<html><body>
<p>In no particular order, here are some Linux security gaps/wishlist:<br>
<br>
Highly accurate open source static analysis tools (and all open source projects making use of them)<br>
Capability to run w/o root in a traditional DAC environment<br>
ala Solaris Process Rights Management<br>
Linux project: Olaf Dietsche's File system capabilities patch not integrated<br>
Integrated cryptographic framework - single point of FIPS certification<br>
Secure virtualized containment (not SELinux) ala Solaris Zones/containers or HPUX Secure Resource Partitions<br>
this often gets punted to Xen, but there is an advantage for having both types of virtualized containment available<br>
Linux project: vserver not integrated<br>
Easy to use RBAC tools (not talking about RBACPP)<br>
Encrypted file system with per file encryption<br>
Linux project: eCryptfs + others not integrated<br>
Whole disk encryption<br>
Patch risk assessment<br>
MLOSPP compliance may become an issue in the near future<br>
Kernel crypto api improvements - asynchronous work underway, asymmetric algorithms, GCM mode<br>
<br>
I'd like to see IPSec be easier to set up and a centralized repository that collects whether Linux IPSec and interoperate with various vendor VPNs and the settings required for the VPNs that it can interoperate with (ala monitor settings database or CDDB).<br>
A tiny feature that I would like to see added to logcheck (may be there in the latest release) is the ability to switch after a certain threshold from telling me about attempts (for example, ssh login attempts) from a certain address to successes from that address. The attempts become uninteresting and the successes are very, very interesting.<br>
<br>
I haven't found anyone who cares but NIS+ is not available on Linux.<br>
<br>
Other requests that we have received - default umask 037, no world writeable directories (/tmp) on filesystems/partitions with setuid/setgid binaries and log files.<br>
<br>
A key Linux weakness that affects other areas as well as security is a lack of integration between components.<br>
<br>
Ed, want to comment on I & A gaps?<br>
<br>
Emily<br>
<br>
Emily Ratliff<br>
IBM Linux Technology Center, Security<br>
CISSP #51839<br>
512-838-0409 (T/L 678-0409)<br>
emilyr@us.ibm.com</body></html>