rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

reformat

Browse Source
This commit is contained in:
Chris PeBenito 2005-05-17 19:58:58 +00:00
parent 696b41785d
commit efa9947dc6
1 changed files with 32 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
www/html/index.html
View File

@ -1,8 +1,36 @@
<h1>SE Linux Reference Policy</h1> <h1>Security Enhanced Linux (SELinux) Reference Policy</h1>
<h3>Introduction</h3> <h3>Introduction</h3>
<P>The purpose of this document is to serve as a blueprint to policy developers and serves as the initial means for communicating the motivations, approach and goals of the <i>SELinux Reference Policy</i> development project. This document is intended for SELinux policy developers and other members of the SELinux development community interested in building a secure foundation upon which to build high-assurance solutions using SELinux. The reference policy will provide a carefully designed and consistent system security policy that can be used as a basis for developing secure solutions using SELinux. <P>
The purpose of this document is to serve as a blueprint to policy developers
and serves as the initial means for communicating the motivations, approach and
goals of the <i>SELinux Reference Policy</i> development project. This document
is intended for SELinux policy developers and other members of the SELinux
development community interested in building a secure foundation upon which to
build high-assurance solutions using SELinux. The reference policy will provide
a carefully designed and consistent system security policy that can be used as
a basis for developing secure solutions using SELinux.
</p>
<h3>Background and Motivation</h3> <h3>Background and Motivation</h3>
<P>One of the key motivations for this project is the drive to get SELinux mainstreamed into commercial products. True, SELinux is currently being incorporated into various commercial distributions, but clearly, widespread adoption of SELinux as a commercial product eventually will require the operating system to be certified. Efforts are already underway by IBM for SELinux to undergo a Common Criteria evaluation under the Labeled Security Protection Profile (LSPP). Furthermore, SELinux needs a more robust policy structure upon which to build high-assurance solutions, such as intrusion detection systems (IDS), cross-domain solutions, LAN guards, etc., particularly for government and DoD security-critical missions. <P>
One of the key motivations for this project is the drive to get SELinux
mainstreamed into commercial products. True, SELinux is currently being
incorporated into various commercial distributions, but clearly, widespread
adoption of SELinux as a commercial product eventually will require the
operating system to be certified. Efforts are already underway by IBM for
SELinux to undergo a Common Criteria evaluation under the Labeled Security
Protection Profile (LSPP). Furthermore, SELinux needs a more robust policy
structure upon which to build high-assurance solutions, such as intrusion
detection systems (IDS), cross-domain solutions, etc., particularly for
government and DoD security-critical missions.
</p>
<P>Unfortunately, the current “strict” policy for SELinux does not meet the requirements of high security systems. The policy chooses functionality over security, with the implicit goal of not breaking legacy application behavior. Additionally, it has no clear security goals and those that exist are not rigorously followed or are ignored to preserve functionality. Furthermore, complexity, a formidable enemy to security, is increasing in the policy and the situation is not improving. <P>
Unfortunately, the current "strict" policy for SELinux does not meet the
requirements of high security systems. The policy chooses functionality over
security, with the implicit goal of not breaking legacy application behavior.
Additionally, it has no clear security goals and those that exist are not
rigorously followed or are ignored to preserve functionality. Furthermore,
complexity is increasing in the policy and the situation is not improving.
</p>