[Security_sig] Reply about draft Army guide
Stephen Smalley
sds at epoch.ncsc.mil
Tue Feb 15 09:20:10 PST 2005
On Tue, 2005-02-15 at 12:15, Andy Murren wrote:
> 2. There are several ways to implement MAC. At the time I started
> this document SELinux was not allowed. Other tools to implement
> MAC include grsecurity (http://www.grsecurity.net/) which is
> available from the grsecurity site and is one of the Gentoo
> Hardened projects. (We may want to review this as an alternative
> to SELinux). I cannot state one way or another what the Army is
> doing about MAC for Linux systems or its position on SELinux.
- SELinux is also included in Hardened Gentoo.
- SELinux is included in RHEL4, which was officially released today by
Red Hat.
- grsecurity does not implement MAC per any definition of MAC that would
pass evaluation. It does not support information flow control.
- Many other so-called MAC implementations for Linux are likewise
unsuited for controlling the flow of information throughout the system
and can not support DoD needs.
--
Stephen Smalley <sds at epoch.ncsc.mil>
National Security Agency
More information about the security_sig
mailing list