Linked by Thom Holwerda on Wed 5th Mar 2008 09:43 UTC, submitted by diegocg
Sun Solaris, OpenSolaris "OpenSolaris has launched a new project, Flexible Mandatory Access Control, to integrate the Flask/TE security scheme into their OS. This is the same underlying model implemented by SELinux, and follows other cross-platform Flask/TE integration projects such as SEDarwin and SEBSD. This is very exciting in terms of establishing compatible security across operating systems, particularly for Mandatory Access Control, which has traditionally been narrowly focused and generally incompatible. With FMAC, we're closer to seeing truly ubiquitous, cross-platform MAC security."
Thread beginning with comment 303489
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[2]: Trusted Solaris?
by Bitterman on Wed 5th Mar 2008 13:22 UTC in reply to "RE: Trusted Solaris?"
Bitterman
Member since:
2005-07-06

like what? any technical faults?
The only bad things about SElinux I hear are due to difficulty in rule building which although isn't meant for a joe desktop user the new building tools should be easy enough for a system admin to learn.
Mainly im trying to see what advantages this has over the current system.

Reply Parent Score: 1

RE[3]: Trusted Solaris?
by sbergman27 on Wed 5th Mar 2008 13:47 in reply to "RE[2]: Trusted Solaris?"
sbergman27 Member since:
2005-07-24

Well, the 12% (on x86 for reads) to 147% (on SH series processors for writes, and no that's not a typo) cpu overhead of SELinux is rather significant. (And that impacts heat dissipation and battery life as well, of course.) Not sure how this new OpenSolaris implementation will compare. I think the overhead is supposed to be somewhat lower in Linux kernel 2.6.24. We'll see, I guess.

My understanding is that one pays a performance overhead even with selinux "disabled", unless he manually adds "selinux=0" to the kernel boot params AND the option for SELinux to honor that boot param has been compiled in.

Edited 2008-03-05 13:58 UTC

Reply Parent Score: 6

RE[4]: Trusted Solaris?
by Bitterman on Wed 5th Mar 2008 14:35 in reply to "RE[3]: Trusted Solaris?"
Bitterman Member since:
2005-07-06

woh thanks i had never heard that but i'll take your word for it. that is a pretty bad performance hit. Personally i'll still deal with it cause i want some security infrastructure to get adopted. Open source has way, way too many programs on a machine. I mean look at debians repo's you got 20,000 different applications. That is ALOT of security bugs waiting to be found or already found and being exploited. There needs to be a wrapper in the middle to protect the machine from poor code. Weather it be Selinux or another type of MAC system, or stack protection I dont know or care, but there needs to be something between poor code and free reign of a machine. for now SElinux appears to be the one with the most active development and adoption.

Reply Parent Score: 1

RE[4]: Trusted Solaris?
by PlatformAgnostic on Wed 5th Mar 2008 17:09 in reply to "RE[3]: Trusted Solaris?"
PlatformAgnostic Member since:
2006-01-02

Any idea why the cost is so high?

On Windows, we do the expensive security check when you open a handle (aka fd) and you are granted tbe desired rights until you close the handle. There is a cost when using handles of checking that the handle has been given the right needed for each operation, but it's a single AND and a comparison that happens in the handle table lookup codepath.

What does SELinux do that is more expensive?

Reply Parent Score: 3

RE[4]: Trusted Solaris?
by danieldk on Wed 5th Mar 2008 19:11 in reply to "RE[3]: Trusted Solaris?"
danieldk Member since:
2005-11-18

Well, the 12% (on x86 for reads) to 147% (on SH series processors for writes, and no that's not a typo) cpu overhead of SELinux is rather significant.


That's a too unbalanced statement. 12% overhead on what? As far as I know, the overhead is on certain system calls. Most CPU-intensive applications will relatively only spend very little time in system calls. So, overall, the impact is not that much, while it does give much more security. Seems like a fair trade-off to me.

Reply Parent Score: 2