SEVERE impact - SE Linux being imposed by Red Hat 6 SCAP

Steve Grubb sgrubb at redhat.com
Mon Oct 29 17:46:04 UTC 2012


On Monday, October 29, 2012 01:18:01 PM Lee Kinser wrote:
> This is incorrect.  The Common Criteria Certification released today does
> not require SELinux be enabled when the system is not part of a MLS
> deployment or hosting VMs.  Reference the summary on page 12 of the PDF [1]
> from the evaluating Command Criteria lab.

The Common Criteria settings do not apply here. CC has requirements that cause 
certain settings to be chosen. Other policies, such as this one, are free to 
adopt or ignore anything done in common criteria. Historically, CC had a 
profile that was only traditional discretionary access (CAPP) and one that 
enforces MAC policy (LSPP). When SE Linux is loaded with targeted policy, you 
have a hybrid system. in its default state, all user actions are unconfined but 
known daemon's are confined.

If a daemon is not known, it will not have an auto-transition rule that 
changes it from initrc_t to its correct domain. initrc_t is basically 
unconfined_t. Any commands run by the user are also unconfined. The basic 
premise is that known daemons are the common entry points that an attacker 
might use. If they are successful, we want to make sure they cannot access 
user or certain system data.

It might be worth a test to see if turning on selinux causes a problem. Its 
better to say I am getting this AVC than us thinking about what-ifs.

-Steve


PS -  The RHEL5 USGCB content requires SE Linux on and enforcing.


More information about the scap-security-guide mailing list