Re: NSA's Secure Linux Distribution
At 04:38 PM 12-22-2000 -0500, Jacob Kuntz wrote:
from the secret journal of Brent Fulgham (brent.fulgham@xpsystems.com):
> No doubt most of you have seen the NSA's secure linux posting
> on Slashdot this morning.
>
> Looking at:
> http://www.nsa.gov/selinux/docs.html
>
> there appears to be several utilities that have been updated
> to provide enhanced security.
>
> Should we be merging these patches into Debian, assuming they
> appear to be compatible with our policy, etc.?
>
unless we have a policy against security, it should be fine. :) it's all
gpl.
I'd take a close look at what they did before deciding to integrate their
patches in.
The goals of the NSA in doing this may not be suitable for Debian. I'm not
talking about paranoia concerning the NSA putting back-doors into
everything; I'm taking as given that they are being honest and upfront
about what they are doing and why. But...
Here is a quote from their "overview" page
(http://www.nsa.gov/selinux/index.html):
Security-enhanced Linux is not an attempt to correct any flaws that may
currently exist in Linux. Instead, it is simply an example of how
mandatory access controls that can confine the actions of any process,
including a superuser process, can be added into Linux. The focus of this
work has not been on system assurance or other security features such as
security auditing, although these elements are also important for a secure
system.
In addition, while they provide 15 new or modified system utilities, they
also provide 36 new system-calls, and require a custom kernel to handle the
system.
On their to-do list are the following items:
Port the kernel patches to the latest 2.2 kernel
Port the kernel patches to the 2.4.0 kernel
Port the utility patches to the latest versions of the base utilities
so I'm not even sure we -could- apply their patches, even if we wanted to.
--
jacob kuntz
jpk@cape.com
underworld.net/~jake
--
To UNSUBSCRIBE, email to debian-devel-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Reply to: