Open Source Market Segment LS
Open Source Market Segment RS
Wednesday, 24 July 2013 12:35

Does the NSA's SE Linux code need a review? Featured

By

In the wake of the recent revelations that America's National Security Agency is spying on all and sundry, is it time for the Linux community to take another good, hard look at the NSA-developed Security Enhanced Linux?

The NSA's Security Enhanced Linux comprises a kernel patch to add security features, and patches to applications to allow them to determine the security domain in which to run processes.

The code was initially developed by the NSA and is under the GPLv2, the same licence as the kernel. Numerous individuals and companies have made contributions to the project.

Recently, Cyanogenmod, one of the more popular forks of the Android mobile operating systems, announced it would be incorporating SE Linux as part of its security features.

Asked whether a code audit was needed now, Russell Coker, a Melbourne-based developer for the Debian GNU/Linux project, who is listed as a contributor to SE Linux, told iTWire: "The SE Linux source is free for anyone to review. It's probably better reviewed than most kernel code because someone who finds a bug would get more fame for doing so than for finding bugs in most kernel code."

Russell, who has ported and packaged SE Linux for Debian, added: "It doesn't seem plausible that there would be anything inappropriate in patches publicly submitted by the NSA.

"Given that anyone anywhere in the world can submit a patch I don't think that we need to worry about patches coming from .gov email addresses."

Brian May, another Debian developer who is based in Melbourne, is credited with backporting Russell's work to Woody, a Debian release made in July 2002.

May, an open-source consultant, told iTWire he was no longer the maintainer for SE Linux for the stable stream of Debian.

"Unfortunately that is not the case," he said when the question of him being the maintainer arose. "I looked into SE Linux some years ago, but ran out of time to really get into it. I am a Debian developer, however."

However, May was confident about the integrity of the code.

"SE Linux is entirely open source software, that has been reviewed by many people," he said. "It has been merged into the mainline Linux kernel since version 2.6.0-test3, released on 8 August 2003.

"Linux has a reputation of being very conservative for allowing new features, this means everything would have been reviewed even more times by more people while pushing to have it accepted in the kernel release. If there were any concerns it would have been rejected.

"I am sure there would be a number of people very keen on finding backdoors in SE Linux for the sole purpose of discrediting NSA. Yet so far, I haven't seen any reports of anyone finding anything. I can only conclude that this is because there are no hidden backdoors."

He added: "PRISM, if the allegations are true, was designed around complete secrecy. SE Linux on the other hand has been a very open and transparent project for many years."

Read 27345 times

Please join our community here and become a VIP.

Subscribe to ITWIRE UPDATE Newsletter here
JOIN our iTWireTV our YouTube Community here
BACK TO LATEST NEWS here




ELASTICON SYDNEY 2024 LATEST ADVANCEMENTS IN GENERATIVE AI

On 20 February, keynote addresses from NAB, Canva, AWS, and Google Cloud, among others, will feature at ElasticON Sydney 2024.

This event will explore the latest advancements in generative AI

The one-day conference, hosted by leading search analytics company Elastic, will include networking drinks, hands-on labs, technical sessions and a stellar line-up of keynote speakers from finance, technology, and government e=sectors.

ElasticON Sydney 2024 promises to be an enriching experience with a comprehensive exploration of the latest developments in security, observability, generative AI and their real world applications

Don't miss out on this opportunity to network and find answers for what's next from your industry peers and leaders


Register for ElasticON Sydney 2024

REGISTER HERE!

PROMOTE YOUR WEBINAR ON ITWIRE

It's all about Webinars.

Marketing budgets are now focused on Webinars combined with Lead Generation.

If you wish to promote a Webinar we recommend at least a 3 to 4 week campaign prior to your event.

The iTWire campaign will include extensive adverts on our News Site itwire.com and prominent Newsletter promotion https://itwire.com/itwire-update.html and Promotional News & Editorial. Plus a video interview of the key speaker on iTWire TV https://www.youtube.com/c/iTWireTV/videos which will be used in Promotional Posts on the iTWire Home Page.

Now we are coming out of Lockdown iTWire will be focussed to assisting with your webinars and campaigns and assistance via part payments and extended terms, a Webinar Business Booster Pack and other supportive programs. We can also create your adverts and written content plus coordinate your video interview.

We look forward to discussing your campaign goals with you. Please click the button below.

MORE INFO HERE!

BACK TO HOME PAGE
Sam Varghese

Sam Varghese has been writing for iTWire since 2006, a year after the site came into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.

Share News tips for the iTWire Journalists? Your tip will be anonymous

Subscribe to Newsletter

*  Enter the security code shown:

WEBINARS & EVENTS

CYBERSECURITY

PEOPLE MOVES

GUEST ARTICLES

Guest Opinion

ITWIRETV & INTERVIEWS

RESEARCH & CASE STUDIES

Channel News

Comments