Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Security Software United States Linux

NSA Releases Updated SELinux 319

Posted by timothy from the now-they-have-to-kill-you dept.
darthcamaro writes "Looks like our federal tax dollars are hard at work - improving security on Linux! The NSA - you know the folks that are shadowy figures on X-files - have released the latest updates to SELinux (security enhanced). Internetnews.com has got a piece on it where they talk to Gentoo and Red Hat about the release's significance."
This discussion has been archived. No new comments can be posted.

NSA Releases Updated SELinux More

NSA Releases Updated SELinux

Comments Filter:

  • eeeeenteresting.... (Score:5, Funny)

    by JoeLinux ( 20366 ) <joelinux@gma[ ]com ['il.' in gap]> on Tuesday February 24, 2004 @08:32PM (#8380386)
    I wonder how it compares to Tin Foil Hat Linux?

    Anyone can provide contrast/comparisons?

  • Shouldn't this be our default system? (Score:4, Interesting)

    by ObviousGuy ( 578567 ) <ObviousGuy@hotmail.com> on Tuesday February 24, 2004 @08:33PM (#8380389) Homepage Journal
    What kinds of changes in SELinux would be NOT welcome in mainstream Linux distros?

  • X-Files Eh? (Score:5, Funny)

    by mattdev121 ( 727783 ) on Tuesday February 24, 2004 @08:34PM (#8380404) Homepage
    ScullyEnhanced Linux?
    I'm in. Where do i get it?

  • Now with 200% more... (Score:3, Funny)

    by MikeCapone ( 693319 ) <skelterhell @ y a hoo.com> on Tuesday February 24, 2004 @08:34PM (#8380410) Homepage Journal
    ...backdoors!

  • Context (Score:5, Interesting)

    by lukewarmfusion ( 726141 ) on Tuesday February 24, 2004 @08:35PM (#8380417) Homepage Journal
    This comes right on the heels of a report [slashdot.org] by a security firm that Linux was the most vulnerable server OS...

    On the other hand, I think this is a great example of why open source software is a good thing - anyone, the government included, can improve the software. I'm sure they feel much better about using an OS that they've personally inspected and tested than something else [microsoft.com].

    • Agree Strongly. (Score:5, Insightful)

      by Anonymous Coward on Tuesday February 24, 2004 @08:48PM (#8380540)
      You can say whatever you like about backdoors and the like, but you can be goddamned sure i want some of the brightest minds in this country looking at the code i use as opposed to the dumbfucks that i graduate with that go to work for regular companies. As for the brightest minds? Just take a look at the requirements to work for the NSA vs. Microsoft (and NO, i'm not talking about security requirements).
  • Whoooo nelly... It kind of makes you wonder what kind of "enhanced security" those boys loaded that thing up with?

    I am guessing it will either somehow steal every bit of information, including your fingerprints

    or be totally sweet

    • Re:Better go over the source... twice (Score:5, Insightful)

      by Tackhead ( 54550 ) on Tuesday February 24, 2004 @08:49PM (#8380558)
      > Whoooo nelly... It kind of makes you wonder what kind of "enhanced security" those boys loaded that thing up with?

      Well, those who are able should be going over the source closely anyways. The adversaries are!

      Remember, NSA has two mandates:
      1) Help Americans secure their boxen, and
      2) Be able to 0wnz0r any non-American's boxen.

      Just because #2 gets all the press on Slashdot doesn't invalidate #1. The net effect of "more machines on the network are secure, even though some of those machines are used by non-Americans, and even if that fact makes some things a little more difficult for the other half of NSA" is still an increase in security for Americans.

      SELinux is consistent with NSA's goals in providing a secure information infrastructure for US Citizens. Given that NSA knows that the code will be closely examined by both NSA-friendly and NSA-hostile folk alike, I'd expect SELinux code to be safe, and would treat such code with a policy of "trust, but verify." (More precisely: "Verify, but trust.")

      • DES is a great example of the NSA working for the general bebefit of the public. Im sure everyone uses DES all the time and doesnt realize that NSA has the major contibuter to that project. Granted no one has really been able to figure out why the DES encryption works they way it does (see DES boxes) it is still a great encryption tool that has not been broken ( for those morons who say DES is broken, read a book).
        • Actually the ONLY contribution the NSA made to DES was to tweak the S-Box selection criteria to help thwart differential crypto analysis (20 years before the public sector rediscovered the technique). The cypher itself was written 100% at IBM and was an extension of LUFICER.
      • 2) Be able to 0wnz0r any non-American's boxen.
        I think that needs to be changed to 2) Be able to 0wnz0r any terrorist boxen. This group includes everyone who is not a citizen of USA and many who are, including, according to our secretary of education, all teachers.

  • Rather generous of the NSA (Score:5, Insightful)

    by mrdaveb ( 239909 ) on Tuesday February 24, 2004 @08:37PM (#8380437) Homepage
    Seeing as any changes the NSA make are presumably only used internally by the agency, they are under no obligation to release the source. So this is quite a community spirited move on their part.

    Unless of course they are trying to sneak some NSA backdoors into Linux kernels :-)

    • Re:Rather generous of the NSA (Score:5, Insightful)

      by ePhil_One ( 634771 ) on Tuesday February 24, 2004 @08:44PM (#8380495) Journal
      Seems like folks (other than me :) could trivially diff the source and find out what "enhancements" thay have made. I would expect that the authors of the code would be very interested in the changes amd would check it out, at the very least.

      All in all, this is a very good thing. If nothing else, its kind of hard for other OS's to compete with "The NSA's OS" on security concerns.

    • Re:Rather generous of the NSA (Score:5, Insightful)

      by Gorath99 ( 746654 ) on Tuesday February 24, 2004 @08:48PM (#8380541)
      Well, since it's all GPL anyone can go though the code to look for backdoors. If the NSA has actually planted backdoors and they're found, then that is sure to backlash at them bigtime (nobody will trust them ever again), so I don't think they actually put any in.

      However, that doesn't mean that taking a long and critical look at the modifications isn't worthwhile...

      • Re:Rather generous of the NSA (Score:5, Insightful)

        by Artifakt ( 700173 ) on Tuesday February 24, 2004 @09:05PM (#8380705)
        "(nobody will trust them ever again)"

        Like the average slashdotter trusted them now.

        Why should it surprise people if this code is clean. The NSA wanted an OS that they could examine, for their own security. They got one, and made sure it was as safe as possible so they could run it internally. Then they did what a government agency is supposed to do, that is, act like the law applied to them as well and respect the GPL. Like it would be smart to bite the hand that feeds them, and have to go back to using an OS they would have a harder time verifying.
        • Read the GPL again. Nothing requires you to give away the source to a GPL program. You need to provide source to anyone you give modified binaries to. Thus if the NSA kept it in house they could keep it to themselves. In addition they could in theroy provide to other classified agencies. Who in turn would be able to keep it in house.
      • Of course. And hence my smiley.

        Although there has been at least one known attempt to deliberately insert a security hole into the Linux kernel before, it would be a pretty outrageous thing for a government to attempt. It would almost certainly be spotted.

        If the NSA are into that sort of thing, they are more likely to sneak/coerce their backdoor into closed source software where it is more likely to go unnoticed and perhaps be harder to trace back to it's authors.
    • seeing as even federal government agencies already believe in the GPL.

    • Re:Rather generous of the NSA (Score:5, Funny)

      by AndroidCat ( 229562 ) on Tuesday February 24, 2004 @09:03PM (#8380684) Homepage
      They'll regret such foolish generousity when Darl and SCO bitch-slap them with a law-suit and a request for n*$699 (for secret values of n). [Bugs voice] Please Jacques, not this distro!

      • Re:Rather generous of the NSA (Score:5, Funny)

        by multiplexo ( 27356 ) on Tuesday February 24, 2004 @09:58PM (#8381185) Journal
        "Hello Mr. McBride, welcome to the National Security Agency Before we talk about your lawsuit and IP claims
        we'd like to show you a few things. Exhibit one. A picture of you entering a hotel room in Orem with two live nanny goats, a
        rubber raft, a pair of chaps and a can of Frymax fryer grease. Exhibit 2. Pictures from within the room of activities which violate the laws of God and Man, if not those of the State of Utah. Exhibit 3, credit card receipts for animal tranquilizers and male goat hormones. Shall we continue?"
    • This code is, has been, and will be some of the most highly scrutinized code. Especially by foreign governments and security shops seeking to learn from some of the more brighter minds the US has to offer. If anything is found it would be a national, global incident and make the NSA look very, very bad. No way they do that. A back door would be found nearly immediatly and they know it. c'mon now could you imagine the headlines? "NSA attempts to control the world" Even our other government agencies would whi
    • You are ofcourse assuming that the NSA uses Linux. I seriously doubt, anything you find on the net is in operation at NSA guarding real secrets.

      Anyway, the NSA has two tasks SIGINT (signal intelligence) or code breaking, and the other is Information Assurance as it relates to US National Security interests.

      Both are broad tasks, the most exciting and romantic is ofcourse is the SIGINT code breaking, spying, espionage, being clever, etc.

      The janitorial work is the Information Assurance, and that is the prot

  • Come on (Score:2, Insightful)

    by Hi_2k ( 567317 )
    Shadowy? Since when are the NSA guys "Shadowy"? I have an uncle who used to work for them (he's retired), and he's a great guy.

    Although, that may describe why he always has those blind marks across his face.
    • I noticed this too. Is that kind of stereotype really that prevalent (or is it just accurate)? All of the NSA folks I've met (not many, mind you) were less shadowy than my mailman.

      Then again, I'm pretty sure my mailman opens my birthday cards.

      • Re:Come on (Score:4, Funny)

        by sik0fewl ( 561285 ) <xxdigitalhellxxNO@SPAMhotmail.com> on Tuesday February 24, 2004 @08:55PM (#8380607) Homepage

        Then again, I'm pretty sure my mailman opens my birthday cards.

        So does the NSA :)

      • Is that kind of stereotype really that prevalent (or is it just accurate)? All of the NSA folks I've met (not many, mind you) were less shadowy than my mailman.

        Is it just another case of life imitating art [upn.com]? ;-)

        Using the term "art" extremely loosely, of course.

        Spotting NSA agents should be pretty darn easy according to Jake 2.0,
        just look for the pretty boy or the hot chick.

      • Re:Come on (Score:3, Interesting)

        by qtp ( 461286 )
        The NSA is mostly a bunch of geeks.

        The vast majority of their work is maintaining secure communications for the military and other intelligence agencies plus analizing (code breaking) intercepted secure transmissions. The movie "the Falcon and the Snowman" depicted their work fairly accurately, compiling lists and transcripts of monitored communications and forwarding them to the apropriate parties.

        These are not the guys who start wars and disappear people (that would be the CIA). That's not to say they

  • I am curious (Score:5, Interesting)

    by enrayged ( 67136 ) <ray@nosPaM.guildsites.com> on Tuesday February 24, 2004 @08:39PM (#8380458) Homepage
    Does the security enhancements developed by the NSA slow down the kernel? Does it make it harder to set up services such as email or apache? How much more secure is it than a standard vanilla kernel?

    I have not had the opportunity to play with SELinux but am interested in how it works, how difficult it is to set up properly and all that fun stuff

    • Re:I am curious (Score:5, Informative)

      by temojen ( 678985 ) on Tuesday February 24, 2004 @09:07PM (#8380717) Journal
      Does the security enhancements developed by the NSA slow down the kernel?
      No
      Does it make it harder to set up services such as email or apache? Yes
      How much more secure is it than a standard vanilla kernel?

      It's not much more secure, except that it's based on a more flexible permissions system. So even Root may not have full root access, and it's not nescesary to be root to run a server (bind to ports lower than 1024), so long as you're given permission to that port. Also there's a lot more auditing support.

      So for standalone home desktops, it's mostly not nescesary, but for Banks, the military, and others than need a major paper trail for everything it's worthwhile.

    • How its predecessor worked (Score:5, Informative)

      by billstewart ( 78916 ) on Tuesday February 24, 2004 @10:36PM (#8381605) Journal
      I worked with AT&T's Multi-Level-Secure System V/MLS systems in the late 80s. Some details have changed since then (:-), but the basics are mostly the same. Most of the changes were in file and device access permissions and logging. The permissions features don't slow anything down significantly (except of course by stopping unapproved accesses altogether), and at the time, the logging functions were implemented very cleanly and rapidly, typically burning under 5% of horsepower (mostly disk access to save the very compact log entries.)

      Some services are harder to set up, because the permission issues get in the way, especially if they expect to have an all-powerful root doing the work for them, or if the application does lots of work to secure themselves (chroot jails, etc.), but most applications aren't affected much. Anything that does much with Setuid() can expect a radically different environment underneath.

      The big security win is that you can define different security compartments, including one or more for the operating system itself, and applications can only read from lower-security-level compartments, not write to them. This means that even if somebody finds an egregious buffer overflow bug in your email client, and uses it to mail your precious files to kgbvax.dhs.gov, they still can't use that to r00t your machine, and it's very hard for them to accomplish much by leaving Trojan Horse files around in your home directory because root usually isn't allowed to read them without you explicitly authorizing them.

  • NSA and Common Criteria Evaluation (Score:2, Insightful)

    by Anonymous Coward
    Can we expect that NSA will also do EAL5 for Linux for free?

  • About time (Score:5, Insightful)

    by cluge ( 114877 ) on Tuesday February 24, 2004 @08:41PM (#8380467) Homepage
    I find extremely disheartening that our tax dollars go into products, ideas and research that is then turned around and used for the benefeit of ONE company (see big drug companies, defense contractors, and certain university proffesors). That just seems plain "un-american". Here we have a rare exception, our tax dollar going to improve something for ALL americans (and the world too).

    Sadly Microsoft is lobbying to shut down the NSA's involvement in free software, claiming that the government is essentially "competing" with them. Somehow our tax dollar going to work securing windows isn't communist according to MS. Just if it also helps someone that ISN'T MS. Lets hope they fail.

    In the end, this can only be a good thing for ALL OS designers. It helps them look at how the people that stay awake at night worrying a lot think about security in an operating system.

    AngryPeopleRule [angrypeoplerule.com]

    • Re:About time (Score:5, Funny)

      by lukewarmfusion ( 726141 ) on Tuesday February 24, 2004 @08:46PM (#8380522) Homepage Journal
      Hell, this could be good for all OS users
      Imagine grandpa sitting down to breakfast, reading the paper, and seeing this article (if it's published in his paper). Maybe - just maybe, he'll think *is my computer secure?* And he'll realize it is.

      Knowing my fiancee's grandfather though, he'll think *those spooks are using my social security money on computer games?!*
    • Sadly Microsoft is lobbying to shut down the NSA's involvement in free software, claiming that the government is essentially "competing" with them. Somehow our tax dollar going to work securing windows isn't communist according to MS. Just if it also helps someone that ISN'T MS. Lets hope they fail.

      If the NSA pored over the Windows code and made it secure, well, then you would have big government.

      "It required a work force of 384 slaves, 34 slave drivers, 12 engineers, 2 turtle doves, and a partridge in a

    • Well, NSAs involvement with closed source would be bad - even if they introduced backdoors, there is no way you are going to be able to find it, unlike in the case of Open Source :)

      On another note, not to troll, but I was wondering if you had any references to substantiate your argument on Microsoft lobbying against NSA Linux (just out of curiosity!).

      Thanks.

    • Microsoft vs. NSA (Score:5, Interesting)

      by Animats ( 122034 ) on Tuesday February 24, 2004 @11:41PM (#8382344) Homepage
      Microsoft tried to shut the NSA Secure Linux effort down once before. The result was amusing.

      For about a year, NSA stopped talking about SELinux. Then one day there was an announcement in the Linux kernel mailing list that SELinux had been updated to the current kernel version and was becoming part of the mainstream kernel.

      Now it's mainstream.

  • They didn't get the memo (Score:3, Funny)

    by Kid Brother of St. A ( 662151 ) on Tuesday February 24, 2004 @08:41PM (#8380469)
    I guess NSA didn't get the memo -- or the lobbyists -- from SCO telling them that open source software was a security risk and that terrorists could use it to make their own supercomputer.

  • hmm... (Score:3)

    by frodo from middle ea ( 602941 ) on Tuesday February 24, 2004 @08:41PM (#8380473) Homepage
    I distinctly remember reading that NSA stopped deveolpment on this project , under pressure from US govt. which was under pressure from Microsoft..So what happend now ?
    But then again I read that on /. , so the authenticity of it is highly questionable.

  • A few quick comments (Score:5, Interesting)

    by picklepuss ( 749206 ) on Tuesday February 24, 2004 @08:44PM (#8380492) Homepage
    I just want to toss out the notion that the general complaint that slashdot readers don't read the article, and the slashdot effect are mutually exclusive. There were only 8 replies to this thread when I clicked the main article link, and although it wasn't completely slashdotted, it was incredibly slow coming up.

    My second comment is really a question: How do we weigh this up against Mr. McBride's letters to congressmen? It seems like they would probably lean on the NSA for advice on what's secure and what's not, rather than the seemed ravings of a madman.

    I would also throw out a little pointer that probably one of the major reasons that the NSA is working on the Linux Kernel is simply because they can. I'm almost certain that if they had the ability to tweak security in MS, they would do so.

    Kutos to the NSA for sharing it all with us.

    • Not at all mutually exclusive! (Score:5, Informative)

      by qortra ( 591818 ) on Tuesday February 24, 2004 @09:00PM (#8380649)
      Apparently, you don't understand the difference between a "page impression" and a "read". Now, here's what the normal slashdot user does:
      1)clicks on link
      2)looks for colorful photos
      3)Presses Ctrl-F, then types "screeshots", then Enter
      4)Clicks on any links he finds in that context.
      5)If he finds nothing, clicks "Back", clicks "Reply", and makes an uninformed comment

      Very little reading usually goes on; just viewage of pretty pictures. And, of course, this just makes the slashdot effect worse; text doesn't really hurt webservers as bad as big JPGs. That's why two hours after the posting on slashdot, the site admins are always back online with a text-only version of their site saying something like "I've never seen so much web activity in my life".

    • Re:A few quick comments (Score:4, Funny)

      by Anonymous Coward on Tuesday February 24, 2004 @09:21PM (#8380824)
      Slashdot *readers* do read the article. Slashdot posters are another matter entirely...
    • I would also throw out a little pointer that probably one of the major reasons that the NSA is working on the Linux Kernel is simply because they can. I'm almost certain that if they had the ability to tweak security in MS, they would do so.

      The NSA can do whatever the hell they want with Microsoft's products, and they do. This might be because MS lets them, but Iduno. Remember the NSAKey boondoggle?

      There are many reasons that they must deploy Windows in government. They spend quite a bit of money doing p
    • I'm almost certain that if they had the ability to tweak security in MS, they would do so.

      They did, sort of, with the security guides [conxion.com], which are well-documented (if rather dry) explanations of how to use existing Windows functionality to improve security on the systems. Some of them are pretty clearly overkill for most people (minimum 12-character passwords and 4GB max size for each log file, for example), but they're generally pretty good use. Apparently, they had such an effect on Microsoft that MS wr

  • Pure gold? (Score:5, Interesting)

    by Kiyooka ( 738862 ) on Tuesday February 24, 2004 @08:44PM (#8380496)
    Isn't this one of the best things to have happened to linux in the past year? How many operating systems can boast about having ***NSA***-quality security? Whether that's the whole story is another issue: this is marketing pure gold! That line in and of itself would be enough to catch the interest of most managers, I think. This may really kick open the door for Linux moving into the corporate space.
    • SELinux has been going on for four years now. Moreover, the NSA doesn't certify this as some sort of bulletproof linux, it mostly just adds access controls (I'm guessing aka ACLs). Since nobody's been dumb enough to run around marketing the NSA's involvement and SELinux it really hasn't caught on much. Bandying about that the NSA has somehow "approved" of this kernel would likely result in a very pissed off NSA. Nobody, not even marketing, dicks with the NSA.

    • Re:Pure gold? (Score:3, Informative)

      by YrWrstNtmr ( 564987 )
      How many operating systems can boast about having ***NSA***-quality security?

      Seeing as how NSA publishes security guides [nsa.gov] for NT, 2000, XP, 2003Server and Solaris 8, I'd say it is more than just Linux.

  • Article Text (seems sluggish) (Score:4, Informative)

    by sik0fewl ( 561285 ) <xxdigitalhellxxNO@SPAMhotmail.com> on Tuesday February 24, 2004 @08:46PM (#8380523) Homepage
    February 24, 2004
    Linux Gets Security Boost from NSA
    By Sean Michael Kerner

    Most stories about government deployments of Linux involve a distributor helping various federal and municipal agencies install the open source operating system. But in this case, a federal agency is helping Linux.

    The U.S. National Security Agency (NSA), also known as the codemakers and codebreakers cryptologic division within the Department of Defense, has helped to harden Linux with newly-released Security Enhanced Linux (SELinux) kernel modifications.

    The latest release, which updates the base kernel to 2.6.3 and 2.4.24, contains numerous significant improvements to security in the open source operating system. The SELinux improvements mark a major breakthrough for Linux. Because of the NSA's contributions to the kernel, the new security features will now show up in mainstream distributions of Linux.

    "Conditional policies are significant and also networking hooks were added, which makes SElinux all that much more powerful," Joshua Brindle, hardened Gentoo Linux Project Leader and the NSA's SELinux contributor, told internetnews.com.

    "They also exported AVC (define) controls to userland to facilitate strong X-based access control and privilege separation," he added.

    SELinux was released by the NSA under the GNU GPL open source license. SELinux is essentially a Linux Kernel with a number of utilities that provide enhanced security functionality. But the critical component of SELinux is how it implements and handles mandatory access controls.

    "SELinux is important because mandatory access controls are essential to limiting access to daemons and users to only what they need. It also solves the age-old almighty powerful superuser problem in Linux," Gentoo's Brindle told internetnews.com.

    "We stress however that it isn't an end-all solution, that it must be combined with additional layers of protection."

    Debian, Gentoo and Red Hat Fedora's latest test release of Fedora Core 2 all currently make some use of SELinux. Red Hat also plans to incorporate SELinux into its next Red Hat Enterprise Linux release

    This "marks an important milestone in what enterprises globally feel is an important issue," Red Hat spokesperson Leigh Day said of the SELinux update. "One of the first issues we hear from our customers when talking with them about solution requirements is security," she told internetnews.com. "Were pleased to be working with the NSA to bring SELinux to our distribution. We will incorporate SELinux fully in our next release of RHEL 4."

    The Security-enhanced Linux kernel enforces mandatory access control policies that confine user programs and system servers to the minimum amount of privilege they require to do their jobs.

  • Are NSA improvements public domain? (Score:3, Interesting)

    by geekee ( 591277 ) on Tuesday February 24, 2004 @08:58PM (#8380631)
    I don't think the US. govt. is allowed to use GPL. Of course, they must honor the gpl for the rest of the linux kernel, however.
    • From the SeLinux website: "All source code found on this site is released under the same terms and conditions as the original sources. For example, the patches to the Linux kernel, patches to many existing utilities, and some of the new programs available here are released under the terms and conditions of the GNU General Public License (GPL). The patches to some existing utilities and libraries available here are released under the terms and conditions of the BSD license. Some new libraries and new program

  • That's nice but... (Score:4, Funny)

    by nzAnon ( 130423 ) on Tuesday February 24, 2004 @08:59PM (#8380637)
    i'm sure it can't hold a candle to BarbieOS [divisiontwo.com] !!

  • post rsbac news, too! (Score:3, Informative)

    by boldi ( 100534 ) on Tuesday February 24, 2004 @09:00PM (#8380659)
    There were some selinux related posts on slashdot, consider checking www.rsbac.org too.

    RBAC, MAC, ACL, extensible, malware-scan (virus protection on kernel ('access') level), network protection, other methods (FF,...) and whatever you wish

    It's not financed by NSA, and not programmed in the US., can you be happier?

    Anyhow, don't tell me SeLinux is better because.. it would cause a flame-thread only...
    • RBAC, MAC, ACL, extensible, malware-scan (virus protection on kernel ('access') level), network protection, other methods (FF,...) and whatever you wish

      This breaks the Linus rule or we'd probably be using RSBAC. If it slows us down or breaks compatibility he conciders this broken code and sends it back to you.

      Anyhow, don't tell me SeLinux is better because.. it would cause a flame-thread only...

      So why tell us RSBAC is better?

    • Re:post rsbac news, too! (Score:4, Insightful)

      by plcurechax ( 247883 ) on Tuesday February 24, 2004 @10:07PM (#8381276) Homepage
      Anyhow, don't tell me SeLinux is better because.. it would cause a flame-thread only...

      So are you trying to claim Rule-set Based Access Control (RSBAC) is better? Have anything to back up that assertion?

      Considering there are still too many junior and not so junior system administrations that fail to use standard Unix access controls correctly or to their full potential, I do not expect to see advanced fine-grain access controls like RSBAC, MAC, etc. to gain mainstream usage any time soon. The issue is that find-grain access control does not tend to scale well in complex and dynamic environments like found in the typical IT department of a commercial enterprise, or an academic computer centre, or the typical under (IQ) staffed government IT/IS department.

  • So why... (Score:3, Interesting)

    by jpetts ( 208163 ) on Tuesday February 24, 2004 @09:01PM (#8380666)
    ... is the NSA web site running on IIS [netcraft.com]?

    (Yes, yes, I know that the web site will be totally physically separated from the spooks' computers...)

  • security vs stupidity (Score:2, Insightful)

    by lkcl ( 517947 )
    security -> tends to zero as Sum(Idiots) -> tends to infinity.

  • US Government employees MUST relinquish copyright (Score:4, Insightful)

    by lkcl ( 517947 ) <lkcl@lkcl.net> on Tuesday February 24, 2004 @09:06PM (#8380709) Homepage
    the combination of linux being open source plus the legal requirement that all US government employees must release code they develop as public domain results in SElinux.

    in other cases it results in a very good statistical test suite being dumped into the public domain.

    http://csrc.nist.gov/rng/
  • .....Microsoft.

    Let them continue to believe they can defeat FOSS

  • Hardened Gentoo (Score:5, Informative)

    by MadMethod ( 703012 ) on Tuesday February 24, 2004 @09:09PM (#8380733) Homepage
    Alot of my Gentoo specific comments were taken out of the article so I'll provide them below:

    MAC's are only the enforcement part, auditing is also very important and sadly something lacking in LSM. We are looking into different auditing schemes to compliment SELinux.

    Recently we have completely integrated PaX memory protections into the SELinux policy. Unfortunatly Redhat's Ingo wrote execsheild, which he admits provides less protection so most of the SELinux camp is not interested in the work we are doing in this area.

    We also provide much tighter policies by default whereas Redhat/Fedora has chosen to make the user domains much less restrictive and 'user-friendly'. This isn't in line with the goals we've cited on out page http://hardened.gentoo.org . While user friendliness is important taking restrictions away from domains inevitably loosens security.

  • nsa is by far (Score:3, Funny)

    by minus_273 ( 174041 ) <aaaaaNO@SPAMSPAM.yahoo.com> on Tuesday February 24, 2004 @09:14PM (#8380761) Journal
    one of the coolest gov agncies. Think really smart geeks working in secret for the greater good :)
  • Anyone know much much of SELinux MITRE contributed?

  • Go Linux (Score:4, Insightful)

    by SphericalCrusher ( 739397 ) on Tuesday February 24, 2004 @09:22PM (#8380835) Journal
    I'd rather pay taxes to support the stability of Linux, than to pay taxes to keep a piece of vulnerable software running any day.

  • changelog (Score:5, Funny)

    by jjeffries ( 17675 ) on Tuesday February 24, 2004 @09:28PM (#8380887)
    Summary of Changes for SELinux

    [classified@classified]

    [classified@classified] fix broken (classified) in (classified).c

    [classified@classified] changed (classified), added (classified)'s patch to (classified)

    [classified@classified] (classified) (classified) with (classified)

  • SELinux Demo Machine (Score:5, Informative)

    by Lord Tocharian ( 569589 ) on Tuesday February 24, 2004 @09:35PM (#8380939)
    Afraid to install SELinux but interested in what it does? The Hardened Gentoo project maintains a SELinux Demo Machine that allows you to ssh in as root. More information here: http://selinux.dev.gentoo.org/ [gentoo.org]

  • Please clariify (Score:5, Funny)

    by brain1 ( 699194 ) on Tuesday February 24, 2004 @11:37PM (#8382310)
    OK, Darl says that Linux is a threat to National Security, but the NSA who is responsible for National Security contributes to Linux.... Therefore logic says that Linux is good for National Security. But Microsoft says that they are more secure than Linux. Who's on first, what's on second...

    Yeeow! Nothing like a paradigm shift without using the clutch!

  • Why not talk to the developers? (Score:3, Informative)

    by Anonymous Coward on Wednesday February 25, 2004 @12:49AM (#8382916)
    The SE Linux mailing list is a good place to ask questions about it, see http://www.nsa.gov/selinux/ for the details.

    Also see #selinux on irc.freenode.net.

    Then you can discuss it with the people who are involved in SE Linux development.

    SE Linux has been going for a long time, I've been working on it for almost three years, and I wasn't involved at the start.

    The NSA gets some significant benefits from releasing the code under the GPL. See the list of non-NSA contributors for a list of the work that was done for free by the community instead of having to be paid for by the NSA.

    Russell Coker

  • SCO? (Score:4, Funny)

    by DaneelGiskard ( 222145 ) on Wednesday February 25, 2004 @05:00AM (#8384040) Homepage
    Personally, I would love to see SCO demanding money from the NSA for a linux license =) This should get rid of the SCO problem really fast ;-))

Slashdot Top Deals

He has not acquired a fortune; the fortune has acquired him. -- Bion

Close