Home Business IT Open Source Does the NSA's SE Linux code need a review?
Does the NSA's SE Linux code need a review? Featured

In the wake of the recent revelations that America's National Security Agency is spying on all and sundry, is it time for the Linux community to take another good, hard look at the NSA-developed Security Enhanced Linux?

The NSA's Security Enhanced Linux comprises a kernel patch to add security features, and patches to applications to allow them to determine the security domain in which to run processes.

The code was initially developed by the NSA and is under the GPLv2, the same licence as the kernel. Numerous individuals and companies have made contributions to the project.

Recently, Cyanogenmod, one of the more popular forks of the Android mobile operating systems, announced it would be incorporating SE Linux as part of its security features.

Asked whether a code audit was needed now, Russell Coker, a Melbourne-based developer for the Debian GNU/Linux project, who is listed as a contributor to SE Linux, told iTWire: "The SE Linux source is free for anyone to review. It's probably better reviewed than most kernel code because someone who finds a bug would get more fame for doing so than for finding bugs in most kernel code."

Russell, who has ported and packaged SE Linux for Debian, added: "It doesn't seem plausible that there would be anything inappropriate in patches publicly submitted by the NSA.

"Given that anyone anywhere in the world can submit a patch I don't think that we need to worry about patches coming from .gov email addresses."

Brian May, another Debian developer who is based in Melbourne, is credited with backporting Russell's work to Woody, a Debian release made in July 2002.

May, an open-source consultant, told iTWire he was no longer the maintainer for SE Linux for the stable stream of Debian.

"Unfortunately that is not the case," he said when the question of him being the maintainer arose. "I looked into SE Linux some years ago, but ran out of time to really get into it. I am a Debian developer, however."

However, May was confident about the integrity of the code.

"SE Linux is entirely open source software, that has been reviewed by many people," he said. "It has been merged into the mainline Linux kernel since version 2.6.0-test3, released on 8 August 2003.

"Linux has a reputation of being very conservative for allowing new features, this means everything would have been reviewed even more times by more people while pushing to have it accepted in the kernel release. If there were any concerns it would have been rejected.

"I am sure there would be a number of people very keen on finding backdoors in SE Linux for the sole purpose of discrediting NSA. Yet so far, I haven't seen any reports of anyone finding anything. I can only conclude that this is because there are no hidden backdoors."

He added: "PRISM, if the allegations are true, was designed around complete secrecy. SE Linux on the other hand has been a very open and transparent project for many years."

FREE CLOUD BACKUPS MANAGEMENT WEBINAR

Are your technicians spending too much time just managing your clients cloud backups?

Backups are an important part of any IT business but they should not consume more than their fair share of time and money.

Discover how to reduce the amount of time & money spent managing your Cloud Backups during this Free Webinar.

REGISTER FOR FREE WEBINAR!

FREE NETWORKING SERVICES CASE STUDY

As one of the world’s largest social networking services, Facebook handles a lot of user information, and requires input from an astounding range of stakeholders 24 hours a day, 7 days a week — from both inside and outside the business.

Discover how Facebook was helped to connect remote employees, vendors, consultants, and partners to applications and web services quickly and reliably - without risking sensitive data.

GET CASE STUDY!

GET THE IT BUDGET YOU WANT

Explore your Network Treasure Trove to get the IT Budget you want

With Australian businesses projected to spend over $78.7 Billion why does it feel like you can never get the budget you need?.

In most cases your budget will get approved because the proposals are not only technically correct, but also provide good, credible evidence on how the spend aligns with key business objectives.

Did you know that your Network Monitoring tool can help you build a comprehensive business case without an MBA?

HERE ARE 8 TIPS TO GET THE IT BUDGET YOU WANT.

CLICK HERE!

Sam Varghese

website statistics

A professional journalist with decades of experience, Sam for nine years used DOS and then Windows, which led him to start experimenting with GNU/Linux in 1998. Since then he has written widely about the use of both free and open source software, and the people behind the code. His personal blog is titled Irregular Expression.

Connect

 

 

 

 

Join the iTWire Community and be part of the latest news, invites to exclusive events, whitepapers and educational materials and oppertunities.
Why do I want to receive this daily update?
  • The latest features from iTWire
  • Free whitepaper downloads
  • Industry opportunities