Trusted Solaris over SELinux

[Justin Conover]

http://blogs.sun.com/roller/page/darren?entry=dear_ibm_please_consider_tr...

I thought this was interesting.  Yeah, I use Solaris to so I read some Sun
blogs too.  :)

[Andy Green]

Justin Conover wrote:

> http://blogs.sun.com/roller/page/darren?entry=dear_ibm_please_consider_tr...
>  
>  I thought this was interesting.  Yeah, I use Solaris to so I read some 
>  Sun blogs too.  :) 
Get thee to somewhere far away from the NHS...

http://globalspecials.sun.com/servlet/ControllerServlet?Action=DisplayPag...

...with yer $995 - $27K trusted Solaris junk.  Give me Linux+selinux at 
$0 per unit when I am flat on my back... or happy and healthy and paying 
my taxes.

-Andy

[Justin Conover]

On 5/20/06, Andy Green <andy(a)warmcat.com&gt; wrote:
>  Justin Conover wrote:
>
>  >
>  http://blogs.sun.com/roller/page/darren?entry=dear_ibm_please_consider_tr...
>  >
>  > I thought this was interesting.  Yeah, I use Solaris to so I read some
>  > Sun blogs too.  :)
>
>  Get thee to somewhere far away from the NHS...
>
>
>
> http://globalspecials.sun.com/servlet/ControllerServlet?Action=DisplayPag...
>
>  ...with yer $995 - $27K trusted Solaris junk.  Give me Linux+selinux at
>  $0 per unit when I am flat on my back... or happy and healthy and paying
>  my taxes.
>
>  -Andy 

Actually Solaris 10 is intergrating the bits of Trusted Solaris which will
make it FREE.  I'm not saying one is better than the other, simply wondering
what the SELinux developers thought.

To say that Trusted Solaris is junk seems a bit silly, if your only talking
of price, ok, but if your talking the OS, than your just mis-informed.

[Andy Green]

Justin Conover wrote:

>     
> http://globalspecials.sun.com/servlet/ControllerServlet?Action=DisplayPag...
>  
>      ...with yer $995 - $27K trusted Solaris junk.  Give me Linux+selinux at
>      $0 per unit when I am flat on my back... or happy and healthy and paying 
>  Actually Solaris 10 is intergrating the bits of Trusted Solaris which
>
>  will make it FREE.  I'm not saying one is better than the other, simply 
>  wondering what the SELinux developers thought.
>  
>  To say that Trusted Solaris is junk seems a bit silly, if your only 
>  talking of price, ok, but if your talking the OS, than your just 
>  mis-informed. 
I'm talking of the price.  I'm sure IBM take their cut for managing it, 
but at $995+ /cpu, $0 linux+selinux has to win out here even if Trusted 
Solaris poops golden eggs.  The benchmark is Windows level of security.

-Andy

[Stephen Smalley]

On Sat, 2006-05-20 at 09:46 -0500, Justin Conover wrote:

>  Actually Solaris 10 is intergrating the bits of Trusted Solaris
> which
>  will make it FREE.  I'm not saying one is better than the other,
>  simply wondering what the SELinux developers thought.  
Not exactly.  IIUC, trusted extensions for Solaris 10 are quite
different from past Trusted Solaris implementations and principally rely
on their zone mechanism rather than providing per-process and per-file
labeling and access control.

-- 
Stephen Smalley
National Security Agency

[Martin Ebourne]

On Sat, 2006-05-20 at 08:22 -0500, Justin Conover wrote:
> http://blogs.sun.com/roller/page/darren?entry=dear_ibm_please_consider_tr...
>  
>  I thought this was interesting.  Yeah, I use Solaris to so I read some
>  Sun blogs too.  :) 
High on opinion, low on fact.

Just how was that interesting? As a measure of desperation?

Martin.

[Stephen John Smoogen]

On 5/20/06, Martin Ebourne <lists(a)ebourne.me.uk&gt; wrote:
>  On Sat, 2006-05-20 at 08:22 -0500, Justin Conover wrote:
>  > http://blogs.sun.com/roller/page/darren?entry=dear_ibm_please_consider_tr...
>  >
>  > I thought this was interesting.  Yeah, I use Solaris to so I read some
>  > Sun blogs too.  :)
>
>  High on opinion, low on fact.
>
>  Just how was that interesting? As a measure of desperation?
>  
It is low on fact, but in some ways is influential as Darren is a well
known security person. On a cost area it does have an item that many
business managers may have to look at:

Solaris is EAL4+ with various subsets already and is a known quantity.
SeLinux implementations are not by themselves EAL4+.. a companies
version might be in the future but not now.

And if you are doing end of fiscal year purchasing..



-- 
Stephen J Smoogen.
CSIRT/Linux System Administrator

[Stephen Smalley]

On Sat, 2006-05-20 at 10:53 -0600, Stephen John Smoogen wrote:
>  On 5/20/06, Martin Ebourne <lists(a)ebourne.me.uk&gt; wrote:
>  > On Sat, 2006-05-20 at 08:22 -0500, Justin Conover wrote:
>  > > http://blogs.sun.com/roller/page/darren?entry=dear_ibm_please_consider_tr...
>  > >
>  > > I thought this was interesting.  Yeah, I use Solaris to so I read some
>  > > Sun blogs too.  :)
>  >
>  > High on opinion, low on fact.
>  >
>  > Just how was that interesting? As a measure of desperation?
>  >
>  
>  It is low on fact, but in some ways is influential as Darren is a well
>  known security person. On a cost area it does have an item that many
>  business managers may have to look at:
>  
>  Solaris is EAL4+ with various subsets already and is a known quantity.
>  SeLinux implementations are not by themselves EAL4+.. a companies
>  version might be in the future but not now. 
Validated products:
http://niap.nist.gov/cc-scheme/vpl/vpl_type.html#operatingsystem
http://www.commoncriteriaportal.org/public/consumer/index.php?menu=4&...

Products in evaluation:
http://niap.nist.gov/cc-scheme/in_evaluation.html

-- 
Stephen Smalley
National Security Agency