Subject: [nfsv4] MAC Resources

From: Dave Quigley <[email-masked]>
Date: Fri, 14 Mar 2008 18:22:54 -0400

Hello,
	Someone suggested at the WG meeting that I provide some resources on
Mandatory Access Control(MAC) and why it is important. I have selected
some resources that we have on MAC which are public as a place to start.
The first of the papers is titled "The Inevitability of Failure."[1]
This is the motivational paper for the work that has been going on for
the past decade. It explains MAC and why DAC is insufficient to provide
the security needed in modern OS environments. The second paper outlines
the Flask architecture. This provides the rational for using flexible
MAC instead of the traditional rigid MAC implementations used in past
trusted operating systems. The remaining links [3,4,5] are presentations
given at various conferences about SELinux. We are trying to put generic
flexible MAC support into NFS but it helps to have a sample
implementation to help understand better what is it we are trying to do.
If you have any questions you want answered please feel free to ask. I
have added James Morris and Stephen Smalley to the list so they can help
answer any questions you might have as well.

Dave

[1] The Inevitability of Failure: The Flawed Assumption of Security in
Modern Computing Environments
http://www.nsa.gov/selinux/papers/inevit-abs.cfm

[2] The Flask Security Architecture: System Support for Diverse Security
Policies
http://www.nsa.gov/selinux/papers/flask-abs.cfm

[3] 2001 Linux 2.5 Kernel Summit Presentation on SELinux
http://www.nsa.gov/selinux/papers/sel.summit-abs.cfm

[4] Integrating Flexible Support for Security Policies into the Linux
Operating System was published in the Proceedings of the FREENIX Track
of the 2001 USENIX Annual Technical Conference.
http://www.nsa.gov/selinux/papers/freenix01-abs.cfm

[5] Meeting Critical Security Objectives with Security-Enhanced Linux
was published in the Proceedings of the 2001 Ottawa Linux Symposium.
http://www.nsa.gov/selinux/papers/ottawa01-abs.cfm

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/nfsv4

---

From: Dave Quigley <[email-masked]>
Date: Fri, 14 Mar 2008 18:55:09 -0400

By to the list I meant the list of recipients of this email not to the
IETF mailing list :)

Dave