I just posted about this on SELinux News: HP have now completed a common criteria certification of RHEL 5, covering LSPP, RBACPP and CAPP at EAL4 augmented. This is basically the same as the IBM certification. Indeed, both certifications stem from the same cooperative effort.

For the first time, we are seeing security certifications from different vendors which are fully compatible, thanks to a community-based approach. From a customer point of view, there is now true choice in certified solutions, as it’s possible to choose different hardware vendors. While technically not certified, pure RHEL clones effectively extend that choice to selection of OS vendor.

So, Linux now offers the highest evaluation level possible for an off-the-shelf operating system, with a flexible, modern MAC scheme, without vendor lock-in for either hardware or software. It’s all upstream, and the source is out there for anyone to review, use, experiment with or develop further.

More importantly, the underlying technology aims for general usability, and is already protecting millions of systems from modern security threats.