On 10/29/12 10:17 AM, Joe Wulf wrote:
Improvements in security are collective as time and technology mature.  The reality of being a CAT I or a CAT II finding can certainly be further debated, but you articulate to us what seems like the basis for your waiver for your Accreditation---not the exception that should be imposed on everyone else who doesn't live under the same circumstances/situation you are.

I don't think I could have articulated that better than Joe just did. Do note that based off the DoD Consensus call last week we did lower this from a High/Cat I finding to a Medium/Cat II. I ack'd the patch myself, ref:

https://lists.fedorahosted.org/pipermail/scap-security-guide/2012-October/002072.html

With that said, I see absolutely no circumstances under which disabling the major host security protection mechanism should ever be disabled. Especially for systems delivering warfighter capabilities. As for McAfee, even they got their act together and issued guidance on how to properly make HBSS work with SELinux:

https://kc.mcafee.com/corporate/index?page=content&id=KB67360&cat=CORP_VIRUSSCAN_ENTERPRISE_FOR_LINUX_1.8&actp=LIST

Given that today the RHEL6 Common Criteria Certification was announced [1], which requires SELinux to be enabled to be compliant, you may see this be bumped back up to a Cat I/high finding.

-Shawn

[1] http://www.net-security.org/secworld.php?id=13856