Strategy adaptation system and method based on SELinux (Security-Enhanced Linux) security subsystem

Abstract

The invention discloses a strategy adaptation system and a method based on an SELinux (Security-Enhanced Linux) security subsystem, wherein the system comprises an information collecting module used for collecting the SELinux security subsystem and information of services operated in the SELinux security subsystem; a strategy template storing module used for storing an atomicity strategy template and a strategy base with preset services in a database storage manner; a strategy generating module used for generating a strategy sentence through the atomicity strategy template and the strategy base; a strategy testing module used for testing whether the grammar of the strategy sentence generated by the strategy generating module is legal; and a strategy recovering module used for restarting the system to test whether the loaded strategy sentence normally operates in different security levels. The method disclosed by the invention generates the strategy in an opening-once-serving manner, and generates the strategy according to the customization of a user in an application process instead of loading the strategy in a module, thereby improving the security of the system.

Description

technical field [0001] The invention relates to the field of Linux operating systems, in particular to the field of security servers, in particular to a policy adaptation system and method based on the SELinux security subsystem. Background technique [0002] SELinux (Security-Enhanced Linux) is the implementation of mandatory access control by the US National Security Agency (NSA), and is the most outstanding new security subsystem on Linux. The NSA, with the help of the Linux community, developed an access control system that restricts a process to only those files it needs in its mission. Usually, SELinux is installed on the Fedora operating system and Red Hat Enterprise Linux operating system by default, and can also be installed on other related systems, such as CentOS, NeoKylinOS, etc. [0003] Linux has added a general security access control framework, which controls the execution of the program through the Hook function. This framework is LSM (Linux Security Module...

AI Technical Summary

Problems solved by technology

SELinux access control rules are stored in security policy files, which are divided into binary files and source code files. Because of the fine-grained influence of SELinux, it is difficult to write and maintain the source code of policy files.

Images