Novell Acquires SELinux Alternative Immunix

G Money writes "Novell announced today that they acquired Immunix, a company the produces an alternative mandatory access control solution to SELinux using the LSM. For anyone who hasn't used both Immunix and SELinux, the difference between configuring them is like night and day. There's even a YaST module for configuration. (Disclaimer: I'm on the Defcon Immunix CTF team.)"

Comments

Re:A picture might be worth a thousand words

[jd]

My (limited) understanding is that you set up an association. So, in your case, you'd want the user to have access to the date program AND the system clock, and the date program itself to also have access to the system clock.

The user then runs the program. The system determines that this is legit. The program then tries to set the date. The system checks to see if the program is authorized (in this case, it is) and if the user is also authorized (again true in this case). The system then allows the transaction.

Mandatory access controls originated with the military, where classified information could not be exposed to an environment or user of improper classification. You should never have a top secret file delivered to an unclassified machine, regardless of who is using it, for example. Nor should that file be saent to someone who was of a lower clearance, no matter what clearance the system they were using.

Pretty well nearly all systems developed since then have understood that for mandatory access controls to work, you need to apply them to ALL parts of the system. This makes MACs cumbersome, as you have a lot of checking going on. The problem with MAC is less "how do we build it" and more "how do we build it so someone can use it". That's where the problem lies.