Jeronimo Zucco has published some SELinux documentation in Portuguese:
Hardening Linux Usando Controle de Acesso Mandatório.
Relatedly, I just read Spot‘s report on attending FISL in Brazil. Sounds like it was an exciting and productive event. With over 7000 attendees, I wonder if this was the largest FOSS conference ever?
The 2008 SELinux Developer Summit CFP is now closed.
As suspected, most of the proposals arrived at the last possible moment. It looks like we have more proposals than can reasonably fit in one day, so the organizing team now has the interesting task of squeezing as much in as possible without overloading the schedule. This is going to be very difficult, as pretty much all of the submissions are of excellent quality.
In any case, we should have the schedule finalized and published within a week or so.
The Call for Participation for the 2008 SELinux Developer Summit closes on the 18th of April — that’s this Friday!
If you’ve been working on something interesting, there are some slots still open for the informal 30-minute talks. We’re also accepting suggestions for discussion topics and panels.
Send your ideas/proposals to the organizing team: selinux-summit-team AT namei.org
We’ve just announced the SELinux Developer Summit for 2008, which will be held in Ottawa (as an OLS mini-summit) on July 22nd. A CfP will be issued early next week, where we’ll be looking for people to submit talks and panel topics.
In previous years, the project has had the SELinux Symposium, generously run by Tresys, with an invite-only developer summit tacked onto the end.
The new Developer Summit is intended to track with the evolution of SELinux as a wider community project, and we are very pleased to be able to hold an open event this year in conjunction with OLS.
All developers and folk with a strong technical interest in SELinux and related Flask/TE projects are encouraged to attend. Note that attendees need to also be registered for OLS.
There’ll be more information on the CfP and schedule soon — this is something of a heads up for those planning travel and who may be wish to start thinking about presentation and discussion topics.
The organizing team is as follows:
For more details on the event, including contact details for the team refer to the SELinux Developer Summit page.
So, there’ll be quite a lot of SELinux content at OLS, some of which I’ve previously mentioned. To summarize, in addition to the Developer Summit, there’ll be:
Talks:
A tutorial:
A BoF session:
Because the cool kids are doing it, here are photos of the bookshelves above my desk:
Click for more detail.
The OLS 2008 schedule is up:
There are quite a lot of security-related items this year, with several covering SELinux. I’ve had a talk accepted on the general state of the SELinux project. If you can read Japanese, see Yuichi Nakamura’s blog entry (he’s presenting on SELinux in consumer electronics).
We’re hoping to hold an SELinux developer event in conjunction with OLS. Hopefully there’ll be more to say on that soon.
It’s interesting to see so many Indian flags next to speakers’ names this year. No doubt related to the enthusiastic efforts of the grassroots community in India as evidenced by FOSS.IN and the growing number and scope of regional conferences.
A quick google returns regional conferences this year in Delhi, Calicut, Chennai and Pune. I probably missed some. A few of them happen around the same time (February or so ) and if its similar next year, then there’s scope for folk who are interested in both traveling around India and in FOSS to do some kind of geek tour — on PTO, I’d imagine, unless your management is epically cool.
Christer Edwards has announced support for SELinux in Ubuntu 8.04, and documented the installation procedure:
$ sudo aptitude install selinux
It’s great to see other distributions adopting SELinux. I’m anticipating that the Ubuntu community will bring in fresh ideas and perspectives based on their overall focus on usability.
SELinux has always been an entirely open project and it was never intended to be specific to any particular distribution or company (a perception which unfortunately has emerged in recent times). Hopefully, adoption by Ubuntu (and others) will help to dispel such myths, including the myth that SELinux is difficult to use. It would be unrealistic not to expect a few teething problems in Ubuntu, but experience with Fedora has shown that they can be fixed, and that stronger security can be made highly usable in the general case.
Something interesting to consider is that with SELinux support, Ubuntu is now a potentially LSPP/EAL4+ certifiable distribution. As many will know, such certifications are important requirements for significant classes of government and military procurement, and we are also seeing some such users moving exclusively to open systems.
Side note: it seems that there’ll be some SELinux talks and events at OLS: nothing official quite yet, but keep your calendars open!
That they’re forced to spend money on IT security is an artifact of the youth of the computer industry. And sooner or later the need to buy security will disappear.
It will disappear because IT vendors are starting to realize they have to provide security as part of whatever they’re selling.
Interesting article, but the concept of shipping security features by default is significantly established and even pioneered within FOSS. For example, the idea that mandatory access control could be enabled by default, in a general purpose OS, was I think unheard of until SELinux was released as a standard part of Fedora.
Linux systems have many best of breed security features available as standard, typically for free: firewalling, PAM, OpenSSH (thanks OpenBSD folk), binary protection, code review, vulnerability response, audit, crypto, network stack hardening, and so on. The inclusion of such features as standard, rather than expensive, layered products with vendor lock-in written all over them, is itself an innovation in computer security. An innovation which is being adopted by major OS vendors.
I was surprised to see Bruce interviewed a few months back, being asked what he thought Linux had contributed to security, and to see him answer something along the lines of merely raising the bar for Windows. That may be true to an extent, but I think he seems to underestimate (or not understand) the direct value provided now to the millions of systems running Linux, many of which are running all kinds of critical workloads. We’re talking stock exchanges, large banking systems, Google, telephone exchanges, cell phones, supercomputers, file and print servers, much of the web, mail servers, routers, hospitals, military, government, and almost anything you can think of. FOSS achievements stand alone, and frankly, have enabled progress which simply would otherwise not have occurred.
As noted at SELinux News, OpenSolaris has launched a new project, Flexible Mandatory Access Control (FMAC), to integrate the Flask/TE security scheme into their OS. This is the same underlying model implemented by SELinux, and follows other cross-platform Flask/TE integration projects such as SEDarwin and SEBSD.
This is very exciting in terms of of establishing compatible security across operating systems, particularly for Mandatory Access Control, which has traditionally been narrowly focused and generally incompatible. With FMAC, we’re closer to seeing truly ubiquitous, cross-platform MAC security.
I’ll be interested to see how they approach the integration, with the opportunity to learn lessons from the SELinux experience.
It’ll also be great to have an expanded TE/Flask community. According to their project page, areas of work include improving usability (we can never have enough of that), desktop integration via XACE, integration with Xen (presumably via XSM), Labeled NFS, and Labeled IPSec. It seems they already have a separate project for the latter, txipsec.
I’ll be watching with great interest, and would like to offer any assistance in ensuring interoperability with SELinux.
My morning email slog was greatly enhanced by some choice quotes from Peter Gutmann on the IETF Security Area Advisory Group list:
Compare this to the example I gave earlier of performing a TLS exchange with Amazon. This performs an in-depth test of all the crypto algorithms (corresponding to the FIPS algorithm tests, including ones that FIPS ignores), and the crypto mechanisms (many/most of which FIPS again ignores). In other words simply by connecting to Amazon using TLS and ordering a “Scrubs” DVD for $19.95 I’m getting more comprehensive algorithm testing than I can for a five-figure sum with the FIPS algorithm tests.
This was based on a FIPS-140 crypto certification costing $100,000 (which was challenged in a followup as costing a mere $30,000).
He then describes what he believes would be a better way to use the $100k in assuring a crypto product, including the purchase of a $45k home theater system, beer, and setting a up fake banking web site as a honeypot to attract Russian mafia.