Maybe so... and if it works for you then use it, but sometimes when
people say "but we needed this or we needed that", they haven't
allways sat down and thought "why do we need it" or "do we really 'need'
this ?"
Even having worked on government classified networks I have *never* seen
an instance where the standard access controls offered by Linux/Unix
didn't do what was required.
Often DAC/MAC setups leads to inferior security because they can get
very complex to setup, and the term "can't see the wood for the trees"
springs to mind.
As is most often the case the best security is the simplest, and DAC/MAC
bloat doesn't help in any way.
If some document or requirement or spec says you need it, I would often
question the theory behind the spec, and only if a demonstrable need
arises (have yet to see that in 20+ years of consulting) then I would do
it...
Of course I've also been in this game too long as well to "never say
never" and there is always a first time.... :-)
P.
Bryan J. Smith wrote:
>On Tue, 2005-05-24 at 08:24 +0100, Peter Farrow wrote:
>
>
>>Just turn off SELinux, it really is a complete pain.
>>I've managed to set up Linux and Unix boxes securely for years without
>>all the SE Linux baggage.....
>>All it does is slow the machine down, and adds "bloat" to the OS...
>>
>>
>
>Unfortunately, Mandatory Access Controls (MACs) are a necessary
>accountability detail needed in many environments.
>
>It's really the only place NT was better than legacy UNIX.
>
>Of course, I would return argue that Linux at least addresses all
>aspects of the 7 domains of the SSCP _except_ the MAC portion of
>DAC/MAC, whereas Microsoft only addresses 3 of them in the OS as
>standard.
>
>But we needed MAC. It's a good thing to have in many environments --
>especially where accountability is essential.
>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.centos.org/pipermail/centos/attachments/20050524/3162024b/attachment.htm
