Security focused operating system

From Wikipedia, the free encyclopedia

This is an alphabetical list of operating systems with a sharp security focus. Their order does not imply rank. In addition, some operating systems meet certain evaluation criteria: they can be described as security-evaluated operating systems.

In our context, "Security-focused" means that the project is devoted to increasing the security as a major goal. As such, something can be secure without being "security-focused." For example, almost all of the operating systems mentioned here are faced with security bug fixes in their life time; however, they do all strive to consistently approach all generic security flaws inherent in their design with new ideas in an attempt to create a secure computing environment.

Contents

[edit] BSD

BSD is a family of Unix variants derived from a code base originating at the University of California, Berkeley. All derived BSD operating systems are released under the terms of a BSD-style license. There are several BSD variants, with only one being heavily focused on security.

[edit] OpenBSD

OpenBSD is an open source BSD operating system that is known to be concerned heavily with security. The project has completed rigorous manual reviews of the code and addressed issues most systems have not. OpenBSD also supplies an executable space protection scheme known as W^X (memory is writable xor executable), as well as a ProPolice compiled executable base.

[edit] TrustedBSD

TrustedBSD is a sub-project of FreeBSD designed to add trusted operating system extensions, targeting the Common Criteria for Information Technology Security Evaluation (see also Orange Book). Its main focuses are working on access control lists, event auditing, extended attributes, mandatory access controls, and fine-grained capabilities. Since access control lists are known to be confronted with the confused deputy problem, capabilities are a different way to avoid this issue. As part of the TrustedBSD project, there is also a port of the NSA's FLASK/TE implementation to run on FreeBSD. Many of these trusted extensions have been integrated into the main FreeBSD branch starting at 5.x.

[edit] Linux

Linux is a free, open source Unix variant created by Linus Torvalds. Linux itself is not inherently security-focused; however, many distributions and projects attempt to make Linux secure.

[edit] Adamantix

Adamantix is a Debian-based, security-focused Linux distribution (formerly named Trusted Debian). It employs a PaX and ProPolice protected base, and utilizes the RSBAC Mandatory access control system.

[edit] Annvix

Annvix was originally forked from Mandriva to provide a security-focused server distribution that employs ProPolice protection, hardened configuration, and a small footprint. Plans are to include full support for the RSBAC Mandatory access control system in the near future.

[edit] Fedora Core

Fedora Core is a free, Red Hat sponsored community developed Linux distribution. It is the only mainstream Linux distribution with a concentrated effort to improve system security, as a consequence it boasts a fully integrated SELinux MAC and fine-grained executable memory permission system and all binaries compiled with GCC's standard stack-smashing protection, as well as focusing on getting security updates into the system in a timely manner.

[edit] Hardened Gentoo

Hardened Gentoo is a subproject of the Gentoo Linux project.

Hardened Gentoo offers a ProPolice protected and Position Independent Executable base using the exact same package tree as Gentoo. Executable space protection in Hardened Gentoo is handled by PaX.

The Hardened Gentoo project is an extremely modular project, and also provides subprojects to integrate other intrusion-detection and Mandatory access control systems into Gentoo. All of these can be optionally installed in any combination, with or without PaX and a ProPolice base.

[edit] Immunix

Immunix is a commercial distribution of Linux focused heavily on security. They supply many systems of their own making, including StackGuard; cryptographic signing of executables; race condition patches; and format string exploit guarding code. Immunix traditionally releases older versions of their distribution free for non-commercial use.

Note that the Immunix distribution itself is licensed under two licenses: The Immunix commercial and non-commercial licenses. Many tools within are GPL, however; as is the kernel.

[edit] Openwall Project

Owl by a developer known as Solar Designer was the first distribution to have a non-executable userspace stack, /tmp race condition protection and access control restrictions to /proc data, by way of a kernel patch. It also features a per-user tmp directory via the pam_mktemp PAM module, and supports Blowfish password encryption.

[edit] Wendzel Linux

Wendzel Linux (a.k.a. Hardened-Linux) is a small Distribution for Firewalls, Intrusion Detection Systems, VPN-Gateways and Authentication jobs that is still under heavy development. The distribution is based on Slackware but entirely hardened and minimalized and includes the grsecurity kernel-patch, hardened versions of packages, and a hardened system configuration.

[edit] Solaris

Solaris is a free Unix variant created by Sun Microsystems. Solaris itself is not inherently security-focused. It is licensed under the CDDL open source license.

[edit] Trusted Solaris

Trusted Solaris is a security-focused version of the Solaris Unix operating system. Aimed primarily at the government computing sector, Trusted Solaris adds detailed auditing of all tasks, pluggable authentication, mandatory access control, additional physical authentication devices, and fine-grained access control. Versions of Trusted Solaris through version 8 are Common Criteria certified. See [1] and [2] Trusted Solaris Version 8 received the EAL4 certification level augmented by a number of protection profiles. See [3] for explanation of The Evaluation Assurance Levels.

[edit] See also

[edit] External links

Retrieved from "http://en.wikipedia.org../../../s/e/c/Security_focused_operating_system.html"