Line 109:		Line 109:
	== TOMOYO {{TOMOYO-Version}} ==		== TOMOYO {{TOMOYO-Version}} ==

	Run init_policy~~.sh~~ to perform initial configuration.		Run init_policy to perform initial configuration.

	/usr/lib/ccs/init_policy~~.sh~~		/usr/lib/ccs/init_policy

	You will get initial configuration files in /etc/ccs/ directory.		You will get initial configuration files in /etc/ccs/ directory.
Line 119:		Line 119:
	cat > /etc/rc.d/init.d/ccs-auditd << EOF		cat > /etc/rc.d/init.d/ccs-auditd << EOF
	#!/bin/sh		#!/bin/sh
	/usr/~~lib/ccs~~/ccs-auditd /dev/null /var/log/tomoyo/reject_log.txt		/usr/sbin/ccs-auditd /dev/null /var/log/tomoyo/reject_log.txt
	EOF		EOF

Line 225:		Line 225:
	\|Assigns a profile to domains.		\|Assigns a profile to domains.
	\|-valign="top"		\|-valign="top"
	!ccs-ccstree		!ccs-pstree (for TOMOYO 1.7) ccs-ccstree (for TOMOYO 2.2)
	\|Lists the domainnames of currently running processes belong to and the profile numbers the domains currently assigned to.		\|Lists the domainnames of currently running processes belong to and the profile numbers the domains currently assigned to.
	\|-valign="top"		\|-valign="top"
	!ccs-savepolicy		!ccs-savepolicy
	\|Saves the on-memory policy onto disk.		\|Saves the on-memory policy onto disk.
	~~\|-valign="top"~~
	~~!makesyaoranconf~~
	\|Generates syaoran.conf, the configuration file for SYAORAN (the Tamper-Proof /dev filesystem). You can use SYAORAN filesystem if you want to run the system with read-only root fs or you want to prevent device files from tampering.
	\|-valign="top"		\|-valign="top"
	!ccs-auditd		!ccs-auditd

Kumaneko at 04:48, 12 July 2009

2009-07-12T04:48:23Z

← Older revision		Revision as of 04:48, 12 July 2009
Line 2:		Line 2:
	\|-		\|-
	!Download Tools Source:		!Download Tools Source:
	\|http://jaist.dl.sourceforge.jp/tomoyo/30298/ccs-tools-1.6.8-~~20090528~~.tar.gz		\|http://jaist.dl.sourceforge.jp/tomoyo/30298/ccs-tools-1.6.8-20090623.tar.gz
	\|-		\|-
	!Download Kernel Patch:		!Download Kernel Patch:
Line 18:		Line 18:
	= Building TOMOYO aware kernels =		= Building TOMOYO aware kernels =

	== Kernel 2.6.29.4 with TOMOYO {{TOMOYO-Version}} ==		== Kernel 2.6.30.1 with TOMOYO {{TOMOYO-Version}} ==

	Download the ccs-patch-{{TOMOYO-Version}}.tar.gz file and put it in kernel source directory, Patch the kernel source:		Download the ccs-patch-{{TOMOYO-Version}}.tar.gz file and put it in kernel source directory, Patch the kernel source:

	tar xzvf ccs-patch-{{TOMOYO-Version}}.tar.gz &&		tar xzvf ccs-patch-{{TOMOYO-Version}}.tar.gz &&
	patch -Np1 -i patches/ccs-patch-2.6.29.diff		patch -Np1 -i patches/ccs-patch-2.6.30.diff

	Run "make menuconfig" and go to "File systems" screen and select as below.		Run "make menuconfig" and go to "File systems" screen and select as below.
Line 38:		Line 38:
	Compile and install a new TOMOYO aware kernel.		Compile and install a new TOMOYO aware kernel.

	== ~~Kernel 2.6.30-rc8 with~~ TOMOYO 2.2.0 ==		== TOMOYO 2.2.0 ==

	Download 2.6.30~~-rc8~~ (or later) from http://www.kernel.org/ and extract it.		Download 2.6.30 (or later) from http://www.kernel.org/ and extract it.

	Run "make menuconfig" and go to "Security options" screen and select "TOMOYO Linux support" as shown below.		Run "make menuconfig" and go to "Security options" screen and select "TOMOYO Linux support" as shown below.
Line 57:		Line 57:
	= Building TOMOYO Tools =		= Building TOMOYO Tools =

	Download the ccs-tools-1.6.8-~~20090528~~.tar.gz file and put it somewhere.		Download the ccs-tools-1.6.8-20090623.tar.gz file and put it somewhere.

	Change directory to ccstools/ .		Change directory to ccstools/ .