SELinux has clearly defined security mechanisms implemented through different components. It is doing what it was designed for. The real problem with SELinux is the way it hooks to the Linux kernel. The inaccurate marketing of this tool doesn't help too, unsuspecting users are blindly using it as a magical security solution.
On 9/23/07, Ihar Hrachyshka <[EMAIL PROTECTED]> wrote: > 2007/9/22, Douglas A. Tutty <[EMAIL PROTECTED]>: > > On Sat, Sep 22, 2007 at 12:20:34PM -0400, Jason Dixon wrote: > > > On Sep 22, 2007, at 12:00 PM, Darrin Chandler wrote: > > > > > > >On Sat, Sep 22, 2007 at 11:34:33AM -0400, Douglas A. Tutty wrote: > > > >>Linux has SELinux in its 2.6 kernel and debian has gone ahead and > > > >>compiled SELinux into the libraries, although the SELinux policies > > > >>aren't ready on debian yet. The whole focus seems to be to make > > > >>Linux "more secure". I'm not sure what to make of it. I figure > > > >>that if you want secure, you switch to OBSD. > > > >> > > > >>Could someone who knows both the details of OBSDs security > > > >>enhancements and the details of SELinux comment? > > > > > > > >I don't know all the details, and especially not the SELinux details, > > > >but that won't stop me from commenting. > > > > > > > >Not long ago I was talking with a Linux person about security, and > > > >they pointed me to a set of patches that did a lot of nifty stuff. > > > >Good stuff, like the things you find OpenBSD doing. But it's not in > > > >the mainline kernel, it's a set of patches. > > > > > > > >Security should not be grafted on, it should be integrated into the > > > >main development process. I'm sure the patch maintainers are doing > > > >their best, but this doesn't change the fundamental flaw in the > > > >process. It's not a flaw of their making, it's inherent in the > > > >situation. But it's still a flaw. > > > > > > > >Compare that to a complete operating system (OpenBSD) where security > > > >is part of code quality, and part of the normal mainline development. > > > > > > If I could add one thing to Darrin's comment (of which I agree > > > completely), it would be this: > > > > > > SELinux is a button. Buttons are easy to turn off. > > > > As I understand it, the patches (the button) are maintained by the US > > NSA; I suppose as a service to their fellow Americans. That likely > > brings out the conspiracy theorists who say that there's probably a > > back-door to allow NSA to read your ssh keys, GPG/PGP keys, whatever. > > > GPL code, isn't it? Go read it! Go find backdoors! > > My _personal_ perspective is that OBSD is smaller. You don't have 5,000 > > or whatever people changing the kernel, plus NSA putting their thumb in > > it. You have my Fellow Canadian Theo and people he trusts. > The problem of Linux as a whole is that it tries to resolve security > problems not by auditing code but by implementing SELinux. But what > the problem would be if OpenBSD has "SeBSD" extension? It's just one > of security features, and I don't see the matter for blaming on > SELinux. Linux security flaws are not there but in Linux kernel as a > bunch of badly tested code. > > > > Thanks for your comments. > > > > Doug.
