SELinux has become, to many,
the mechanism for high-security Linux
deployments. The SELinux framework is considered sufficiently powerful,
flexible, and universal that some developers have contemplated removing the
Linux security module (LSM) interface altogether. When SELinux does
everything, why have hooks for anything else? The fact of the matter,
however, is that SELinux is not the only high-security approach out there.
On September 27,
version
1.2.5 of the
Rule Set Based Access Control
(RSBAC) patch was released. RSBAC has been around for several years,
but it has never quite achieved the prominence of SELinux.
Like SELinux, RSBAC inserts hooks throughout the kernel source. RSBAC does
not use the LSM framework, however. This
page explains why; in short, the RSBAC developer (Amon Ott) does not
like how LSM exposes kernel internals to security modules, and the LSM
hooks are not nearly extensive enough for RSBAC. In fact, RSBAC adds hooks
in many places (individual device drivers, for example) where LSM does not
tread. RSBAC hooks can also change system state in ways not allowed with
the LSM framework.
With the hooks in place, RSBAC allows for several different access control
regimes, all of which can be mixed and matched as desired. Available
options include:
-
Authenticated user: essentially a list of user IDs which may be
assumed by each process on the system. This module is required by
most other RSBAC security schemes.
-
User
management: a replacement for the PAM and shadow mechanisms which
moves most of the user and group management tasks into the kernel.
-
Role
compatibility: assigns roles to users and programs, and ensures
that they match at run time.
-
Access
control lists: a variant of file ACLs which can take additional
RSBAC features (such as roles) into account.
-
Mandatory
access control: assigns security levels to processes and objects,
and prevents access between different levels.
-
Dazuko:
a specialized interface for virus scanning applications. Dazuko
creates a special purpose device which can be used to intercept file
accesses; malware scans can then be performed before the access is
allowed to succeed. There is a ClamAV interface to Dazuko.
When it comes to features and achieveable level of security, I'd be inclined to say RSBAC has the upper hand, but I don't remember the details well enough to say anything much concrete about this.
I think it's unfortunate that the LSM framework is the one security framework accepted into the standard kernel. I find Amon Ott's arguments about why RSBAC can't work with LSM concinving, and it's sad that RSBAC, a very high quality, well maintained secury system, is effectively kept out of the standard kernel forever for this reason.
For the rest: be glad. Be very glad!
