RHEL certified at EAL4+

RHEL certified at EAL4+

Posted Jun 18, 2007 23:28 UTC (Mon) by jd (guest, #26381)
Parent article: RHEL certified at EAL4+

EAL4+ is fine, but as others have noted, it's only an assurance that a set of criteria has been met. It is not actually a security audit, per se, unless the specific implementation of the Common Criteria actually includes a security audit. I believe the highest rating for a general-purpose OS is EAL5, and Windows 2003 ranks EAL4, so 4+ seems to be a little on the old side anyway. Who wants to be known as only a little better than Windows on security?

Now, certain Government uses require certain EAL levels, so this will have an impact on who uses Linux. Maybe not a huge impact, but an impact nonetheless. That, in and of itself, is a major bonus, even if the label has little real value.

There are a few things that surprise me, assuming I read the PR correctly. Please correct me if I'm wrong, but there appears to be no security labeling of memory regions or of network connections. These are fairly significant security additions and have been considered an important part of mandatory access controls for a long time.

The next thing that surprises me is that I saw nothing obvious about a kernel or glibc security audit. A thorough audit of these two would be well within the capacity of IBM and would eliminate weaknesses at the critical points within the system. Any weakness in those two components will be shared with virtually all applications, so closing them would seem critical for true assurance.

I hope the EAL4+ tests make their way into the Linux Test Project, the way the other EAL tests have, and I also hope that some of the hardened Linux distros use these tests to show what level of security they are equivalent to, whether they are certified or not. It would be healthy competition if a solid hardened distro could show itself to be comparable or superior to the certified version of RHEL5 in terms of standards and security. Not because I have anything against Red Hat, but because it will boost efforts in the security arena.

---

(Log in to post comments)