Not just SELinux, also LIDS (and it uses full capability system)

Not just SELinux, also LIDS (and it uses full capability system)

Posted Nov 26, 2003 14:40 UTC (Wed) by linuxbox (subscriber, #6928)
Parent article: BSD security levels for Linux

Just FYI, in addition to SELinux, and a much finer-grained system-hardening regime than BSD securelevels (not to disparage them), is Huagang Xie's LIDS system (http://www.lids.org).

LIDS has fine-grained ACLs based on the the full range of Linux capabilities, process and file hiding, etc, etc, using an ACL language vaguely inspired by that of iptables. (The 2.6 LIDS adds an "auto learn" mode that builds ACLs automatically, but I haven't tried it.)

LIDS was already in pretty wide use as a source patch for Linux 2.2 and 2.4 kernels, but the 2.6 series LIDS is layered on the Linux Security Module.

LIDS works, works with essentially any Linux (I recently ported the patch to the 2.4.21 kernel source tree used by SuSE 9.0), has proved its worth for me on several occasions.

Matt Benjamin <matt@linuxbox.com>

(Not that it's perfect--a few patch versions over the last two years had memory leaks or other issues. The LSM implementation should reduce the maintenance overhead of the kernel patch, substantially.)

---

(Log in to post comments)