SEVERE impact - SE Linux being imposed by Red Hat 6 SCAP
Steve Grubb
sgrubb at redhat.com
Mon Oct 29 17:46:04 UTC 2012
On Monday, October 29, 2012 01:18:01 PM Lee Kinser wrote:
> This is incorrect. The Common Criteria Certification released today does
> not require SELinux be enabled when the system is not part of a MLS
> deployment or hosting VMs. Reference the summary on page 12 of the PDF [1]
> from the evaluating Command Criteria lab.
The Common Criteria settings do not apply here. CC has requirements that cause
certain settings to be chosen. Other policies, such as this one, are free to
adopt or ignore anything done in common criteria. Historically, CC had a
profile that was only traditional discretionary access (CAPP) and one that
enforces MAC policy (LSPP). When SE Linux is loaded with targeted policy, you
have a hybrid system. in its default state, all user actions are unconfined but
known daemon's are confined.
If a daemon is not known, it will not have an auto-transition rule that
changes it from initrc_t to its correct domain. initrc_t is basically
unconfined_t. Any commands run by the user are also unconfined. The basic
premise is that known daemons are the common entry points that an attacker
might use. If they are successful, we want to make sure they cannot access
user or certain system data.
It might be worth a test to see if turning on selinux causes a problem. Its
better to say I am getting this AVC than us thinking about what-ifs.
-Steve
PS - The RHEL5 USGCB content requires SE Linux on and enforcing.
More information about the scap-security-guide
mailing list