[apparmor] GSoC proposal text

[Christian Boltz]

Hello,

Am Samstag, 9. März 2013 schrieb John Johansen:
> Here is a first pass at a proposal to implement a new learning tool
> for GSoC (Google Summer of Code)

Thanks for your text!

While it is probably very correct, it sounds quite technically and is 
probably hard to understand for people that don't know AppArmor yet. 
(Some parts are even hard to understand for me ;-)

Let me add some comments and proposed additions (marked by +) inline.

> Cross-distribution topic
> 
> AppArmor profile development tool
> 
> Description: The AppArmor project is a MAC like security extension for
> Linux. Its policy is based around profiles that are used to define
> the set of permission an application will be granted.
> 
> The project goal is to implement a new smarter profile development
> tool, that is better at creating abstractions, and inter-profile
> policy analysis.
>
> The base part of the project will be to implement a library and basic
> tool using the library that can develop a profile from logs files,

+  (audit.log)

> and basic user interaction.

+  This tool will replace the existing aa-logprof and aa-genprof tools.

(In other words: the student can try out aa-logprof to get an idea what 
he's expected to write ;-)

> The remainder of the project will be to extend the base library and
> tool, in any of several possible directions: 

> doing inter-rule and inter-profile static analysis, 

What do you mean with that?

I'd also
+  Create a tool to merge two profiles into one (working similar 
+  to logprof, but takes a profile instead of a log as input)

> doing static analysis on applications
> to extract possible rule patterns, 

In other words and extremely simplified:
    strings /usr/bin/foo | grep /
? ;-)

> or developing a better interface that will aid the user in being able 
> to find abstractions, 

That's already part of aa-logprof/aa-genprof, so I wouldn't put this in 
the part with optional stuff.

> and analyze inter-profile behavior.

What exactly do you mean with this?

I'd also
+  The profile development tool should be written in Python or Go.

(assuming Go is another programming language you'd like ;-)

> Required knowledge: basic C, 

Personally I'd have guessed that C isn't really needed because the 
existing aa-logprof is perl and the new one is in Python or Go. What did 
I overlook?

> Python or Go, 

> YCP (depenent on implementation route), 

Which part would require YCP knownledge?
(or did you forget to mention "update the YaST2 AppArmor module"?)

> some knowledge of Perl would be good but is not required

Well, I'd guess understanding the existing perl code would be good. 
Or are aa-logprof and AppArmor.pm so bad that people better don't look 
at them? ;-)

> Skill Level: Intermediate - Hard (depends on implementation route)
> 
> Mentor: John Johansen, Christian Boltz

Looks like I might have a new "job" in the summer ;-)  No problem, but 
I'll probably forward the more technical questions to you.


Regards,

Christian Boltz
-- 
Ich rede davon, daß eine defekte Schrift an freetype übergeben wird (Daß
sie defekt ist, kann ich ja nicht prüfen), woraufhin freetype irgendeine
(defekte) Anweisung im Fontcode ohne Prüfung ausführt und erstmal
getreulich versucht, sagenwirmal 5 Okobyte RAM von der Adresse $IRSINN
nach $WAHNSINN zu verschieben. [Ratti in suse-programming]