As for the topic of whether or not SELinux requirements should maintain a Cat II finding
status, I genuinely hope they do. Cat II findings are nothing to scoff at; systems under
the scrutiny of most DAAs are quite limited on the number of Cat II findings they will
allow to be implemented across the infrastructure or given system. Of those allowed
findings, their have to be waivers and acceptance on each, just as they would if they were
Cat I findings. The difference is that gaining DAA acceptance on Cat I findings is nearly
impossible - I don't want to see that kind of a roadblock stood up in front of system
engineers when there is legitimate reason not to implement SELinux. The DAAs are often
not technical
SELinux provides significant improvements in the security posture of a system, that is a
given, but the question is "does RHEL pose such a security risk without it, that
putting it on the network should constitute a Cat I finding?". I hardly believe it
does.
--
Lee Kinser
Solutions Architect
Navy & Marine Corps
Red Hat Federal
843-868-1024 (Mobile)
lkinser(a)redhat.com
----- Original Message -----
From: "Shawn Wells" <shawn(a)redhat.com>
To: scap-security-guide(a)lists.fedorahosted.org
Sent: Monday, October 29, 2012 12:28:16 PM
Subject: Re: SEVERE impact - SE Linux being imposed by Red Hat 6 SCAP
On 10/29/12 10:17 AM, Joe Wulf wrote:
Improvements in security are collective as time and technology
mature. The reality of being a CAT I or a CAT II finding can
certainly be further debated, but you articulate to us what seems
like the basis for your waiver for your Accreditation---not the
exception that should be imposed on everyone else who doesn't live
under the same circumstances/situation you are.
I don't think I could have articulated that better than Joe just did.
Do note that based off the DoD Consensus call last week we did lower
this from a High/Cat I finding to a Medium/Cat II. I ack'd the patch
myself, ref:
https://lists.fedorahosted.org/pipermail/scap-security-guide/2012-October...
With that said, I see absolutely no circumstances under which
disabling the major host security protection mechanism should ever
be disabled. Especially for systems delivering warfighter
capabilities. As for McAfee, even they got their act together and
issued guidance on how to properly make HBSS work with SELinux:
https://kc.mcafee.com/corporate/index?page=content&id=KB67360&cat...
Given that today the RHEL6 Common Criteria Certification was
announced [1], which requires SELinux to be enabled to be compliant,
you may see this be bumped back up to a Cat I/high finding.
-Shawn
[1]
http://www.net-security.org/secworld.php?id=13856
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide