SEVERE impact - SE Linux being imposed by Red Hat 6 SCAP

Lee Kinser lkinser at redhat.com
Mon Oct 29 17:42:29 UTC 2012


As for the topic of whether or not SELinux requirements should maintain a Cat II finding status, I genuinely hope they do.  Cat II findings are nothing to scoff at; systems under the scrutiny of most DAAs are quite limited on the number of Cat II findings they will allow to be implemented across the infrastructure or given system.  Of those allowed findings, their have to be waivers and acceptance on each, just as they would if they were Cat I findings.  The difference is that gaining DAA acceptance on Cat I findings is nearly impossible - I don't want to see that kind of a roadblock stood up in front of system engineers when there is legitimate reason not to implement SELinux.  The DAAs are often not technical 

SELinux provides significant improvements in the security posture of a system, that is a given, but the question is "does RHEL pose such a security risk without it, that putting it on the network should constitute a Cat I finding?".  I hardly believe it does.  




-- 
Lee Kinser
Solutions Architect
Navy & Marine Corps
Red Hat Federal
843-868-1024 (Mobile)
lkinser at redhat.com


----- Original Message -----
> From: "Shawn Wells" <shawn at redhat.com>
> To: scap-security-guide at lists.fedorahosted.org
> Sent: Monday, October 29, 2012 12:28:16 PM
> Subject: Re: SEVERE impact - SE Linux being imposed by Red Hat 6 SCAP
> 
> 
> 
> On 10/29/12 10:17 AM, Joe Wulf wrote:
> 
> 
> Improvements in security are collective as time and technology
> mature. The reality of being a CAT I or a CAT II finding can
> certainly be further debated, but you articulate to us what seems
> like the basis for your waiver for your Accreditation---not the
> exception that should be imposed on everyone else who doesn't live
> under the same circumstances/situation you are.
> I don't think I could have articulated that better than Joe just did.
> Do note that based off the DoD Consensus call last week we did lower
> this from a High/Cat I finding to a Medium/Cat II. I ack'd the patch
> myself, ref:
> 
> https://lists.fedorahosted.org/pipermail/scap-security-guide/2012-October/002072.html
> 
> With that said, I see absolutely no circumstances under which
> disabling the major host security protection mechanism should ever
> be disabled. Especially for systems delivering warfighter
> capabilities. As for McAfee, even they got their act together and
> issued guidance on how to properly make HBSS work with SELinux:
> 
> https://kc.mcafee.com/corporate/index?page=content&id=KB67360&cat=CORP_VIRUSSCAN_ENTERPRISE_FOR_LINUX_1.8&actp=LIST
> 
> Given that today the RHEL6 Common Criteria Certification was
> announced [1], which requires SELinux to be enabled to be compliant,
> you may see this be bumped back up to a Cat I/high finding.
> 
> -Shawn
> 
> [1] http://www.net-security.org/secworld.php?id=13856
> 
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> 


More information about the scap-security-guide mailing list