Submission + - Leopard Security Enhancements
99BottlesOfBeerInMyF writes: A few days ago Apple quietly provided developers with overviews of some of the new features to be in Mac OS X 10.5, including two new security features that may help them maintain their reputation for security. The first is a Mandatory Access Control framework similar to that in SELinux from the NSA. The overview describes it as follows: "This framework, original developed for TrustedBSD, provides a fine-grained security architecture for controlling the execution of processes at the kernel level. This enables sandboxing support in Leopard. By sandboxing an application, using a text profile, you can limit an application to being able to just access only the system features, such as disk or the network, that you permit."
The second feature is even more briefly described: "Also new in Leopard is code signing. This means that Leopard will be able to identify applications by using digital signatures and then use that identification to base trust decisions on."
With these sparse details we can only speculate, but could Apple be planning a user friendly version of application level controls in Mac OS X 10.5? Will unsigned applications be sandboxed by the MAC framework by default? This could make implementing spyware, trojans, and worms a whole lot harder than any current mainstream offering. Will this bring fine grained security permissions to the masses, or will this be another technology that sits in the background with lots of potential but little real world use?
Also included in the overview are mentions of resolution independent displays, OpenGL 2.1 implementation, using multiple cores to drastically increase graphics performance, and other tidbits.
The second feature is even more briefly described: "Also new in Leopard is code signing. This means that Leopard will be able to identify applications by using digital signatures and then use that identification to base trust decisions on."
With these sparse details we can only speculate, but could Apple be planning a user friendly version of application level controls in Mac OS X 10.5? Will unsigned applications be sandboxed by the MAC framework by default? This could make implementing spyware, trojans, and worms a whole lot harder than any current mainstream offering. Will this bring fine grained security permissions to the masses, or will this be another technology that sits in the background with lots of potential but little real world use?
Also included in the overview are mentions of resolution independent displays, OpenGL 2.1 implementation, using multiple cores to drastically increase graphics performance, and other tidbits.
