Back in 2004, the U.S. National
Security Agency (NSA) helped the Linux community to build something called
SELinux, which brings mandatory access control (MAC) policies to the
Linux kernel.
Now four years later, Sun is getting the same technology from
the NSA to use with its Solaris operating system. Sun’s OpenSolaris community will work on integrating the NSA’s Flux
Advanced Security Kernel (Flask) architecture, which is a form of mandatory
access control, for type enforcement. Flask is the basis of SELinux.
The Flask enhancements will be added to Sun’s Trusted
Extensions, which provide high-security labeling features to meet
regulatory and compliance requirements.
The difference between the Type
enforcement of Flask/SELinux and the Labeling of Trusted Extensions is an
important distinction to how security policies can be enforced and managed.
The NSA’s technology is critical to US Government customers that require
high degrees of security assurance policies and controls.
“The labeling in Trusted Extensions separates applications and it applies a
multi level protection profile and it separates them within the same
operating system,” Bill Vass, president and COO of Sun Microsystems Federal told InternetNews.com.
“In the Flask model you have multiple
applications running at different levels inside the same instance of the
operating system. In the Trusted Extensions model you have lots of
applications running inside each different instance of the operating system
running on the same server,” he said.
Vass explained that the advantages to the Flask model is very granular level
control over what the application does. The drawback of the Flask model is
that there is also a lot of work in managing that policy. On the other side,
the advantage to labeling is you don’t have any policy to mange, you just pop
the application inside the label and it does whatever it needs to do.
The NSA’s Flask controls have been made available to Sun under what Vass
described as a Public Domain license. Sun in turn will re-license the
technology inside of OpenSolaris under the open source CDDL license (Common
Development and Distribution License).
Vass noted that initially a user will only be able to run either the Flask
control or the labeling (traditional Trusted Extensions) control but not
both at the same time. The plan going forward is to work within the
OpenSolaris community with the continued assistance of the NSA to make a
dual type/labeling control possible.
The new Flask based controls for OpenSolaris will not get their own branded
name from Sun, like an SELinux, but instead will simply just become a
different feature available as part of Sun’s Trusted Extensions.
As to why Sun is just getting around to trying implementing the SELinux-type
technology from the NSA now, Vass was brutally honest.
“Had I been in charge 3 or 4 years ago we would have done it then, “Vass
admitted. “There were a lot of politics involved and wishy-washiness back
then.”
Vass noted that in the last few years Sun has made tremendous strides to
being more open and accepting of outside contributions and efforts. It’s
that openness that makes the addition of the NSA’s technology a bit more
doable now for Sun than it might have been four years ago.
“Now that we’re community driven in Solaris it’s a lot more advantageous
for us to do these kinds of things,” Vass said. “I wish we would have done
it back then and I can’t really explain to you why we didn’t, other than I
think we had a lack of maturity in our open source model around Solaris.”
