RHEL8 Security

Main New Features

Required by security certifications
Preventing security flaws (stack smashing, memory corruption, etc) before shipping

Solves the problem of ensuring systemwide consistent cryptography settings for addressing compliance requirements
Easy to use and automate with 4 policies (LEGACY, DEFAULT, FIPS and FUTURE)
- # update-crypto-policies –set FUTURE
- # update-crypto-policies –show
Sets allowed key lengths, hashes, parameters, protocols, and algorithms
Allows disabling an algorithm system or site-wide without breaking the stack
Systemwide effects on libkrb5, BIND, OpenSSL, OpenJDK, GnuTLS, OpenSSH, Libreswan, Python, NSS

Provide a means to consistently identify software, its origin, and manufacturer
Methods for executing only ‘white-listed’ utilities and application to reduce risk
Used by strongSwan, IBM BigFix, Microsoft, and others already
Works with any of packaging mechanisms (rpm, tar, zip, etc)
Defined in ISO/IEC 19770-2:2015 standard
XML file, digitally signed by Red Hat
Optional requirement for Common Criteria certification, required for SCAP 1.3 scanners
Highly recommended for whitelisting for federal governments

SELinux provides mandatory access control and is enabled by default (containers require it)
Supports No New Privileges (NNP) in Systemd (nnp_nosuid_transition)
New control for preventing a process from changing the limits of another process (getrlimit)
Files have specific control now to prevent certain files from being memory mapped (file:map)
Ability to limit need to override access controls (dac_read_search)

TPM 2.0 full support with TCG software stack
Measurements of kernel taken each boot and stored into TPM PCR
LUKS data-at-rest key can be stored in TPM now via Network-Bound Disk Encryption utility (Clevis) for protecting against disk theft
Future work includes PKCS#11 API for TPM, virtual TPMs, and Red Hat OpenStack Platform

(No Ratings Yet)