<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1">
<title></title>
</head>
<body text="#000000" bgcolor="#ffffff">
Maybe so... and if it works for you then use it, but sometimes when
people say "but we needed this or we needed that", they haven't
allways sat down and thought "why do we need it" or "do we really
'need' this ?"<br>
<br>
Even having worked on government classified networks I have *never*
seen an instance where the standard access controls offered by
Linux/Unix didn't do what was required.<br>
<br>
Often DAC/MAC setups leads to inferior security because they can get
very complex to setup, and the term "can't see the wood for the trees"
springs to mind.<br>
<br>
As is most often the case the best security is the simplest, and
DAC/MAC bloat doesn't help in any way.<br>
<br>
If some document or requirement or spec says you need it, I would often
question the theory behind the spec, and only if a demonstrable need
arises (have yet to see that in 20+ years of consulting) then I would
do it...<br>
<br>
Of course I've also been in this game too long as well to "never say
never" and there is always a first time.... :-)<br>
<br>
P.<br>
<br>
<br>
<br>
<br>
Bryan J. Smith wrote:<br>
<blockquote type="cite"
cite="mid1116920073.4417.135.camel@bert64.mobile.smithconcepts.com">
<pre wrap="">On Tue, 2005-05-24 at 08:24 +0100, Peter Farrow wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Just turn off SELinux, it really is a complete pain.
I've managed to set up Linux and Unix boxes securely for years without
all the SE Linux baggage.....
All it does is slow the machine down, and adds "bloat" to the OS...
</pre>
</blockquote>
<pre wrap=""><!---->
Unfortunately, Mandatory Access Controls (MACs) are a necessary
accountability detail needed in many environments.
It's really the only place NT was better than legacy UNIX.
Of course, I would return argue that Linux at least addresses all
aspects of the 7 domains of the SSCP _except_ the MAC portion of
DAC/MAC, whereas Microsoft only addresses 3 of them in the OS as
standard.
But we needed MAC. It's a good thing to have in many environments --
especially where accountability is essential.
</pre>
</blockquote>
</body>
</html>