[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Bits from the release team and request for discussion

On Thu, Jul 30, 2009 at 11:16 AM, Manoj Srivastava<srivasta@debian.org> wrote:
> Hi,
>        I would like to set up a selinux related release goal for
>  Squeeze.
>  Developer assiociated:  Manoj Srivastava (Perhaps also Russell Coker,
>                         but I have not discussed this with him)
>  Issues to be solved:
>   (a) Get all Debian patches to the reference security policy merged in
>       upstream.  Status: In progress, we have all patches submitted,
>       some need to be tweaked and resubmitted based on feedback
>        Time line: 1-2 months, depending on free tie I have
>   (b) Update reference security policy to allow standard machines to be
>       in enforcing mode.
>       Status: It is possible to run minimal virtual machines in
>       enforcing mode, but real machines are somewhat crippled; these
>       denials need to be inspected, and determination needs to be made
>       for how to resolve them (no not want security holes enshrined in
>       policy)
>      Time line: 6-8 months (can be done in tandem with a, if here were
>      more people working on it)
>   (c) Make it easier to run in struct (no unconfined.pp module)
>       mode. This needs firstly documentation, and secondly, additional
>       tweaks to policy to make it work. Russell has a play machine
>       where it all works, but those changes are not in the reference
>       policy -- and some of them might not be fit to be in ref policy
>       at all.
>      Time line: 9-12 months
>        The actual non-policy packages are now well in sync with
>  upstream,  so the weak point is the security policy.
>        Ideally, the goal would be to have Squeeze certifiable at EAL-4,
>  at least the "standard" install (no optional packages), if someone with
>  deep pockets were willing to actually pay for the certification, and be
>  willing to push through the process.

Which parts of the work you described above would be needed to Squeeze
be certifiable at EAL-4? All of them?

Based on your timeline, it seems A is on track to make Squeeze, we
should get more people to work with you on B (setting as a goal) and C
would be a no go for this release, jmo. Am I wrong?

-- Gustavo "stratus" Franco

Reply to: