Red Hat, Oracle to get Gov't Certification for Linux 171
Mark writes "As this news.com article states, 'Red Hat and Oracle plan to announce on Thursday that the companies have teamed to get Linux evaluated under the Common Criteria, a certification that could open doors for the broader use of open-source software by government agencies.' It looks like this will be an important step in getting Linux to be more widely adopted in governments around the world."
Germany (Score:5, Funny)
Re:Germany (Score:2)
Re:Germany (Score:1)
Don't be silly, We taught them a lesson. . . (Score:2, Funny)
KFG
Re:Germany (Score:1)
http://www.computable.nl/artikels/arch
Also the goverments of France and Spain funded Open Souce initiatives.
http://www.osopinion.com/perl/story
Altough costs are a one of the big reasons for countries like Spain, the Dutch goverment believes that using Open Source software opposed to properietary software will improve quality, realibility, security and innovation of the software.
Re:Germany (Score:2)
What a positive (Score:2, Flamebait)
Having a working solution already in place works for business. You can say "we have system X already go, and can set it up for you". It shows you are on the ball.
Working for a certification like this is similar. Best solutions combine the strengths. What other pre-made solutions do users see as a good thing? perhaps systems such as linux plus apache. That's another well known one
note: slashdot user 'danamania' is a transsexual. guy's watch out if you are talking to him
Frankly... (Score:5, Funny)
Thanks for being frank. This should be a wake-up call for all slashdot users.
--sex [slashdot.org]
Re:Frankly... (Score:5, Insightful)
And where are all those articles that were popular on /. when NT was certified, basically telling us that this Common Criteria is total crap? Is it not a crap anymore?
Re:Frankly... (Score:5, Interesting)
And as for the other point, wouldn't level 2 be a step towards level 4? Ya gotta start somewhere, and level 2 opens a lot of doors.
Re:Frankly... (Score:1, Informative)
Re:Frankly... (Score:2)
Wake up, and stop spreading FUD. Not only "without a network" was NT4, but it also was completely different certification.
For Common Criteria EAL 4 Microsoft certified Windows 2000, and with full networking.
RHAS again? (Score:3, Insightful)
Sheesh... How much pushing does RHAS need? Show me a TCO study where RHAS at $800/server/year beats any free Linux distro. Simply plugging in a $800/server/year cost into most of the TCO studies I've seen makes Windows look like a bargain.
Re:RHAS again? (Score:5, Informative)
But for those that want service and don't want the hastle of putting all the pieces together they also provide a nice package.
As far as windows a bargain, how much does quality node-balancing software cost (~$500), Quality Firewall (~$300), Advanced Server ($750), I could keep going but I think you get the picture. If you don't need HA then RHAS isn't a great deal, but then again if you do, MS doesn't have a competive product...say what you want about 2000&XP (big improvement over NT&9x), you can't call them HA.
BTBTBT
scooby
Re:RHAS again? (Score:2)
Re:RHAS again? (Score:3, Informative)
BUT if you read redhat's site, they explicitly say that you can make your own ANYTHING based off their open source code (+ others), are sell it as their own. The only caveat is that you CAN'T use the RH logo or name to endorse your product...it HAS to be in your name, and show no direct affiliation (the most you can say is that it is based on RH, like Mandrake does/did).
So if you follow their directions, build your own ISO, you could sell it as yourDistroLinux, the only problem is support, etc. Most companies that really have HA requirements also have the money (and need) for large full service support contracts. And if they are going to pay for it, they might as well pay RedHat (the industry standard).
I think is would be a great OSS project, and in fact there are several like it out there. http://linux-ha.org/ (I've counted 8 "developer groups" that looked like they already had a decent HA solution).
BTBTBT
snoopy
Re:RHAS again? (Score:2)
Re:RHAS again? (Score:5, Insightful)
The companies plan to first push Red Hat Linux Advanced Server for a modest level of certification: Evaluation Assurance Level (EAL) 2.
Sheesh... How much pushing does RHAS need?
Sometimes that all a company look's at is certification levels. I have a friend that runs a software development company. They cannot get any big jobs because they lack a software process certification. It does not say that they are great programmer's or effective, it just says, "Hey we went through this process and this is the type of service that we provide."
It is is the same thing with certain types of software. If you don't have the correct certification, certain agencies and businesses cannot even consider doing business with you. They would not go through these hoops if they don't not believe that they would get somewhere
Re:RHAS again? (Score:5, Informative)
Re:RHAS again? (Score:1)
Re:RHAS again? (Score:4, Interesting)
Huh?
1. RHAS is free. The added professional services cost $800 but the whole CD is GPL. Read this (http://www.redhat.com/software/whichlinux.html):
2. A Windows Cluster with SiteServer and SQL Server can cost upwards of $20,000. I don't see how this is a "bargain" compared to $800.
Re:RHAS again? (Score:2)
Is Larry making a stand? (Score:5, Interesting)
Wow. I knew Larry hated Bill and MS, but I sure wouldn't have expected this! Or is he just conceding the Windows server database market to Bill and trying to grow the Linux market on the low end + the UNIX market at the higher end?
Hmm...
Re:Is Larry making a stand? (Score:5, Insightful)
Wow. I knew Larry hated Bill and MS, but I sure wouldn't have expected this! Or is he just conceding the Windows server database market to Bill and trying to grow the Linux market on the low end + the UNIX market at the higher end?
Smart companies try to transform complementary products of other companies into commodity items. OS for Oracle nicely fits into this picture. Since they need it anyway, might as well be inexpensive Linux. Also, one more Linux system - one less Windows system that could run MSSQL instead of Oracle. The choice to support Linux is really no brainer for Larry the Nut.
Linux port should also be relatively cheap for Oracle, since it is very much like standard Unix and Oracle tends to use basic OS facilities anyway.
Re:Is Larry making a stand? (Score:5, Funny)
larry & co have been pushing oracle on linux for years. after all, if you run oracle on a stable and cheap OS, there's more licensing and support $$$ left over for larry.
larry's support for linux is not a big deal for sun (at least it wasn't when he started), since 99.999% of linux runs on x86, and (almost)nobody uses solaris on x86.
larry has always hated bill. he's a simple man. he wants, power money and women(in that order), and bill is after the first two. linus is a hippie who's already married, so there's more for larry with linux.
Re:Is Larry making a stand? (Score:4, Funny)
Re:Is Larry making a stand? (Score:1)
PSSSST
Linux is a good match (Score:1)
Hearing this Q&A, I get the impression that Oracle is an enterprise software developer and they continue to be that way, but the stuff that they do is not kind of computing that requires 1024 64bit processors running simultaneously. Linux is good enough; Linux has matured enough so that it can handle enterprise software level computing, though it might not do Molecular Dynamics Simulation (yet).
So, sure, this all makes sense. Linux does what it needs to do to run an enterprise software, and certainly cheaper than Sun UltraSparc+Solaris and IBM mainframes. One thing that Linux supposedly lacks is Label, Certificate, an official Statement that says "Linux is a good OS". Oracle wants it to push Linux to corporate gulf players because these gulf players want to see "Linux Approved" stamp. Once Oracle accomplishes it, they've got all the tools to conquer the world of Enterprise Software.
Re:Is Larry making a stand? (Score:4, Insightful)
He seems to be saying that there is no windows database server market. I think that probably is pretty correct as far as Oracle is concerned. I don't know too many people who would run oracle on windows espcially for large operations where oracle really shines. If you need oracle and can pay for it there is ZERO reason to put it on windows.
Re:Is Larry making a stand? (Score:2, Interesting)
I'm not a MS basher by nature, but rather from experience. I have endured over 10 years of crashy shitty programs that were developed for their sucky OS and I just can't deal with it anymore.
At work, I probably know more about MS Windows than anybody else, but if anybody asks me for help I shut them down and tell them to call the IT department. I simply do not have the time or inclination to help a company which has caused me so much grief. Ask me a Linux question and I will help you all day, ask me a Windows question and I will tell you to call MS Tech support.
Re:Is Larry making a stand? (Score:2)
My company runs the intranet portal on the Portal-Server, on a NT4 BOX. We have about 2000 employees. ;-)
At the beginning, they had such huge problems, that it almost wouldn't run and they escalated the issue up to Oracle HQ (we're an important company for Oracle).
Now, it runs more or less, but don't ask about TCO
The reason some people run it on Windoze is, that they don't know anything else and thus have a Windozw-only infrastructure. This is OK, as long as you can pay for it....
Re:Is Larry making a stand? (Score:2)
Re:Is Larry making a stand? (Score:2)
If that were true, then MSSQL Server would not exist, and I bet that is what you would run on a Windows box.
Plus, unless things have changed recently, Oracle's primary OS target is Solaris, and all of the other builds are ports from the Solaris build.
Re:Is Larry making a stand? (Score:2)
MSSQL server only runs on windows. It's the only database that I am aware of that only runs on one platform. People who run Oracle need big databases and for that windows is inadequate. Yes there is a market for windows databases but not if you are Larry Ellison.
"and I bet that is what you would run on a Windows box."
Most likely not. Interbase, Sapdb, Mysql, and Postgres all run on windows and are free and open source. If I wanted a commercial database product I could choose from informix, db/2, sybase, sql anywhere, mimer, frontbase, and openbase. Most of these cost significantly less then MS-SQL server and perform wonderfully on windows as an added bonus I could migrate to another operating system if I ever needed to.
Honestly I don't see any real advantages to MS-SQL server. If my needs are small to modest open source products are great. If I need more power I can buy cheaper products, If I need enterprise level stuff I wouldn't use windows anyway.
Re:Is Larry making a stand? Always did :) (Score:1)
Didn't Oracle dump Windows as a strategic platform back in '95? Linux is a completely natural development path for Oracle.
Nice to See (Score:1)
Not quite... (Score:4, Interesting)
Getting the US Government to start buying Linux based solutions gives them more potential customers. I would guess that is a given that if it is certified for government use at the federal level, that it becomes a legitimate product for the state governments as well.
Besides, how is this different from say, IBM and Sun working together to promote Java?
END COMMUNICATION
Re:Not quite... (Score:1)
Re:Nice to See (Score:1)
Now we just need an OS DB (Score:5, Funny)
Re:Now we just need an OS DB (Score:2)
Nah, they'd only sew the patches to their sleeves.
Re:Now we just need an OS DB (Score:2)
Hang on, someone just ran that query
Support coming from the right areas.. (Score:4, Informative)
Having Oracle on side will help as well, as the article mentions they have tones of experience getting their product (and thus the OS) certified. It is massivly in Oracle's interest to do so - less $'s on the OS means the purchaser can spend more on the hardware / DB.
Re: (Score:1)
Again? (Score:2, Funny)
I think Slashdot just got certified by the Department of Redundancy Department.
Hypocritical? (Score:3, Insightful)
A bit of MS bashing is fine, but this is taking it a bit far for me.
Re:Hypocritical? (Score:5, Informative)
The Common Criteria is of the fashion:
"I have this product. I am going to tell you what it does in a security-related context. You can take this checklist, test my product, and certify that it does in fact do these things."
There is no security implied by the certification. It is a recommendation from the vendor of what the product is best used for when the customer is shopping for products to do certain security-related tasks. The vendor makes the checklist, a third party says "yay" or "nay", the customer says "i need a product that does X, Y, and Z. Windows does X, HP-UX does X and Y, and this one all three, plus it will help my sex life". Or something similar, anyway.
These things can be as simple as "userA cannot access userB's files" to "enforces complex passwords" to "has the biggest crazy ass firewall known to man". Well, maybe not that last one...
Now y'all can go back to shootin' your mouths off.
--mandi
Re:Hypocritical? (Score:3, Interesting)
Isn't this practically the same post that got modded up the first time [slashdot.org] we saw this article?
Re:Hypocritical? (Score:2, Interesting)
Isn't this the same question [slashdot.org] that someone asked when the same story [slashdot.org] was posted yesterday?
The answer remains unchanged 24 hours later. No, it's not the same certification.
Hmmmm...duped question for a duped article from someone thinking that there's such a thing as "taking it a bit too far" when it comes to MS bashing on SlashDot.
Dude, stop drinking that decaf stuff -- it's obviously slowing your cognitive processes down. Take two expressos and try again in the morning. (If you're lucky, this article'll be posted for the third time by then. :-)
Re:Hypocritical? (Score:1)
Re:Hypocritical? (Score:5, Insightful)
People that have to make such decisions are also a lot safer by choosing certified products; if something goes terribly wrong, you can always say that the product you choose was has some "official" certification upon which you based your decision and you're pretty safe. If it goes wrong and you don't have any such paperwork to fall back on, you're definately in a much weaker position explaining why you didn't choose the "safer" product to someone that doesn't know the difference between product A and product B and only sees "product A is certified, product B isn't". It's just that maybe you and I know that Linux is often a better choice but an incredible lot of other people don't.
Recession can be Good Thing (Score:4, Interesting)
Sometimes it takes something that has a drastic economic impact to for people to seriously look at alternatives. Linux is gather momentum at just the right time, I believe. Everyone has financial problems, and is looking for cheaper alternatives. Linux packages are hitting that point which say "We're professional software." These sort of certifications which add reinforce to that reputation.
Linux has a bright future ahead.
Re:Recession can be Good Thing (Score:1)
I agree that Linux, and UNIX systems, have merit and are powerful tools.
I don't see how a certification process, which will 'certify' one binary distribution of Linux, validates Linux. It validates one binary distribution of Linux. You don't seriously believe that said certification will mean anything more than a single binary snapshot is certified, I hope.
What certification means (Score:2)
Think like a marketer, and you'll get the point of all this. Remember, the folks at your local government agency who actually run the IT systems are seldom the folks who determine which systems enter the selection process.
Politics and marketing trump technical merits, as our friends and Microsoft know so well.
Re:What certification means (Score:2)
The "revolution" (Score:2)
Marketing may be a distasteful exercise to you, but I'd be willing to bet that that without the marketing that Linux has received so far, the great explosion of Linux distros, books about Linux, software tools, Linux-optimized hardware, Linux drivers, and so on would simply not exist.
If the "revolution" means Linux as a hobbyist's OS, or as a geeks-only OS, then you're right. The revolution IS over. But isn't the point of a revolution to bring your ideas into the mainstream?
Re:The "revolution" (Score:1)
The 'great explosion of distros' could also be called 'the rising tower of babel'. So damned many distros out there. I prefer the same old Slackware I was using in 1994.
'Books about Linux.' Hmmm. I like the O'Reilly books, and the ones I like the best aren't even specifically about Linux. They're UNIX books.
Almost nothing I like about Linux wouldn't exist without marketing. A lot of it would probably be actually more focused and powerful without all the marketing hype and the way it distracts people off to 'oooooh pretty' features.
M$ confirmns this. (Score:1)
Re:M$ confirmns this. (Score:1)
"M$ condemns this".
This is not a Dupe! (Score:5, Informative)
I'm always amazed by the number of clarivoyant slashdot users we have around here who don't need to read a story before posting...
Yes it is (Score:2)
Post a Mirror or copy of text (Score:1)
Re:Post a Mirror or copy of text (Score:1, Informative)
Red Hat and Oracle plan to announce on Thursday that the companies have teamed to get Linux evaluated under the Common Criteria, a certification that could open doors for the broader use of open-source software by government agencies.
The effort is expected to take nine to 10 months and cost up to $1 million. But if successful, it could pay off handsomely for Red Hat and Oracle, as well as for Linux.
"The government has been deploying Linux in smaller settings quite broadly, but it's still done by exception, by and large," said Mark De Visser, vice president of marketing for Red Hat. "What happens with these certifications is that they will push Linux into the mainstream."
The United States government is among 14 nations that recognize the Common Criteria evaluation. A certification from one country is recognized in the others. With countries from Germany to Peru considering using open-source software, having a certified version of Linux will help break down barriers.
The companies plan to first push Red Hat Linux Advanced Server for a modest level of certification: Evaluation Assurance Level (EAL) 2. In total, there are seven levels of certification attesting to varying grades of security, reliability and developmental process control. The highest level that a commercial software laboratory can certify is EAL 4, which Microsoft received for Windows 2000 last fall.
The EAL level needed by a government customer depends largely on the agency and the application in which the software will be used. On Tuesday, the Department of Defense (DOD) gave Red Hat a Common Operating Environment certification, which attests to a certain level of interoperability with other operating systems.
Oracle 9i has already been certified at EAL 4 on both Windows NT and Solaris, but has to be recertified for each operating system on which it runs. And Oracle thinks that there is a large market among government customers for the company's database running on Linux. In fact, some government clients have been clamoring for Linux, said Mary-Ann Davidson, chief security officer for Oracle.
"One of our large DOD customers asked us if we could foster a Linux evaluation," she said. "The customers truly care about getting Linux evaluated and want Oracle running on it."
There hasn't been much interest in running Oracle on Microsoft's Windows platform because of past security problems with Microsoft products, despite the company's major security push, Davidson said.
"We are going to use Unix and Linux as the evaluation platforms for our products in the future, and not Windows, because the customer demand for Windows is not there," she said. "Frankly, there is a fair amount of disenchantment with Microsoft products because of security problems."
After Red Hat earns the EAL 2 certification, Oracle plans to work toward getting its Oracle 9i Release 2 database running on the evaluated Red Hat Linux Advanced Server certified at the highest commercial rating, EAL 4. Oracle currently ships Oracle 9i Release 2 on Red Hat Linux Advanced Server as part of its Unbreakable campaign.
The final goal for both companies is to have both Red Hat's software and Oracle's software certified under the Common Criteria at EAL 4.
Oracle has tackled the process 15 times on a variety of operating systems.
The Common Criteria, an international standard administered by the National Institute of Standards and Technology in the United States, grades products based not only on their security and reliability, but also on the development and support processes that ensure quick responses to problems.
Other nations that have signed the Arrangement on the Mutual Recognition of Common Criteria Certificates in the Field of IT Security are Canada, France, Germany, the United Kingdom, Australia, New Zealand, Italy, Spain, the Netherlands, Norway, Finland, Greece and Israel.
The benefits of Common Criteria certification for Red Hat's Linux products should trickled down to the rest of the Linux community as well, said Dave Dargo, vice president of Oracle's Linux program office.
"The benefits of this evaluation extend beyond Red Hat in the long term," Dargo said, adding that the enterprise-level changes Red Hat and Oracle have made to the Linux kernel have made their way into Linux 2.5, the newest version of the kernel under development.
Moreover, the evaluation process, while expensive, should result in a more secure version of Linux being generally available, added Davidson.
"Fixing a major security hole costs a lot," she said. "And while certification won't prevent those holes, it helps to have a stricter development process. Finding one security hole that you otherwise would have missed, easily pays for evaluation."
how can it be secure without drm ? (Score:2, Funny)
Someone please think about our children.
Why? (Score:1)
Re:Why? (Score:1)
Re:Why? (Score:1)
OSS vs. Windoze (Score:1)
Re:Why? (Score:1)
Mirror of article (please don't over-mod me!) (Score:2, Informative)
The effort is expected to take nine to 10 months and cost up to $1 million. But if successful, it could pay off handsomely for Red Hat and Oracle, as well as for Linux.
"The government has been deploying Linux in smaller settings quite broadly, but it's still done by exception, by and large," said Mark De Visser, vice president of marketing for Red Hat. "What happens with these certifications is that they will push Linux into the mainstream."
The United States government is among 14 nations that recognize the Common Criteria evaluation. A certification from one country is recognized in the others. With countries from Germany to Peru considering using open-source software, having a certified version of Linux will help break down barriers.
The companies plan to first push Red Hat Linux Advanced Server for a modest level of certification: Evaluation Assurance Level (EAL) 2. In total, there are seven levels of certification attesting to varying grades of security, reliability and developmental process control. The highest level that a commercial software laboratory can certify is EAL 4, which Microsoft received for Windows 2000 last fall.
The EAL level needed by a government customer depends largely on the agency and the application in which the software will be used. On Tuesday, the Department of Defense (DOD) gave Red Hat a Common Operating Environment certification, which attests to a certain level of interoperability with other operating systems.
Oracle 9i has already been certified at EAL 4 on both Windows NT and Solaris, but has to be recertified for each operating system on which it runs. And Oracle thinks that there is a large market among government customers for the company's database running on Linux. In fact, some government clients have been clamoring for Linux, said Mary-Ann Davidson, chief security officer for Oracle.
"One of our large DOD customers asked us if we could foster a Linux evaluation," she said. "The customers truly care about getting Linux evaluated and want Oracle running on it."
There hasn't been much interest in running Oracle on Microsoft's Windows platform because of past security problems with Microsoft products, despite the company's major security push, Davidson said.
"We are going to use Unix and Linux as the evaluation platforms for our products in the future, and not Windows, because the customer demand for Windows is not there," she said. "Frankly, there is a fair amount of disenchantment with Microsoft products because of security problems."
After Red Hat earns the EAL 2 certification, Oracle plans to work toward getting its Oracle 9i Release 2 database running on the evaluated Red Hat Linux Advanced Server certified at the highest commercial rating, EAL 4. Oracle currently ships Oracle 9i Release 2 on Red Hat Linux Advanced Server as part of its Unbreakable campaign.
The final goal for both companies is to have both Red Hat's software and Oracle's software certified under the Common Criteria at EAL 4.
Oracle has tackled the process 15 times on a variety of operating systems.
The Common Criteria, an international standard administered by the National Institute of Standards and Technology in the United States, grades products based not only on their security and reliability, but also on the development and support processes that ensure quick responses to problems.
Other nations that have signed the Arrangement on the Mutual Recognition of Common Criteria Certificates in the Field of IT Security are Canada, France, Germany, the United Kingdom, Australia, New Zealand, Italy, Spain, the Netherlands, Norway, Finland, Greece and Israel.
The benefits of Common Criteria certification for Red Hat's Linux products should trickled down to the rest of the Linux community as well, said Dave Dargo, vice president of Oracle's Linux program office.
"The benefits of this evaluation extend beyond Red Hat in the long term," Dargo said, adding that the enterprise-level changes Red Hat and Oracle have made to the Linux kernel have made their way into Linux 2.5, the newest version of the kernel under development.
Moreover, the evaluation process, while expensive, should result in a more secure version of Linux being generally available, added Davidson.
"Fixing a major security hole costs a lot," she said. "And while certification won't prevent those holes, it helps to have a stricter development process. Finding one security hole that you otherwise would have missed, easily pays for evaluation."
Doesn't mean much (Score:2)
(Why does Common Criteria start to remind me of Dilbert strips about ISO 9000?)
already (Score:1)
Well... (Score:2, Interesting)
If Outlook, SQL Server, IIS or any other Microsoft product which has been riddled with holes have been certified, I'd say this isn't much of an endorsement. If Microsoft hasn't achieved any such ceritification, for products listed above, than you have a point about it opening doors.
For good and for bad (for Microsoft in particular) they are the benchmark for software as a commodity. Expect some writhing in the vicinity of Redmond.
Encouraging step. (Score:4, Interesting)
The article is very short on details, though. Starting small (EAL 2) is probably a good idea - especially since I know of no open source software / Free Software that's gone through a full, normal Common Criteria evaluation (so it would be a first test case). EAL 4 only measures the evaluation effort - it doesn't specify what security functions will be evaluated (nor what threats, assumptions, organizational security policies, configuration, etc. will be used). Hopefully Oracle and Red Hat will include security functions based on a widely-accepted "Protection Profile" (a document that specifies what the users want, including the threats to be countered and the security functions that need to be provided). Currently, the U.S. DoD strongly encourages only purchasing products that have been evaluated to meet not just an EAL level, but meet a "government-approved" PP.
Evaluations are specific to a particular configuration, so this would mean that those who need the evaluated version would need to get the Red Hat distribution named here - not the inexpensive version used by many. That's a side-effect worth noting.
$800 a year, so what. (Score:2)
Government...been there, done that (Score:5, Informative)
this is simple posturing at it's finest. of course...the government's high performance systems (read clusters) aren't running windows anyway. this won't change anything.
-frozen
Re:Government...been there, done that (Score:1)
Re:Government...been there, done that (Score:2)
Re:Government...been there, done that (Score:3, Informative)
Where is PostgreSQL? (Score:3, Interesting)
Many questions, no answers.
Re:Where is PostgreSQL? (Score:2)
Postgres has its uses. Hell, Berkley DB has its uses. I think that in terms of Gov't, support contracts, extreme usage, Oracle and RedHat have come a long way. I'm not surprised that Postgresql isn't being pushed.
Re:Where is PostgreSQL? (Score:2)
It would be like trying to market "EvilTwinSkippy Brand(tm)" cars instead of Daimler Benz.
Re:Where is PostgreSQL? (Score:1)
Otherwise, Why is this such great news?
Re:Where is PostgreSQL? (Score:2)
Have Oracle (again open source or no) means that you can tell a PHB that the software you already have will run under Linux, and if that wasn't enought, it is CERTIFIED.
Kernel Development Model also certified ? (Score:1)
Does that mean that the US Gov. will be officially saying that the Kernel development model is OK ?
Linux will not be CC anytime Soon (Score:1)
A page of memory when freed must be cleared. This includes Virtual memory saved to disk or even laying around in memory.
Linux current does not have this. Sorry folks.
Because I like you guys, here is Alan Cox's response to an email concerning this very issue:
-------------
> 1. When a process removes itself/crashes: is the memory blocks zeroed out
> and then free'd, or does the data still remain in memory just marked free?
It remains in memory, but it will be cleared before being given to another
process if it was private memory. Much of a process of course is shared
pages in read only format (eg the binary). These pages are simply shared
and reused. If a process wrote to a copy of such a page it got a private
copy which will not be given back to someone else.
> 2. When swapping to disk and you read the block into memory and clean it
> (Zero it out), does the block on disk get immediatly updated or is it just
> marked "free" and still has the data on disk?
Linux like most OS's does a lazy rewrite when swapping. When you
swap something back into memory it is left on disk as if we have to swap
it out again it saves writing it back to disk once more. Again when we
allocate new memory to a process we erase the data so a new task always
sees empty disk blocks and empty memory (subject to there being no bugs
as is always the case).
The disk case is more complex. There are situations that ext2/ext3 like the
BSD UFS may expose data after a crash/restart. The ext3 file system supports
a slightly slower performing mode that guarantees this won't happen.
Alan Cox
---------------
What does this mean? It means Linux needs a lot of work before it has CC.
LordMage - Working to better yourself.
Re:Linux will not be CC anytime Soon (Score:1)
Such a thing does exist. See http://www.entrust.com/entrustcygnacom/labs/pfSEL
Doesn't appear to be a problem (RIP on Linux) (Score:2)
First, a few clarifications about the CC itself. The CC lets users pick the requirements that they want, and vendors to state the requirements they happen to meet. The CC by itself doesn't require you to have this particular requirement. Instead, what's happening is that the CC defines a standard set of security requirements, and users are supposed to then identify the requirements they believe they need (using something called a "Protection Profile" (PP)). Then vendors can show whether or not they meet them. Now, it may be true that your customers are imposing this requirement for their needs, but that's different than claiming anything general about the CC.
More specifically, I suspect you're talking about the CC requirements in FDP_RIP (Residual Information Protection). But the CC is like a Chinese Menu; whether or not users want it is determined by users, and whether or not a vendor provides it (and someone is willing to pay to evaluate the function) is another. And in the CC, even if you select FDP_RIP as a requirement, there's a choice about WHEN you erase information (it may be set by the user, or stated by the vendor).
For example, the Controlled Access Protection Profile (CAPP) [ncsc.mil] corresponds more-or-less to the old "Orange Book" C2 level. There are other PPs that apply to operating systems, too. But the CAPP was used to evaluate other operating systems, so it's fair to use it as an example. The CAPP does select the CC function FDP_RIP.2, "Object Residual Information Protection" requirement, so users who are requiring CAPP will require it. But its text simply says that "The TSF shall ensure that any previous information content of a resource is made unavailable upon the allocation of the resource to all objects." There's a clarifying note in the CAPP that "Clearing the information content of resources on deallocation from objects is sufficient to satisfy this requirement, if unallocated resources will not accumulate new information until they are allocated again." It also includes a similar "Subject Residual Information Protection" requirement, stating that "The TSF shall ensure that any previous information content of a resource is made unavailable upon the allocation of the resource to all subjects." See CAPP sections 5.2.3 and 5.2.4.
(Oh, a few quick definitions first for those who don't know. Oversimplifying things, think of "subject" as Linux thread/process, and "object" as data such as filesystem objects, network packets, or memory. A "TOE" is the Target of Evaluation (think "this particular version of GNU/Linux configured a particular way"), and a "TSF" is the TOE security functions (it's the subset of the system responsible for security, including the Linux kernel, processes that run as root, and setuid root programs). Go look at the CC for more official definitions; I'm just trying to give the jist.)
In the CC, users can determine if they want to require clearing data when it's deallocated, or when it's allocated. It appears that the CAPP (and probably many other PPs) only require it by the time it's allocated (the clarifying text hopefully makes it clear that you can clear it earlier, as long as you don't seep data back into it later).
Thus, even if you mean CC requirements like FDP_RIP.2, it appears that GNU/Linux may meet it as long as the PP specifies that it's just when it's allocated - a common user choice. There's no requirement in the CAPP that the erasure happen when the object/subject is freed - merely that the erasure happen some time before it's reused.
Alan Cox's response actually sounds like evidence that GNU/Linux might meet this requirement! Pages are cleared before being handed to another process - that handles one issue. Disk blocks are retrieved as empty disk blocks. And, for crashing, there's a slower mode that would probably be required for use in a secured situation - but that's okay, you just specify that for this kind of use, you have to turn on that configuration option.
There is a known bug in older Linux kernels - many network drivers don't clear out their data, so you can get some information leakage via network packets. That's already been patched (I forget when). It's worth noting that many other operating systems over the years have had that problem too, it's a standard thing to look for in an evaluation.
Of course, intentions are great, but the real test is if it really happens. An evaluation would look over the evidence to determine if it's reasonable to believe that all residual information really is getting cleared. How much effort would be expended to do this examination depends on the EAL level.
YAY (Score:1)
Wwwwaitaminute. . . (Score:1)
- Oracle says, people are upset at Windows' instability, say they are coming out with Oracle on Linux.
- Linux businesses rub their hands together, tool up, and start selling
- Larry Ellison says in some sort of press conferance that you'd be nuts to run Oracle on Linux (or words to that effect)
- VA Linux, which apparently had been telling customers that it was a good idea, gets miffed
- (Customers panic?)
- VA Linux isn't selling systems any more
- Oracle says, customers are upset at Windows' insecurity, promote running on Linux
What did I miss?Re:dupe? (Score:4, Informative)
Re:dupe? (Score:1)
Re:dupe? (Score:1)
Re:dupe? No. This is different. (Score:5, Insightful)
This is a good thing as the US DoD uses ADA95 for most everything AFAIK and the GNAT compiler works just dandy with Linux. This is what DoD needs, an inexpensive, yet totally robust system which they can put unleash the military programmers on.
A good example is BRL-Cad [arl.mil] which is available for free download by US Citizens. This is a nice OpenGL capable solid modeler, somewhat clunky, but probably better than any other free CAD program available for Linux right now.
I'm a veteran of the US Military, and I think that Linux is a great choice for them, since they have the capability to provide cheap, effective, and efficient training about their computer systems to all the members of the armed forces. The US Military could easily train several million service personnel to be effective Linux programmers in a quite short period of time.
And of course, as a taxpaying citizen, I want my armed forces buying the best weaponry, not lining some 2-bit computer software vendor's pockets, especially when those vendors undermine the rights of the citizens by channeling that money back into lobbying for laws like the DMCA.
This is where RedHat shines. I use Debian myself, but Debian is too chaotic to apply for these certifications; however, RedHat could make a killing by supplying the US Government their software, and since Linux is Linux is Linux, this gives my government the state of the art software: it is secure, it is robust, it is inexpensive, and it is the best development environment in the world!
Re:dupe? (Score:1)
This article references the Common Criteria certification attempts of Oracle and perhaps IBM, specificly EAL2. Commmon Criteria is a NIAP certification that evaluates the level of access control, user control, and logging for security purposes. It is essiential if you want to use the software in an enviornment for Secret and above material in the US. It is also accepted throughout NATO, NZ, and Austrilia thanks to some reprocity agreements.
The part where this announcement will be huge is systems requiring NIAP evaluation (particularly systems priced under 15K). Up until now SCO and Windows have been living in a protected bubble, after these evaulations come through the CC market will be much more competitive on the low end. This is a large market, I am surprised that it was not done sooner. Up until now there has just been lame announcments at FOSE.
I'm sure you can get better information out there but I'll be damned if I am going to dig it out after I submitted this two days ago with better links and it got rejected.
Re:Which Version of RH? (Score:2)
Re:Which Version of RH? (Score:2)
No version you can get your hands on without spending lots of $$$ to get. redhat Advanced server is the ONLY version.. and it is also the only version that will have support available for anything but a token length of time. (remember Rh8.0 is EOL this year)
Re:Who posts the most dupes? (Score:2)
Re:Who posts the most dupes? (Score:5, Informative)
Yesterday's article was about RH 8 AS getting DISA (Defense Information Systems Agency) DII (Defense Information Infrastructure) COE (Common Operating Environment) certification. Todays' certification article-o-the-day is about RH 8 AS getting Common Criteria EAL (Evaluation Assurance Level) 2.
Yeah, to the uninformed, it looks the same. But (A) DII COE is specifically a US DoD certification, whereas CC EAL is an international certification (administered in the US by NIST--National Institute of Standards and Technology); and (B) The article about RH's EAL certification also extensively yatters on about Oracle 9i, whereas the RH COE article doesn't.
So in conclusion, this is an erroneous dupe sighting. Nothing to see here, move along.
Re:It's called hotmail (Score:1)