Slashdot Mirror
NAI Labs releases LOMAC, a kernel security extension
Tim Fraser writes "NAI Labs
has released a new version of the
Linux LOMAC kernel extension
, their latest in a series of security
extension products they're involved with -- ranging from
components of TrustedBSD to SELinux. LOMAC provides a drop-in
security solution that does not require extensive administration unlike
other kinds of Mandatory Access control (MAC). There's a port of LOMAC to FreeBSD in the works. The release announcement has more details.
The author gave a talk at our lug last week. This is my understanding of what he said.
/etc, /usr, and anything else only root should be mucking with. Level 1 is everything else. Programs begin running at level 2, and are demoted to level 1 as soon as they read a level 1 file (or from the network which is considered level 1).
Basically LOMAC's goal is to increase security without being intrusive. (Intrusive systems are hard to get people to use). It doesn't protect against everything, or even close to everything. It does make a class of actions which should basically never be done impossible.
It divides the fs into level 1 and level 2 parts. Level 2 stuff is things like
This keeps someone who compromised your copy of bind running as root from reconfiguring your system. It doesn't stop them from trashing your www data, or anything else going on at level 1.
i.e. it eliminates a certain class of problems.
As to it being drop in, it's a kernel module. What is level 1 vs. level 2 in the file system is defined at compile time. There is _no_ configuration, which makes it very easy to use.
God does not play dice - Einstein
Not only does God play dice, he sometimes throws them where they
Am I missing something, but how does this differ from giving every critical file the system immutable flag (under BSDs), then when the box has come up nicely you lift the security level, to something that enforces the chflags and doesn't let you change them?
Ok, so it's nice to just load it, and all your problems will go away. Anyways the standard user won't use it because they haven't heard of it, and they dont know how to get it or compile it.
Anyone with more experience about system should use something like LIDS or SELinux, which lets you do much more fine-grained control, and SELinux really rocks in this aspect. Of course SELinux isn't very stable yet, so using it on a web-server maybe ain't the worlds greatest idea, but this is where LIDS comes to play.
SELinux is of course very cool when building remote administration computers (one computer in the network and all remote administrators has to log in to it, and connect from it to the server they wan't to administer) or shell boxes.
So I really don't think this is anything great, or?