[PATCH 07/26] Mapped CCI-000026 to requirement_unclear.

Shawn Wells shawn at redhat.com
Fri Jun 29 22:41:25 UTC 2012


On 6/29/12 5:45 PM, Willy Santos wrote:
> CCI-000026 refers to enforcing information flow control using protected processing domains. This mapping is open to discussion and change.
>
>

SRG-OS-000010 	CCI-000026 	The operating system must enforce information 
flow control using protected processing domains (e.g., domain 
type-enforcement) as a basis for flow control decisions. 	Protected 
processing domains can be used to separate different data types. The 
operating system must enforce information flow control to ensure 
information does not pass into domains that are not authorized to 
process it.


We enforce information flow against processing domains via SELinux. By 
default we just run everything as unconfined_t. SysAdmins can change 
this if they want to alter the standard flow, but regardless we enforce 
it whenever selinux is enforced.

I'd map this to having to enable selinux.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120629/16232683/attachment.html>


More information about the scap-security-guide mailing list