SEVERE impact - SE Linux being imposed by Red Hat 6 SCAP
Shawn Wells
shawn at redhat.com
Mon Oct 29 16:28:16 UTC 2012
On 10/29/12 10:17 AM, Joe Wulf wrote:
> Improvements in security are collective as time and technology
> mature. The reality of being a CAT I or a CAT II finding can
> certainly be further debated, but you articulate to us what seems like
> the basis for your waiver for your Accreditation---not the exception
> that should be imposed on everyone else who doesn't live under the
> same circumstances/situation you are.
I don't think I could have articulated that better than Joe just did. Do
note that based off the DoD Consensus call last week we did lower this
from a High/Cat I finding to a Medium/Cat II. I ack'd the patch myself, ref:
https://lists.fedorahosted.org/pipermail/scap-security-guide/2012-October/002072.html
With that said, I see absolutely no circumstances under which disabling
the major host security protection mechanism should _ever_ be disabled.
Especially for systems delivering warfighter capabilities. As for
McAfee, even they got their act together and issued guidance on how to
properly make HBSS work with SELinux:
https://kc.mcafee.com/corporate/index?page=content&id=KB67360&cat=CORP_VIRUSSCAN_ENTERPRISE_FOR_LINUX_1.8&actp=LIST
Given that *today* the RHEL6 Common Criteria Certification was announced
[1], which requires SELinux to be enabled to be compliant, you may see
this be bumped back up to a Cat I/high finding.
-Shawn
[1] http://www.net-security.org/secworld.php?id=13856
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20121029/68ca1a2b/attachment.html>
More information about the scap-security-guide
mailing list