On Sun, 23 Mar 2003 00:28, Fraser Campbell wrote: > > The "Trusted Debian" project is based on RSBAC which is not as widely > > supported as SE Linux. Also it is based around the idea of re-packaging > > all Debian software which is a huge amount of work. I currently maintain > > 21 Debian packages for SE Linux which is more than enough work, > > maintaining a fork of all the base packages would be a huge amount of > > work. > > Hmmm, that's almost the opposite of what they say (see > http://www.trusteddebian.org/rsbac.html): > > - SE-Linux makes extensive changes to existing Linux tools, possibly > leading to a horrible versioning mess and delays in security updates
That is incorrect and misleading. SE Linux itself is a kernel patch and a set of tools for compiling and loading policy files, setting and displaying the types of files, and displaying the domains of running processes. SE Linux does not require patched applications, but the default policy does require it. You could run SE Linux with a different policy that does not require such patches, but it would be less secure. > - RSBAC does not need any changes to existing tools, although it could > benefit from such changes. If I spent a couple of days writing a policy for SE Linux to not require patched applications then the same could be said about it (however SE Linux already has a good set of patches for applications and the item you quoted about suggests that RSBAC doesn't have the patches written yet). > Still I don't agree with most of their statements ... RSBAC may be a great > project, and I hope that it works out, but I am more inclined to trust code > that was developed at the NSA and audited by many developers than a project > I have only just heard about, a project which may have only a single > developer (or at least a pretty quiet mailing list). Yes. SE Linux is being actively worked on by IBM researchers, input comes from SGI people, there are a number of private companies involved in security work contributing, and many others. Also hypothetically speaking, if the NSA wanted to put a back-door in the Linux kernel, would they do it in code that has their name on it instead of anonymously putting in dodgey code for device drivers? -- http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark http://www.coker.com.au/postal/ Postal SMTP/POP benchmark http://www.coker.com.au/~russell/ My home page -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
