RE: Bell & Lapadula Model

["Lorenzo Hernández García-Hierro" <lorenzo@gnu.org>]

[-- Attachment #1: Type: text/plain, Size: 1827 bytes --]

El sáb, 19-02-2005 a las 17:29 +0000, Juan Espino escribió:
> Wao, Thanks for your explanations.  SELinux supports more applications than 
> RSBAC ¿?

Both frameworks / security suite in SELinux case support an huge amount
of applications because this is independent of the framework/engine
itself, instead, both use policies that can be handled in a fine-grained
manner (most in SELinux case AFAIK).

Sample/default policies such as NSA SELinux policy available for
download from nsa.gov, make the installation easier, but the
administrator is the person in charge of maintaining a concrete policy
for his proper circumstances and case.
They provide the minimal config. to make applications to work as *they
are expected to do*, allowing only the default operations to make the
app. just working, but this differs in personal and concrete
circumstances as I commented above (ie. Fedora C3 & other RH's goodies
policies), so, fine-tuning is needed if the administrator wants to take
advantage of all the power that SELinux can provide.

It's a decision up to you whatever solution to use, just that I don't
want to enter in flames due to personal remarking, but I've used SELinux
more than RSBAC and I think that with a good policy and knowledge
(minimal I mean) on it, you can make even more profit than using RSBAC,
among that SELinux is used under critical environments and developed by
people who can't buy unexpected issues.

Anyways, both are great solutions, so, the decision is up to you.
RSBAC has an huge amount of documentation and well-explained models, and
the people maintaining it are also good guys that do good work.

I hope my comments could help you.
Cheers,
-- 
Lorenzo Hernández García-Hierro <lorenzo@gnu.org> 
[1024D/6F2B2DEC] & [2048g/9AE91A22][http://tuxedo-es.org]

[-- Attachment #2: Esta parte del mensaje está firmada digitalmente --]
[-- Type: application/pgp-signature, Size: 189 bytes --]