[rsbac] Announce: RSBAC v1.2.2 released

[Amon Ott]

Hello!

Rule Set Based Access Control (RSBAC) version 1.2.2 has been released.
Full information and downloads are available from http://www.rsbac.org

RSBAC is a flexible, powerful and fast open source access control framework
for current Linux kernels, which has been in stable production use since
January 2000 (version 1.0.9a). All development is independent of governments
and big companies, and no existing access control code has been reused.

The system includes a big range of decision modules, some of which implement 
professional access control models like ACL, MAC or Role Compatibility. It 
supports both 2.4 and 2.2 kernel series. Now that 2.6 seems to stabilize, the 
port to 2.6.0-test is in progress.

New features compared to version 1.2.1:

- Malware scanning:
       - Added ms_need_scan attribute for selective scanning
       - MS module support for F-Protd as scanning engine
       - ms_need_scan FD attribute for selective scanning
       - MS module support for clamd as scanning engine.
- Jails:
       - JAIL flag allow_inet_localhost to additionally allow to/from
         local/remote IP 127.0.0.1
- Resource Control:
       - New RES module with minimum and maximum resource settings for
         users and programs
- Authentication Enforcement:
       - Moved AUTH module to generic lists with ttl
       - Added caps and checks for effective and fs owner to AUTH module
         (optional)
- Linux Capabilities:
       - New Process Hiding feature in CAP module
- MAC / Bell-LaPadula:
       - Almost complete reimplementation of the MAC model with many new
         features.
- General:
       - RSBAC syscall version numbers
       - Added new requests CHANGE_DAC_(EFF|FS)_OWNER on PROCESS targets
         for seteuid and setfsuid (configurable)
       - Changed behaviour on setuid etc.: Notification is always sent, even
         if the uid was set to the same value. This allows for restricted RC
         initial roles with correct role after setuid to root.
       - Delayed init for initial ramdisks: delay RSBAC init until the first
         real or a specific device mount.
       - rsbac_init() syscall to trigger init by hand, if not yet
         initialized - can be used with e.g. rsbac_delayed_root=99:99, which
         will never trigger init automatically.
       - New system role 'auditor' for most models, which may read and flush
         RSBAC own log.

Amon Ott.
-- 
http://www.rsbac.org - GnuPG: 2048g/5DEAAA30 2002-10-22