SEVERE impact - SE Linux being imposed by Red Hat 6 SCAP

Lee Kinser lkinser at redhat.com
Mon Oct 29 17:18:01 UTC 2012


This is incorrect.  The Common Criteria Certification released today does not require SELinux be enabled when the system is not part of a MLS deployment or hosting VMs.  Reference the summary on page 12 of the PDF [1] from the evaluating Command Criteria lab.  

----
The TOE can operate in two different modes of operation called “Base mode” and “MLS
mode”. In Base mode the SELinux security module does not enforce a mandatory access
control policy for the general computing environment and does not recognize sensitivity
labels of subjects and objects. SELinux can either be disabled completely, or enabled with
a  non-MLS  policy which  only adds  additional  restrictions  to  the  base  access  control
functions  without  interfering  with  the  “root”  administrator  role.
----


1. https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Zertifizierung/Reporte07/0754a_pdf.html



-- 
Lee Kinser
Solutions Architect
Navy & Marine Corps
Red Hat Federal
843-868-1024 (Mobile)
lkinser at redhat.com


----- Original Message -----
> From: "Shawn Wells" <shawn at redhat.com>
> To: scap-security-guide at lists.fedorahosted.org
> Sent: Monday, October 29, 2012 12:28:16 PM
> Subject: Re: SEVERE impact - SE Linux being imposed by Red Hat 6 SCAP
> 
> 
> 
> On 10/29/12 10:17 AM, Joe Wulf wrote:
> 
> 
> Improvements in security are collective as time and technology
> mature. The reality of being a CAT I or a CAT II finding can
> certainly be further debated, but you articulate to us what seems
> like the basis for your waiver for your Accreditation---not the
> exception that should be imposed on everyone else who doesn't live
> under the same circumstances/situation you are.
> I don't think I could have articulated that better than Joe just did.
> Do note that based off the DoD Consensus call last week we did lower
> this from a High/Cat I finding to a Medium/Cat II. I ack'd the patch
> myself, ref:
> 
> https://lists.fedorahosted.org/pipermail/scap-security-guide/2012-October/002072.html
> 
> With that said, I see absolutely no circumstances under which
> disabling the major host security protection mechanism should ever
> be disabled. Especially for systems delivering warfighter
> capabilities. As for McAfee, even they got their act together and
> issued guidance on how to properly make HBSS work with SELinux:
> 
> https://kc.mcafee.com/corporate/index?page=content&id=KB67360&cat=CORP_VIRUSSCAN_ENTERPRISE_FOR_LINUX_1.8&actp=LIST
> 
> Given that today the RHEL6 Common Criteria Certification was
> announced [1], which requires SELinux to be enabled to be compliant,
> you may see this be bumped back up to a Cat I/high finding.
> 
> -Shawn
> 
> [1] http://www.net-security.org/secworld.php?id=13856
> 
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>


More information about the scap-security-guide mailing list