Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Linux Software

New Release Of NSA SELinux 210

Posted by Hemos from the more-secure-then-secure dept.
rstewart writes: "The NSA has released a new version of SELinux for public consumption. It is based on the 2.4.9 kernel and the utilities patches are known to work on Redhat 7.1. More information and the source can be found at the NSA SeLinux site." You can read the what's new for more information.
This discussion has been archived. No new comments can be posted.

New Release Of NSA SELinux More

New Release Of NSA SELinux

Comments Filter:

  • Secure Linux? (Score:3, Flamebait)

    by SpanishInquisition ( 127269 ) on Monday August 27, 2001 @03:20PM (#2222779) Homepage Journal
    What's their mascot? Penguin in Bondage?

  • Grsecurity (Score:4, Informative)

    by chrysalis ( 50680 ) on Monday August 27, 2001 @03:20PM (#2222780) Homepage
    Actually, I'm very satistied with Grsecurity [getrewted.net], a nice kernel patch to enhance the security of a linux kernel.
    What would be the benefit of switching to NSA (but more complexity to admin) ?
    • Hell yea. It kicks ass. The things I like the most are random Pids and client ports. I am a die-hard OpenBSD fanatic and I've actually been weighing the pros/cons of a switch. Roll out my own distro from scrath + grsecurity patch. Wonder why I havn't seen any /. press for grsecurity....If you havn't checked it out, DO IT.

      oh yea, one of the coolest features hides processes of other users from each other. e.g. top or ps will only show your processes. It doesn't *completly* hide other users that are online though. like i said, go try it out.

    • Re:Grsecurity (Score:2, Informative)

      by Anonymous Coward
      NSA's patch gives linux the permissions/ user tracking that allow linux to exist in military environments.

      It doesn't actually make anything more secure.

      • To say that it doesn't make the system more secure is incorrect. It doesn't involve the same kind of security audits that have been carried out with other projects, so the individual components aren't any more secure. The new security mechanisms can improve matters, though, because they make it easier to implement least privilege. You should be able to give programs only the privileges they need to do their jobs, so that a single buffer overflow or trojaned binary won't leave the whole system open to attack. It's an approach that's orthogonal and complementary to code auditing.

    • Re:Grsecurity (Score:5, Informative)

      by BeBoxer ( 14448 ) on Monday August 27, 2001 @05:04PM (#2223151)
      The main difference is that they address totally different security needs. Grsecurity is focused on preventing various common buffer overflows, race conditions, port scans, etc. It doesn't really do anything to make the basic Unix permissions any more fine grained than the currently are.

      On the other hand, the SELinux is focused on exactly this. It allows you to specify much more finely grained permissions for users and processes. This actually complements the grsecurity work. SELinux is focused on minimizing or containing the damage that can be done with a given application. This can both minimize the things that a buffer overflow can do, and minimize the evil tricks that a user might be able to get away with using installed software. For example, a user could restrict what directories netscape is allowed to read and write to. Or an admin could restrict 'top' to opening the kernel read-only so that a buffer overflow wouldn't enable root access. Or preventing even 'root' from changing important system-level libraries and binaries.

      All sorts of really neat things are possible. The downside of course, as you mentioned, is more complexity to administer. But it doesn't make sense to compare Grsecurity and SELinux. They address different security shortcoming of Linux.
      • > "It doesn't really do anything to make the basic Unix permissions any more fine grained than the currently are."
        Grsecurity includes LIDS that does exactly this.

    • Re:Grsecurity (Score:2, Interesting)

      by virion ( 461888 )
      this release of SELinux is very significant because it based on LSM. Linux Security Module will be kernel included system that will allow one to load security modules. SElinux has ability to be built based on old way or new way that is recommanded by Linus. As i am aware it is first working system, others will fallow same suit. Kernel will be able to handle any security model once can desire and it is all pluggable. LSM is needed because current kernel module not allows to do certain things that are neede for security! LSM is the way, when it will be included in next kernel we will not have to recopile anymore just load a module

  • What about debian? (Score:4, Funny)

    by niekze ( 96793 ) on Monday August 27, 2001 @03:20PM (#2222781) Homepage
    Can i apt-get install Carnivore?
    or do i have to use their rpm? :)
  • 3 years without cdparanoia working in the default install.
  • Didn't HP just release there SE Linux the other day?
    I just got back from the book store to pick up 'Linux Journal' and it was funny how 'Linux Magazine' and LJ have almost identical Security Special Editions.

  • I was getting tired of NSA/Windows for all my backdoor crypto needs.



    Search google for NSAKey if you don't know what I'm yammering about

  • Linux was chosen as the platform for this work because its growing success and open development environment provided an opportunity to demonstrate that this functionality can be successful in a mainstream operating system

    Is Linux really a mainstream OS yet? I know it is for servers, but definately not for desktops. I couldn't quite tell where they were going with it, if it was geared more towards servers or desktops, since both need decent security. Could someone shed some light on this?
    • I'm guessing both - the gov't is talking about some serious deployment of Linux on teh desktop and in sensitive areas, I'd epxect they'd use a distro blessed by teh gov't security folks (ie NSA LInux)
    • Well...

      Linux is not as ubiquitous as Windows (which I doubt can be considered "trusted" in the security sense due to how it handles memory protection and device access).

      However, if you look at the other operating systems which are considered B2 or B1 secure [boran.com] Linux is mainstream compared to those.

      j.
    • I think linux make a fine desktop in a secure environment. I guess it would depend on what kind of work you needed the desktop to do. If I need a desktop to edit papers, read email, and brows the web; linux desktop works fine.
    • It was more that Linux was open and they could actually write testable code into the OS. If you noticed in the main NSA security page, they also provided a series of recommendations for security on Windows 2000. Since they couldn't tamper with Windows code, that was all they could do.

      Also, for those people all paranoid about all this, remember it was because of the national security issues that resulted from systems and web servers attacked by Denial of Service, hackers and the Chinese, that caused Congress and NSA to study the problem.

  • Dumb question (Score:5, Insightful)

    by Anonymous Coward on Monday August 27, 2001 @03:25PM (#2222809)
    Aside from the NSA, has anyone taken the time to audit the code?

    • Re:Dumb question (Score:1)

      by Anonymous Coward
      Yes. [neohapsis.com]


      This comment violated the postercomment compression filter. Extra crap added!

    • Auditing would seem to be the whole point. If the NSA were just going to hack Linux for their own purposes, they wouldn't bother to make their distro available for external use. Obviously, somebody at the NSA is rebelling against the conventional notion that you hiding the source code makes a system more secure.
    • Most of the follow-ups have missed your point, I think. Correct me if I'm wrong, but you were asking if anyone had looked at the NSA's code to determine if it had... problems?

      I've taken a quick look (very quick) and am convinced that it's exactly how I'd build a set of Linux patches if I wanted to be sure that a hidden flaw (either now or later) would be hard to detect. Basically, you have a set of "security operations" handlers which are dynamically assigned by modules. The question is, of course, when are these handlers set, and how good is the security around setting them.

      I've not reviewed the second half (majority?) of their code, which is the modules themselves. We should really get a gorup together and discuss the internals of this thing. If it's really good, and we find no fault with the implementation, perhaps it should be come mainstream. However, for now I think paranoia is wise.
  • How can you trust the NSA after playing a complete game of Deus Ex???

  • I can't get the patch to work. (Score:5, Funny)

    by Picass0 ( 147474 ) on Monday August 27, 2001 @03:30PM (#2222842) Homepage Journal
    My compile keeps hanging on NSABackdoor.h
  • The sole purpose of the NSA is to spy on you, now why are they trying to make your system more secure?

    You know they used the favorite hacker OS out there and now give it out freely....funny crap coming from the very same government that locked Dimitri up for showing security flaws, the same gov that locked Kevin up without trial, the same gov run by CIA spinoffs.....fuck the NSA linux, we don't want no gov building a hacker tool.

    You know they're just trying to get closer to the hacker community by giving you a free linux distro. So far it's the only way the feds found to get close to the hacker type, since force didn't do them any good.

    Watch out, they're not up to any good there.

    • Re:Why is the NSA in this? (Score:5, Informative)

      by wumingzi ( 67100 ) on Monday August 27, 2001 @03:52PM (#2222934) Homepage Journal
      The sole purpose of the NSA is to spy on you, now why are they trying to make your system more secure?

      Incorrect. Read the NSA's charter [psu.edu].

      Pay attention to section 1, Article 5, Section 3 et. al. The NSA also is charged with creating standards for the security of information held in DoD computers (specifically), other govt. computers (generally), and promulgating those standards for use in other systems. Here is a nice link to the NSA's computer security guidelines if you haven't seen them [ncsc.mil].

      Yes, the NSA spies on people. No this isn't nice. Yes, the government of the USA does some awfully screwy things, like the DMCA. Tarring the whole government with the same brush is simple-minded.

      Besides, the code is available for your perusal. If you think the uberspooks have put in a back door, get to work and find it!
      • Besides, the code is available for your perusal. If you think the uberspooks have put in a back door, get to work and find it!

        Right. I'm no fan of the NSA, but my guess is that this is all on the level. If they were to put Evil Nasty Code into it, someone would find it, and that would be a major PR gaffe.

        • Re:Why is the NSA in this? (Score:1, Funny)

          by Anonymous Coward
          If they were to put Evil Nasty Code into it, someone would find it, and that would be a major PR gaffe

          Ahh, but that media frenzy would be enough of a distraction to cover up the secret launches of the newest mind control satellites. Watch out boys, these ones can go right through tinfoil...

      • Re:Why is the NSA in this? (Score:2, Insightful)

        by Anonymous Coward
        Yes, the NSA spies on people. No this isn't nice.

        Why do some many people see the NSA as evil? Yes, the NSA listens to overseas communications. That just might avoid a war, or reduce the scope of one.

        For all you US citizens out there, and citizens of our allies, they are the good guys! When an article comes up mentioning the Air Force, people generally don't dwell on thoughts like "yes the Air Force shoots down enemy fighters, no this isn't nice."

        • Why do some many people see the NSA as evil? Yes, the NSA listens to overseas communications. [...] For all you US citizens out there, and citizens of our allies, they are the good guys!

          Forgive us for having a healthy skepticism about the government. Most Americans probably wouldn't mind if the NSA only worked to listen to overseas communications. However, through Echelon, the NSA and its friends have the power to listen to our conversations as well, which we reguard is a violation of our privacy.

          When an article comes up mentioning the Air Force, people generally don't dwell on thoughts like "yes the Air Force shoots down enemy fighters, no this isn't nice."

          Also, just because my government does something (even to foreigners) does not mean I have to like it. Being part of a democracy means evaluating your government's policies, domestic and foreign. That doesn't mean being super-negative and unwilling to admit that the government ever makes good decisions, but it doesn't mean you sheepishly go along with all the government's decisions either. What kind of patriot are you if, when you see the government doing something overseas you feel is unwise, wrong, or possibly both, you don't speak up? The many men and women who have died serving our country--including those in the Air Force--didn't die so you and I could mindlessly go along with whomever happens to be in power at the moment.

      • of they have another purpose in life, how else do they justify unlimited budget?
    • Yeah fuckit the NSA is our friend.

  • BSD? (Score:2, Insightful)

    by Kozz ( 7764 )
    (I'll probably get modded down as flamebait for this, but screw it.) I'm a Linux user. However, I've long thought about installing/using one of the *BSD variants, simply because they are often touted as being even more secure than linux. Why might the NSA not create "SE-BSD"? Wouldn't that likely be even more beneficial?
    • Problably because there has been a focus on security in bsd, specifically OpenBSD [openbsd.org]. Why re-invent the wheel? Another reason might be that Linux has greater market share than the BSDs.
    • Because openBSD beat them to the punch. For a secure *bsd open is the best there is and the NSA knows that.

    • Re:BSD? (Score:3, Informative)

      by benedict ( 9959 )
      I believe the NSA has provided some funding for TrustedBSD [trustedbsd.org].
    • Actually, our favorite branch of our favorite government agency (DARPA, DoD) is funding a lot of work for both. For instance, CBOSS [nailabs.com] is a contract that NAI Labs recently won to start funding such things as SELinux [nailabs.com] and LOMAC [nailabs.com].

      For what it's worth, LOMAC is an example of a project currently underway andbeing developed for Linux and FreeBSD both, so it is not only Linux that is getting security projecs funded for it (^_^)

      Disclaimer: I am an employee of NAI Labs, not that it makes this information less relevant.

  • Before downloading this software, you must accept the warranty exclusion and limitation of liability which appears below.

    Warranty Exclusion

    I expressly understand and agree that this software is a non-commercially developed program that may contain "bugs" (as that term is used in the industry) and that it may not function as intended. The software is licensed "as is". NSA makes no, and hereby expressly disclaims all, warranties, express, implied, statutory, or otherwise with respect to the software, including noninfringement and the implied warranties of merchantability and fitness for a particular purpose.

    Limitation of Liability

    In no event will NSA be liable for any damages, including loss of data, lost profits, cost of cover, or other special, incidental, consequential, direct or indirect damages arising from the software or the use thereof, however caused and on any theory of liability. This limitation will apply even if NSA has been advised of the possibility of such damage. I acknowledge that this is a reasonable allocation of risk.

    hmmm. "bugs", clear this up will ya? Software glitches or electronic listening devices? Plus, they use "may contain"...Are they giving it permission? My software isn't allowed to have bugs. If it does, it is an error! "it may not function as intended" hmm you mean...like...the 'security' part? "In no event will NSA be liable for any damages, including...or other special, incidental, conseqential...damages...arising from the software"

    special: backdoors we forgot about that we find later
    incidental: backdoors we internally documented
    direct: What we break/steal from you
    indirect: What l33t hax0rs break/steal from you after our direct methods post on Bugtraq.

    and finally...."This limitation will apply even if NSA has been advised of the possibility of such damage" if we 'accidentally' left our public ssh identity in /root/.ssh/authorized_keys and someone points this out...we'll we don't need to explain it, you kids have played Counter-Strike enough to figure it out. 'Hostage Down' hahah
    • I'm not sure if you're trolling, or just karma whoring, hoping some 13-year-old with mod points will mod you up as "informative" or "insightful" because you're bashing a 'gummint' agency, and I probably shouldn't bother, but I'll go ahead and bite.

      Those disclaimers are the exact same disclaimers, almost word for word, that you will find on MANY MANY pieces of software (especially Open Source types). Just because the big, scary government likes to cover their butts the same as everyone else, that doesn't mean that they're out to spy on your computer. You flatter yourself to think that the NSA even cares about the half-naked Brittney Spears pictures you are downloading. They don't. The source code that is being patched into your kernel is right there in front of you. If you have concerns about it, read it. I'm sure that many people will, just to make sure there are no back doors. If you find a back door, fix it. They can't patch something into your kernel without your interaction. Now go back to playing your video games, and let the educated people see if they can do something useful with this patch.

      P.S. I only speak in condescending tones to those who sound like children.

      • that doesn't mean that they're out to spy on your computer. You flatter yourself to think that the NSA even cares about the half-naked Brittney Spears pictures you are downloading. They don't.

        You do realize that there is some [slashdot.org] evidence [slashdot.org] of [slashdot.org] a [slashdot.org] precedent [slashdot.org] for [slashdot.org] that sort of thing.

        I agree that it is silly to suggest that the boilerplate disclaimer is evidence of a secret NSA plot. But your suggestion -- that an intelligence agency is not interested in doing any spying -- is equally ludicrous.

      • I guess you never heard about an IT worker who was sending classified company documents to the outside world by encrypting the data inside images and sent to his hotmail.com account. The FBI helped catch him. Maybe they were pictures of Britney! Why target individuals, when you can target many more?

        What percentage of linux users do you actually think can come close to actually security auditing code? If Linus renamed linux.h to backdoor.h (and no actual changes in the code), how many people would actually find it on their own?

        But, the main point still goes over to motive. *WHY* would a government agency, who primary concern is nation al security (supposedly only outside of American soil), mess with a 'grass roots' OS, modify its kernel, then *RELEASE* it to the public? Use a strlen incorrectly and it's a bug. The shit happens all the time. Suppose for an instant, that someone wanted to allow this bug, since it could be used to gain unauthorized access. OpenBSD patches shit things "that could *never* be exploited!!!", but somehow, in a few years, comes back and bites everyone *else* in the ass. And OpenBSD still gets bit in the ass, just not as often as everyone else. You wouldn't need to include 'backdoor.h' to do something like that. Just use a buffer of size n-1 where it actually needs one of size n. Make it reference through about 20 libraries and function calls (laundry it) and make it only occur after certian other specific events. Nevertheless, if mr. nobody makes something like this and puts it on freshmeat, your risk of discovering the application, installing the application, and he finding you and exploiting said bug would be much smaller than a branch of the US government concerned with national security.

        I see no valid reason to trust the NSA, FBI, CIA, etc. without *extreme* caution and scrutiny. Besides, they have no valid reason to trust us, without *extreme* caution and scrutiny.
    • may contain "bugs"
      This is "may" in the sense of possibility, not in the sense of permission. Check out the definition [dictionary.com] at dictionary.com.
      other special, incidental, consequential, direct or indirect damages
      These are standard legal terms which you're grossly misconstruing. Suppose Joe hit you in the face. Here are some possible types of damages:
      • General: those damages presumed by the law to exist in every case of this type. Example: pain and suffering.
      • Special: damages which do not arise in every such case. Example: medical bills.
      • Direct: damages directly caused by Joe's wrongdoing. Both of the above examples would be direct damages.
      • Indirect, incidental, and consequential Incidental and Consequential damages together comprise indirect damages. There's a distinction between them, but it doesn't matter. These damages refer to problems not directly caused by the wrongdoing. For example, the time off work you had, or (in a different context) lost profits.
      As it happens, this is a pretty generic disclaimer; I'm pretty sure even the GPL contains similar language.

  • Just a question... (Score:5, Insightful)

    by mystery_bowler ( 472698 ) on Monday August 27, 2001 @04:03PM (#2222969) Homepage
    Is the NSA responsible for figuring out the best ways to lock down whatever OS's the various government agencies of the U.S. use? Reason I'm asking is because seems like recently (or kinda-recently) there was an article here on /. with a link to the NSA's guidelines for securing Win2k. I'm sure the NSA has reasons that I don't even want to know about for running both their own build of Linux and a tightened-up install of Win2k, but I'm just curious as to the extent of their influence on other agencies' software choices.

    Do other agencies just follow along with the guidelines the NSA sets forth, try to get independent advice or go it alone? Financially, at least, it would seem like going with the NSA's guidelines would be the way, since the information is more or less public (at least it is in these two instances) and there wouldn't be any time or money spent on third-party tripe (bids, negotiations, etc) or independent research.

    • Re:Just a question... (Score:3, Informative)

      by FooGoo ( 98336 )
      Yes... Executive Order 12333 of 4 December 1981 describes in more detail the responsibilities of the National Security Agency. The resources of NSA/CSS are organized for the accomplishment of two national missions:

      The Information Assurance mission provides the solutions, products and services, and conducts defensive information operations, to achieve information assurance for information infrastructures critical to U.S. national security interests.

      The foreign signals intelligence or SIGINT mission allows for an effective, unified organization and control of all the foreign signals collection and processing activities of the United States. NSA is authorized to produce SIGINT in accordance with objectives, requirements and priorities established by the Director of Central Intelligence with the advice of the National Foreign Intelligence Board.

    • What FooGoo said.

      There are two competing standards for security on government computer systems: DIA (Defense Intelligence Agency) and NSA's, depending on where you are and whose money you're getting, you conform to one or both standards. You'd be surpsied at what a HUGE pain in the ass this can be to do, especially when the standard changes from month to month and which standard inspectors decide to go by.

      This is the government, nothing is ever simple if we can find a way to make it complex.

    • The NSA is responsible for vetting all hardware and software that the US government uses for classified materials. This includes DoD computers (such as the USMC), as well as the State Dept. and others (such as NASA). So, in short, yes. I'm not sure if other parts of the government are required to follow NSA guidelines for non-classified computers, but for classified comptuters, they are required to adhere to the NSA guidelines.

      --sam
  • I'm so sure the source doesn't contain anything like this:

    if $LOGNAME==`NSA_Agent` then
    echo `crackyou.nsa.gov ispy` >> /etc/hosts.equiv
    useradd ispy -G wheel -d /root
  • 13. Is it secure?

    (blah blah blah)...Security-enhanced Linux is ... very unlikely to meet any interesting definition of secure system.
  • I don't know about the rest of you, but i cannot help but feel a little insecure about the NSA's secure version of linux.

  • Like it? Send thanks and donations to above address. Have a good one.
  • Then read this:

    http://www.acm.org/classics/sep95

    (Reflections on Trusting Trust - Ken Thompson)

    "The final step is represented in Figure 7. This simply adds a second Trojan horse to the one that already exists. The second pattern is aimed at the C compiler. The replacement code is a Stage I self-reproducing program that inserts both Trojan horses into the compiler. This requires a learning phase as in the Stage II example. First we compile the modified source with the normal C compiler to produce a bugged binary. We install this binary as the official C. We can now remove the bugs from the source of the compiler and the new binary will reinsert the bugs whenever it is compiled. Of course, the login command will remain bugged with no trace in source anywhere.

    Moral
    The moral is obvious. You can't trust code that you did not totally create yourself. (Especially code from companies that employ people like me.) No amount of source-level verification or scrutiny will protect you from using untrusted code. In demonstrating the possibility of this kind of attack, I picked on the C compiler. I could have picked on any program-handling program such as an assembler, a loader, or even hardware microcode. As the level of program gets lower, these bugs will be harder and harder to detect. A well installed microcode bug will be almost impossible to detect. "

    A definate read !
    Believe it or not, as Ken Thompson says, you will be 100% secure.
  • Nothing against the GPL, but I find it disgraceful that the United States government is producing code under the GPL. Works produced by the government should be public domain, not GPL. And yes, there is a difference.
    • Err...
      Do they really have a choice? Remember, it is a modification of Linux, so it must be released under the GPL or it would be a GPL violation.
      • If they don't have a choice, they shouldn't be doing it. Period.
          • Because United States citizens don't pay their taxes for hte government to produce proprietary licended code. It should be able to be used by all citizens in all circumstances. We all pay for it, businesses, citizens, and even Microsoft. there is no reason we all shouldn't be able to use what we pay for under a public domain license.
            • But everyone can use it in all circumstances, you just can't appropriate it.

              Seems fair to me. Though I'm not a US tax payer, so I suppose my opinion doesn't really count... though I suppose I pay the US Imperialist Stealth Tax in other ways....
            • By the way, I hope you didn't get another IBM drive because they seem to be pretty flakey. Make sure you have a good backup.
            • Absolutely. When are you going to be making the same claims for other tax payer funded items?

              Consider the White House... Everyone should get to sit in the big chair? Stealth Bomber? You want a go?

              Don't think so. Just because you pay for it doesn't mean you personally or you corporately benefit from it. In this case you can use it; even modify it. Be happy. But you can't modify it and distribute it without everyone else seeing how you've hacked it. That's much fairer than the stealth bomber.
            • I agree completely. All government funded software should be public domain. I'm sick and tired of my tax dollars going to fund development of commercial software. This is nothing more than welfare for rich (and in the case of M$, criminal) organizations.

  • Let's lose the FUD, people (Score:5, Insightful)

    by Tassach ( 137772 ) on Monday August 27, 2001 @04:43PM (#2223100)
    The rampant, grossly uninformed FUD that's flying around here is making me ill.


    First try and wrap your brain around this concept: The NSA has TWO distinct missions -- to spy on foreign nations on behalf of the US government, and to keep foreign nations from spying on US govt. and businesses. People tend to forget about that second part. Knowing government beaurocracy, it's not at all unlikely that the spy-on-other-folks department and the keep-other-folks-from-spying-on-us department are involved in a turf war, or are working at cross-purposes.


    Second: the NSA secure linux is a patch to the standard Linux kernal. If you are paranoid about them trying to do somthing neferious, download the source and diff it against the baseline code. It's pretty hard (but not impossible) to hide a backdoor in source. Paranoid types, make sure you trust your compiler [as well as any other binary that touchs the code as it's being transformed from source to executable] If the NSA wanted to hack your box, they have a lot of better ways to do it than releasing a GPL'ed trojan. Give them some credit -- they are not that stupid.


    This is a Good Thing. Having a respected government agency endorse Linux gives it huge amounts of credibility. [OK, geeks may not trust/respect the NSA, but you can be sure that CEOs and PHBs do.] Believe it or not, occasionally the US gvt does manage to Do The Right Thing, even if it's unintentional.

    • Agreed.

      However, this release certainly does not constitute an endorsement. They released it only to demonstrate certain security improvements that should be made to Linux. They admit it is still not secure in any meaningful way (read the FAQ).

      I think this is a good thing. Linux undoubtedly needs better security.
  • Until someone proves me that the NSA Linux distro contains any backdoor, or something that allowes the NSA to snoop on you while running their distro, this is all F-U-D.

    When I say something, you want facts right ?
    Now it's your time to give that facts, I've read no real fact until now.

    So upon then, you are just making a fool of your self with these conspiracy theories. Gimme facts about a backdoor in the NSA distro.

  • Paranoia Strikes Deep (Score:3, Insightful)

    by vbprgrmr ( 411532 ) on Monday August 27, 2001 @05:18PM (#2223185)
    After reading many of the comments on NSA research of security on Linux and Windows 2000, it amazed me the level of paranoia of many of the posters. Let's get real folks! All this research has come about because of the hacks and DoS attacks of commercial and institional computers and servers. The reason NSA chose Linux to test their codes was because it was open. If you notice they also supplied a series of recommendations for security on Windows 2000 systems. Since they couldn't alter Windows source, that was all they could do.

    I would guess for the all-out hacker geek, this NSA compile on their system, probably would cause paranoia (like some invisible eye looking back at you !! ha! ha!) But probably wouldn't have any other power you imagine it has. As for anyone else, it wouldn't hurt to at least study their implementations.


    "Paranoia strikes deep
    Into your life it will creep
    It starts when you're always afraid
    You step out of line, the man come
    and take you away"

    -- Stephen Stills, "For What It's Worth"

  • Why does the NSA only make tools that work with Red Hat? Yes, Linux is Linux, but distributions place different stuff in different places. I think they should expand a little and make modifications to work nicely with other popular distributions, too.
    • Maybe because the most common distros (at least commercially) are rpm-based, & a lot of US government organizations (including the one I contract for) use Red Hat?


      I would think that the kernel patches & source code would be able to build on *any* distro, not just RH...or you could use alien and/or rpm2tgz.

  • So, what is this NSA thing?

    I keep asking around, and all I get is that there is "No Such Agency".
  • From the brief summary [nsa.gov], it looks like this would be very useful to protect a Linux system against malicious code, worms, and many other forms of attacks. For example, rather than trying to find and fix every buffer overrun in sendmail, you could keep sendmail from becoming destructive even if it is compromised. And you don't have to blindly trust every RPM and Debian package you install anymore, you can instead define policies for what the executables in that package may and may not do (e.g., an audio player probably has not business accessing /dev/hda).
  • This version of Linux is NOT, REPEAT NOT any more secure than any other distro as far as most of us have a sense of the word. What is does do is a couple of things.

    1) It shuts off almost all services and ports by default. Unless you specify it, it does not enable it.

    2) It includes (rather clever and robust) methods for autheticating a user and his/her permissions and/or clearance levels on-the-fly in a secure manner called Flask. If you read this [nsa.gov] document, it explains it in very precise terms (if somewhat dryly).

    The articles linked from the last time NSALinux was covered were better, but ./ is screwy today and I can't get it to come up.


  • The United States National Security Agency is a spy agency. It's purpose is to discover things that other people want to keep secret. It is the official U.S. agency for snooping. Democracy means acting openly; the NSA is, in this sense, anti-democratic.

    Nevertheless, it is possible that not all people who work for the NSA believe in sneakiness. Remember that the purpose of DARPA (Defense Advanced Research Projects Administration) was to find better ways to kill people and destroy their property. However, people within Darpa intented the Internet.

    NSAs work should be carefully audited. But things are not so wonderful that the Open Source Community can turn down honest contributions from any source.
    • As others have pointed out, the NSA has two jobs - one is to spy on foriegners' communications (and possibly run the spy photosats, I'm not sure) and the other is to help secure US government communications against foriegn spy agencies.
  • is that they keep referring to linux as a 'mainstream opreating system'. how sweet it is.
  • When I install, my formerly encrypted partitions show up as being mounted on /dev/squeamish_ossifrage
    ???
  • This system is designed to answer the question "can a secure system be built that people will use?" The object of this project, as NSA makes clear, is to find out if people can use a system that has mandatory security features.


    Previous NSA secure OS projects (I worked on one, 20 years ago) concentrated on security at the expense of usability. This resulted in systems that didn't get used much. This time, they're trying to fix the usability problem first.
    If mandatory security in Linux goes mainstream, this would be a major step forward. Once we see important applications like Apache modified to work under mandatory security, we'll have real progress.

Slashdot Top Deals

"Being against torture ought to be sort of a multipartisan thing." -- Karl Lehenbauer, as amended by Jeff Daiell, a Libertarian

Close