Substantiate claims, please

Substantiate claims, please

Posted Aug 7, 2008 2:18 UTC (Thu) by jamesmrh2 (guest, #31680)
Parent article: OLS: Smack for embedded devices

A major difference between the Smack paper and the Embedded SELinux paper is that the latter involved actually implementing MAC security in a real embedded system and measuring the overheads. For example, they were able to reduce the total memory footprint of SELinux by an order of magnitude. From the conclusion:

"Tuned SELinux was evaluated on a SH-based CE device evaluation board. The benchmark result shows that the SELinux overhead for read/write is almost negligible. File size is about 200 Kbyte, and memory usage is about 500Kbyte, about 1% of the flash ROM and RAM of the valuation board. We conclude that SELinux can be applied to CE devices easier as the result of our work."

Also noteworthy is that they developed their policy using SEEdit, a GUI tool which uses a simplified security policy language with a familiar path-based format.

The Smack paper provides does not really subsantiate its claims, and one number cited is a worst-case out of date figure for a general purpose desktop policy -- not something you'd use on an embedded system, or even a desktop system today.

Note that I'm not saying that there's anything wrong with Smack, merely that many of the issues raised in Casey's somewhat hypothetical paper have been concretely addressed in the Nakamura paper.

An apples to apples comparison of actual implementations would be interesting.

- James Morris

p.s. Thanks to LWN for covering these security topics. Much of the security going into Linux now is "new" compared to what people may have previously experienced with traditional Unix, Windows etc., so there's less of an existing knowledge base for people to work from. The more these topics are covered and discussed, the better people will be able to make informed decisions about utilizing Linux's security features.

---

(Log in to post comments)