[conspire] Note about a security framework for Linux kernels

[Rick Moen]

Might be of interest, and I don't think Alan will mind.

----- Forwarded message from Rick Moen <rick at linuxmafia.com> -----

Date: Wed, 30 Apr 2008 21:21:24 -0700
From: Rick Moen <rick at linuxmafia.com>
To: Alan DuBoff <aland at softorchestra.com>
Subject: Re: Hosting the Linux Consultants Lunch mailing list:  RSVP!

Quoting Alan DuBoff (aland at softorchestra.com):

> Are you still holding Cabal? 

Yes.  Same schedule, 2nd and 4th Saturdays, 4 pm to midnight.

> I saw a guy over a Google a while ago that used to be at your place,
> Bruce, I can't remember his last name but was involved with BayLISA. 

Bruce Coston.  Reedy voice, thin, lives in Sunnyvale, attends most CABAL
and BayLISA meetings.  Current president of EBLUG in Fremont.

> I think I'm going to go to the Linux Symposium in Ottawa in July, as 
> there's a security related summit the day before. A friend of mine has 
> a project to implement flask/TE into OpenSolaris, and the Steve 
> Smalley is working with Sun on that. 

Doing FLASK's implementation of MAC and type enforcement would be
interesting.  I personally think that, like most MAC implementations,
FLASK's still too insanely complex for mere mortals to administer.  The
MAC approach I rather like at the moment is Casey Schaufler's SMACK,
Simplified Mandatory Access Control Kernel, which implments MAC but
without either RBAC or type enforcement.  (Instead, it relies on
extended attributes in the filesystem, to set file labels.)

http://lwn.net/Articles/244531/

Maybe that makes me a lightweight ;-> , but I tend to agree with
Schaufler that a security-enforcement framework that's such a pain in
the ass that you don't want to deal with is one that isn't going to
benefit you much, and that a more modest and less far-reaching one will
see more real-world use.

(SELinux is the standard case-in-point, being MAC implemented through
RBAC with a type-enforcement layer underneath it, and in consequence
being so damned problematic that the only people who really use it are
Fedora users who install the "targeted policy" and then leave it
severely alone to avoid breaking anything.)

> I'll give you a ring on Fri, after I get tweaked.

Look forward to seeing you.

----- End forwarded message -----