Re: [Security-Discuss] tcb support under Mandriva

Le vendredi 25 ao=FBt 2006 20:36, Vincent Danen a =E9crit=A0:
> * FACORAT Fabrice <[email protected]> [2006-08-25 19:17:48 +0200]:
> > > > http://www.builderau.com.au/program/linux/soa/Migrating_from_shadow=
_p
> > > >assw ords_to_tcb_in_Linux/0,39028297,39269540,00.htm
> > > >
> > > > I've read your article about tcb support under Linux and I'm willing
> > > > to know if the needed patch have been integrated in the required
> > > > tools in Mandriva ?
> > >
> > > Nope.
> > >
> > > It shouldn't be too hard to integrate it tho.  I don't know if Mandri=
va
> > > has any interest in it, and it's a little late in the game to get it =
in
> > > there for 2007 I think.  It would require patching glibc (to get
> > > blowfish support, which we should do anyways) and a few userland tools
> > > (mostly shadow-utils I think).  And the proper rpms (which can be tak=
en
> > > from Annvix and modified for use with Mandriva... should take all of 5
> > > minutes).
> > >
> > > There would be some distinct advantages (tcb over shadow rocks), but
> > > normally my ideas are shot down so I haven't even bothered proposing
> > > it.
> >
> > IMHO you should, maybe for Corporate.
>
> Well, I'd like to think that I won't get ignored or discouraged, but
> since that tends to happen fairly often, I won't bother.  I don't do the
> R&D, just support.  With Annvix, on the other hand, I can do anything I
> bloody well feel like, which is why tcb support is in there.  If nothing
> else, it demonstrates it could easily be done with Mandriva to boot.
>
> Chances are, if you bring it up, there's a higher probability someone
> will look at it more seriously than if I do (unfortunately, this is most
> probably true).

Ok, I will blog about this in my blog and also put it on cooker ML

> > Do you info about the evolution of RSBAC support ? they managed to do a
> > tool ? they will no longer do it ?
>
> From what I understand, RSBAC is in the kernel, but is not enabled by
> default.  You need to explicitly enable it with a kernel commandline (so
> an option in grub or lilo).  Which means it won't be default (and also
> means 99.5% of the users won't use it, much less even know it's there).
>
> A tool?  Not that I'm aware of.  I've not seen or heard anything
> concrete about a tool actually being made available (and if you'll
> recall my blog entry, you'd need a helluvalot more than a single tool to
> make RSBAC something "convenient" to configure for joe-user).
>
> So, essentially, it's pretty much what I predicted.  RSBAC will be in
> there, but no one will use it because we haven't made it easy to use.  I
> won't start with how easy it would have been to switch to and use
> AppArmor instead.. my blog entry
> (http://linsec.ca/blog/index.php?/archives/81-RSBAC-and-AppArmor.html#ext=
en
>ded for those interested) describes all the challenges, etc.

So your predictions were true :)

> FWIW, Mandriva's focus is not on proactive security.  It never has been.
> It probably never will be (with the exception of MNF which was fairly
> well done from a security standpoint, although there is definitely room
> for improvement there too).  The Corporate product line errs on the side
> of "what customers want" which ends up being lots of bloat, frivolous
> packages, and less security features than (I would like).  That's not to
> say the Corporate products aren't good... they're great, if security
> isn't your primary concern.  If lots of apps, hand-holding, and
> ease-of-use are your thing, they're great.  Since (again, speaking about
> me personally) don't need lots of apps, don't like bloat, don't need my
> hand held (I'd rather whip out vim and edit some text config files), and
> have a primary focus on security, then I think you have two options:
> spend a fair amount of work cleaning and tightening Corp or find
> something else (Bastille might help in the former instance).

Unfortunately and we miss greatly management tools too.
My dream :=20
- a wizard that allow to install OpenlDAP+NFSv4+kerberos
- a management tool to manage users, replication, rights ( web interface ) =
+=20
monitoring + share


--=20
Les mots qui ont un son noble contiennent toujours de belles images.
Marcel Pagnol.
____________________________________________________
Want to buy your Pack or Services from Mandriva?=20
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________