SEVERE impact - SE Linux being imposed by Red Hat 6 SCAP

Shawn Wells shawn at redhat.com
Mon Oct 29 16:28:16 UTC 2012


On 10/29/12 10:17 AM, Joe Wulf wrote:
> Improvements in security are collective as time and technology 
> mature.  The reality of being a CAT I or a CAT II finding can 
> certainly be further debated, but you articulate to us what seems like 
> the basis for your waiver for your Accreditation---not the exception 
> that should be imposed on everyone else who doesn't live under the 
> same circumstances/situation you are.

I don't think I could have articulated that better than Joe just did. Do 
note that based off the DoD Consensus call last week we did lower this 
from a High/Cat I finding to a Medium/Cat II. I ack'd the patch myself, ref:

https://lists.fedorahosted.org/pipermail/scap-security-guide/2012-October/002072.html

With that said, I see absolutely no circumstances under which disabling 
the major host security protection mechanism should _ever_ be disabled. 
Especially for systems delivering warfighter capabilities. As for 
McAfee, even they got their act together and issued guidance on how to 
properly make HBSS work with SELinux:

https://kc.mcafee.com/corporate/index?page=content&id=KB67360&cat=CORP_VIRUSSCAN_ENTERPRISE_FOR_LINUX_1.8&actp=LIST

Given that *today* the RHEL6 Common Criteria Certification was announced 
[1], which requires SELinux to be enabled to be compliant, you may see 
this be bumped back up to a Cat I/high finding.

-Shawn

[1] http://www.net-security.org/secworld.php?id=13856
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20121029/68ca1a2b/attachment.html>


More information about the scap-security-guide mailing list