Date: Fri, 12 Mar 1999 16:21:47 +0100 From: The Unicorn <unicorn@blackhats.org> To: Robert Watson <robert+freebsd@cyrus.watson.org> Cc: Matthew Dillon <dillon@apollo.backplane.com>, andrewr <andrewr@slack.net>, Archie Cobbs <archie@whistle.com>, Andrew McNaughton <andrew@squiz.co.nz>, freebsd-security@FreeBSD.ORG Subject: Re: disapointing security architecture Message-ID: <19990312162147.C22324@unicorn.quux.org> In-Reply-To: <Pine.BSF.3.96.990312084725.6494Q-100000@fledge.watson.org>; from Robert Watson on Fri, Mar 12, 1999 at 08:51:05AM -0500 References: <199903120628.WAA73182@apollo.backplane.com> <Pine.BSF.3.96.990312084725.6494Q-100000@fledge.watson.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, Mar 12, 1999 at 08:51:05AM -0500, Robert Watson wrote: > On Thu, 11 Mar 1999, Matthew Dillon wrote: > > > It would be hillarious if we could get a C2 certification for a base > > GENERIC system. > > I think that would be great also, although possibly not GENERIC :-). > POSIX.1e was intended to match the requirements of the various colored > books. Once we have Auditing and ACLs, I suspect we are getting fairly > close to C2-capable. I've never actually read those specs though--anyone > know if they are still available, and if so have an ISBN? If not, I can > go dig up a reference librarian and have them find it for me, but Amazon > is usually easiest :-). You are referring to the Orange Book, published by the U.S. Department of Defense. Also known as Trusted Computer Systems Evaluation Criteria (TCSEC), CSC-STD-001-S3, 1983. Part of the rainbow series. As far as I know these are still available online. Check out: http://www.ntshop.net/security/rainbow.htm I know, not a place you want to visit often, but last time I looked they had the complete series on-line, which is rather cute :-) > C2 certification is presumably also an expensive process; if someone wants > to find a sponsor, we could almost certainly achieve C2 compliance with a > little restriction of the base system and appropriate POSIX.1e options. > Having a nice big "C2-Compliant!" stamp on the 4.0 CD would blow the > competition out of the water (so to speak) and certainly be excellent PR. Absolutely, but beware... Things got rather nasty when M$ announced that NT was C2 compliant (but only when networking was disabled :-). If I remember correctly this kind of certification is not only dependend on system software, but also on the hardware used during the certification. Therefor C2 certification on PC hardware may not really be what we are looking for... Then again I could be remembering incorrectly. BTW. Iff the security audit of FreeBSD really takes place I would like to be a part of it. Hopefully I can make some time available to actually work on this as well :-) > Robert N Watson ---end quoted text--- Ciao, Unicorn. -- ======= _ __,;;;/ TimeWaster ================================================ ,;( )_, )~\| A Truly Wise Man Never Plays PGP: 64 07 5D 4C 3F 81 22 73 ;; // `--; Leapfrog With A Unicorn... 52 9D 87 08 51 AA 35 F0 ==='= ;\ = | ==== Youth is Not a Time in Life, It is a State of Mind! ======= To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?19990312162147.C22324>