A SELinux policy intelligent generation method, tool and storage medium

Abstract

The present invention provides a SELinux policy intelligent generation method, tool and storage medium. The tool can intelligently learn according to the alarm in the system log information, and then generate the SELinux policy. Specifically, the log information generated in the system operation process is used as an input source to extract the SELinux alarm, and all the SELinux alarms are stored as a text file A, the auditallow command is used to convert the SELinux alarm into a SELinux policy, and the checkpolicy command is used to check whether the SELinux policy violates the neverallow rule, the SELinux policy violating the neverallow rule and the neverallow rule are uniformly stored in a text file B, and then the SELinux alarm of the SELinux policy to be tested is extracted from the SELinux alarm, the SELinux alarm is associated with the corresponding neverallow rule, a new SELinux policy is generated, and the inspection is performed again until all SELinux policies do not violate the corresponding neverallow rule.

Description

Technical Field

[0001] The present invention relates to the field of information communication technology, and in particular to a SELinux policy intelligent generation method, tool and storage medium. Background Art

[0002] In a system running SELinux and SELinux in enforcing mode, when a subject accesses an object, SELinux will perform a permission check on the operation. If there is no SELinux policy configured for the operation, the operation will not be allowed to execute, otherwise it will be allowed. In order to ensure the normal operation of the system, software developers will manually configure the necessary SELinux policies for each subject based on the SELinux alarms in the log information. This method has great disadvantages. The system subjects are numerous and complex. Manually configuring permissions for each subject requires a lot of repetitive time, and this method is prone to problems such as omissions and duplications of SELinux policies. Configuring SELinux policies requires software developers to have relevant knowledge reserves, which increases the learning cost. Summary of the invention

[0003] In view of the above technical problems, the present invention proposes a SELinux policy intelligent generation method, tool and storage medium, wherein the method comprises the following steps:

[0004] S1: Use the log information generated during system operation as the input source;

[0005] S2: Extract SELinux alerts and store all SELinux alerts as text file A;

[0006] S3: Use the auditallow command to convert the SELinux alarm into a SELinux policy;

[0007] S4: Use the checkpolicy command to check whether the SELinux policy violates the neverallow rule. If so, store the SELinux policy that violates the neverallow rule and the corresponding neverallow rule in a text file B; if not, go to S6;

[0008] S5: Take out a SELinux policy to be tested and the corresponding neverallow rule from the text file B, extract the SELinux alarm of the SELinux policy to be tested from the SELinux alarm, associate the SELinux alarm with the corresponding neverallow rule, generate a new SELinux policy, and use the checkpolicy command to check the new SELinux policy again until it does not violate the corresponding neverallow rule, then go to S6; otherwise, store the SELinux alarm of the SELinux policy to be tested in the text file C;

[0009] S6: Generate a first file with a suffix of te according to the name of the subject.

[0010] Further, the alarm content of the SELinux alarm is defined as: comm is the subject; scontext is the subject security context; name is the object; tcontext is the object security context; tclass access category; {} represents the required permissions.

[0011] Furthermore, the S5 further includes the following:

[0012] S51: extract the scontext in the SELinux alarm, and associate it with the attribute of the main part in the corresponding neverallow rule, and then perform a checkpolicy command check. If the neverallow rule is violated, go to S52;

[0013] S52: extract tcontext in the SELinux alarm, and associate it with the attribute of the object part in the corresponding neverallow rule, and then perform a checkpolicy command check. If the neverallow rule is violated, go to S53;

[0014] S53: extract the name in the SELinux alarm, use the SELinux type syntax, take the file name or path name or the combined file name as the new type of SELinux and generate a contexts file, use the selinux syntax to mark the newly defined SELinux security context for the object; replace the object security context part of the SELinux policy with the newly defined type, and then perform a checkpolicy command check. If the neverallow rule is violated, go to S54;

[0015] S54: extract the comm in the SELinux alarm, redefine the subject's security context according to the type of the subject part in the corresponding neverallow rule, and replace the subject's security context part of the SELinux policy with the subject's new security context, and then perform a checkpolicy command check.

[0016] The association syntax adopted by S51 is type attribute init appdomain, and the appdomain is the main part in the neverallow rule.

[0017] The associated syntax adopted by S52 is typeattribute system_file exec_type, and the exec_type is the object part in the neverallow rule.

[0018] Wherein, the S6 further includes:

[0019] It is determined whether the first file exists. If so, the SELinux policy is appended to the end of the file. If not, a new first file is created and the SELinux policy is appended to the end.

[0020] Preferably, the present invention further provides a SELinux policy intelligent generation tool, which is embedded and installed in a system in enforcing mode, and the tool at least includes:

[0021] Furthermore, the tool at least includes:

[0022] A data collection unit is used to obtain log information generated during the operation of the system as an input source;

[0023] The alarm information processing unit is responsible for extracting SELinux alarms and storing all SELinux alarms as text file A; using the auditallow command to convert the SELinux alarms into SELinux policies

[0024] The permission checking unit uses the checkpolicy command to check whether the SELinux policy violates the neverallow rule. If so, the SELinux policy that violates the neverallow rule and the corresponding neverallow rule are uniformly stored in the text file B; if not, a first file with a suffix of te is generated according to the name of the subject;

[0025] The SELinux policy generation unit takes out a SELinux policy to be tested and a corresponding neverallow rule from the text file B, extracts the SELinux alarm of the SELinux policy to be tested from the SELinux alarm, associates the SELinux alarm with the corresponding neverallow rule through the policy adjustment module, generates a new SELinux policy, and uses the checkpolicy command to check the new SELinux policy again until the corresponding neverallow rule is not violated; otherwise, the SELinux alarm of the SELinux policy to be tested is stored in the text file C, waiting for manual processing.

[0026] Furthermore, the SELinux policy generation unit and the policy adjustment module further include:

[0027] According to the SELinux policy to be tested, the corresponding neverallow rule and its SELinux alarm, extract the scontext in the SELinux alarm and associate it with the attribute of the main part in the corresponding neverallow rule;

[0028] Or extracting tcontext in the SELinux warning and associating it with the attribute of the object part in the corresponding neverallow rule;

[0029] or extracting the name in the SELinux alarm, using the SELinux type syntax, taking the file name or path name or a combination of the file name as a new type of SELinux and generating a contexts file, using the selinux syntax to mark the newly defined SELinux security context for the object; replacing the object security context part of the SELinux policy with the newly defined type;

[0030] Or extract the comm in the SELinux alarm, redefine the subject's security context according to the type of the subject part in the corresponding neverallow rule, and replace the subject's security context part of the SELinux policy with the subject's new security context.

[0031] As another preferred embodiment, the present invention further provides a storage medium, a storage medium arranged at the end of an in-vehicle infotainment system, a processor, and a computer program stored on the storage medium and executable by the processor.

[0032] Wherein, the computer program is used to execute the above-mentioned SELinux policy intelligent generation method.

[0033] In summary, the present invention provides a method, tool and storage medium for intelligent generation of SELinux policies. The tool can intelligently learn according to the alarms in the system log information, and then generate SELinux policies. Specifically, the log information generated during the operation of the system is used as an input source to extract SELinux alarms, and all SELinux alarms are stored as a text file A. The auditallow command is used to convert the SELinux alarms into SELinux policies, and the checkpolicy command is used to check whether the SELinux policies violate the neverallow rules, and the SELinux policies that violate the neverallow rules and the neverallow rules are uniformly stored in a text file B, and then the SELinux alarm of the SELinux policy to be tested is extracted from the SELinux alarm, and the SELinux alarm is associated with the corresponding neverallow rule to generate a new SELinux policy, and it is checked again until all SELinux policies do not violate the corresponding neverallow rules. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 This is a flow chart of the SELinux policy intelligent generation method described in the present invention. DETAILED DESCRIPTION

[0035] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0036] Embodiment 1:

[0037] like Figure 1 As shown, the present invention proposes a method for intelligently generating SELinux policies, and implements a SELinux policy intelligent generation tool through a programming language. The tool can intelligently learn based on the alarms in the system log information, and then generate SELinux policies. Specifically, the following steps are included:

[0038] The following steps are involved:

[0039] S1: Use the log information generated during system operation as the input source;

[0040] S2: Extract SELinux alerts and store all SELinux alerts as text file A;

[0041] S3: Use the auditallow command to convert the SELinux alarm into a SELinux policy;

[0042] S4: Use the checkpolicy command to check whether the SELinux policy violates the neverallow rule. If so, store the SELinux policy that violates the neverallow rule and the corresponding neverallow rule in a text file B; if not, go to S6;

[0043] S5: Take out a SELinux policy to be tested and the corresponding neverallow rule from the text file B, extract the SELinux alarm of the SELinux policy to be tested from the SELinux alarm, associate the SELinux alarm with the corresponding neverallow rule, generate a new SELinux policy, and use the checkpolicy command to check the new SELinux policy again until it does not violate the corresponding neverallow rule, then go to S6; otherwise, store the SELinux alarm of the SELinux policy to be tested in the text file C;

[0044] S6: Generate a first file with a suffix of te according to the name of the subject.

[0045] Further, the alarm content of the SELinux alarm is defined as: comm is the subject; scontext is the subject security context; name is the object; tcontext is the object security context; tclass access category; {} represents the required permissions.

[0046] Furthermore, the S5 further includes the following:

[0047] S51: extract the scontext in the SELinux alarm, and associate it with the attribute of the main part in the corresponding neverallow rule, and then perform a checkpolicy command check. If the neverallow rule is violated, go to S52;

[0048] S52: extract tcontext in the SELinux alarm, and associate it with the attribute of the object part in the corresponding neverallow rule, and then perform a checkpolicy command check. If the neverallow rule is violated, go to S53;

[0049] S53: extract the name in the SELinux alarm, use the SELinux type syntax, take the file name or path name or the combined file name as the new type of SELinux and generate a contexts file, use the selinux syntax to mark the newly defined SELinux security context for the object; replace the object security context part of the SELinux policy with the newly defined type, and then perform a checkpolicy command check. If the neverallow rule is violated, go to S54;

[0050] S54: extract the comm in the SELinux alarm, redefine the subject's security context according to the type of the subject part in the corresponding neverallow rule, and replace the subject's security context part of the SELinux policy with the subject's new security context, and then perform a checkpolicy command check.

[0051] The association syntax adopted by S51 is type attribute init appdomain, and the appdomain is the main part in the neverallow rule.

[0052] The associated syntax adopted by S52 is typeattribute system_file exec_type, and the exec_type is the object part in the neverallow rule.

[0053] Wherein, the S6 further includes:

[0054] It is determined whether the first file exists. If so, the SELinux policy is appended to the end of the file. If not, a new first file is created and the SELinux policy is appended to the end.

[0055] Preferably, the present invention further provides a SELinux policy intelligent generation tool, which is embedded and installed in a system in enforcing mode, and the tool at least includes:

[0056] Furthermore, the tool at least includes:

[0057] A data collection unit is used to obtain log information generated during the operation of the system as an input source;

[0058] The alarm information processing unit is responsible for extracting SELinux alarms and storing all SELinux alarms as text file A; using the auditallow command to convert the SELinux alarms into SELinux policies

[0059] The permission checking unit uses the checkpolicy command to check whether the SELinux policy violates the neverallow rule. If so, the SELinux policy that violates the neverallow rule and the corresponding neverallow rule are uniformly stored in the text file B; if not, a first file with a suffix of te is generated according to the name of the subject;

[0060] The SELinux policy generation unit takes out a SELinux policy to be tested and a corresponding neverallow rule from the text file B, extracts the SELinux alarm of the SELinux policy to be tested from the SELinux alarm, associates the SELinux alarm with the corresponding neverallow rule through the policy adjustment module, generates a new SELinux policy, and uses the checkpolicy command to check the new SELinux policy again until the corresponding neverallow rule is not violated; otherwise, the SELinux alarm of the SELinux policy to be tested is stored in the text file C, waiting for manual processing.

[0061] Furthermore, the SELinux policy generation unit and the policy adjustment module further include:

[0062] According to the SELinux policy to be tested, the corresponding neverallow rule and its SELinux alarm, extract the scontext in the SELinux alarm and associate it with the attribute of the main part in the corresponding neverallow rule;

[0063] Or extracting tcontext in the SELinux warning and associating it with the attribute of the object part in the corresponding neverallow rule;

[0064] or extracting the name in the SELinux alarm, using the SELinux type syntax, taking the file name or path name or a combination of the file name as a new type of SELinux and generating a contexts file, using the selinux syntax to mark the newly defined SELinux security context for the object; replacing the object security context part of the SELinux policy with the newly defined type;

[0065] Or extract the comm in the SELinux alarm, redefine the subject's security context according to the type of the subject part in the corresponding neverallow rule, and replace the subject's security context part of the SELinux policy with the subject's new security context.

[0066] As another preferred embodiment, the present invention further provides a storage medium, a storage medium arranged at the end of an in-vehicle infotainment system, a processor, and a computer program stored on the storage medium and executable by the processor.

[0067] Wherein, the computer program is used to execute the above-mentioned SELinux policy intelligent generation method.

[0068] The method of the present invention is used to learn during the operation of the system and then generate SELinux policies, which specifically includes the following beneficial effects: 1. It saves a lot of repetitive time for software developers to configure SELinux policies; 2. It solves the problems of SELinux policy omission and duplication caused by manual configuration of permissions; 3. It reduces the learning cost and burden of software developers for learning SELinux policy configuration.

[0069] Embodiment 2:

[0070] The present invention provides a method, tool and storage medium for intelligently generating SELinux policies. A tool for intelligently generating SELinux policies is implemented by programming language. The tool can intelligently learn based on the alarms in the system log information and then generate SELinux policies. The specific principle process of the tool is as follows:

[0071] (1) The log information generated during system operation is used as the input source of this tool.

[0072] (2) This tool extracts SELinux warnings from the log information described in point 1 and stores all warnings as a text file A. The warning examples are as follows: Among them, the warning examples are as follows:

[0073] [313.353976] (1)type=1400 audit(1194221090.379:107): avc: denied {execute} for pid=1 comm="init" path=" / system / bin / clear_cache.sh" dev="mmcblk0p23" ino=1696 scontext=u:r:init:s0 tcontext=u:object_r:system_file:s0tclass=file permissive=0.

[0074] Further, the various parts of the alarm are explained as follows. Preferably, comm is the subject, scontext is the subject security context, name is the object, tcontext is the object security context, tclass is the access category, and {} represents the required permission, preferably the execute permission.

[0075] (3) This tool uses the auditallow command to convert the SELinux alert mentioned in the second point into a SELinux policy;

[0076] Among them, the conversion command is preferably as follows:

[0077] "audit2allow -i textfileA";

[0078] Taking the above alarm example, the converted SELinux policy is as follows: allow init system_file:file execute.

[0079] The present invention preferably uses the checkpolicy command to check whether the SELinux policy violates the neverallow rule. An example of the neverallow rule is as follows:

[0080] never allow {

[0081] domain

[0082] -appdomain # for oemfs

[0083] -bootanim # for oemfs

[0084] -recovery # for / tmp / update_binary in tmpfs}

[0085] { fs_type -rootfs -exec_type}:file execute.

[0086] (4) Generate a file with the suffix te according to the name of the subject, based on the SELinux policy that does not violate the neverallow rule. If the file already exists, the SELinux policy is appended to the end of the file. If the file already has this policy, it is not appended and the new file is named init.te.

[0087] (5) The SELinux policy that violates the neverallow rule and the neverallow rule are stored in text file B.

[0088] (6) Take out a SELinux policy and the corresponding neverallow rule from text file B, and extract the SELinux alarm corresponding to the SELinux policy described in point 7 from the SELinux alarm described in point 2, and extract the subject (comm), subject security context (scontext), object (name), object security context (tcontext), access category (tclass), required permissions, etc. from the SELinux alarm. If there are no SELinux policies and neverallow rules in text file B, this tool process ends.

[0089] (7) Associate the subject security context extracted from the SELinux alarm with the attribute of the subject part in the neverallow rule described in point 4, and use the checkpolicy command to check whether the SELinux policy described in point 3 violates the neverallow rule. If not, generate a file with the suffix te according to the name of the subject based on the SELinux policy. If the file already exists, append the SELinux policy to the end of the file, and write the subject security context associated with the attribute of the subject part of the neverallow rule into the file; if it violates, associate the subject security context with the next attribute of the subject part in the neverallow rule. If there is no next attribute, proceed to point 9. Using the neverallow rule described in point 4 to explain "the subject part in the neverallow rule", the syntax example of associating the subject security context with the attribute of the subject part in the neverallow rule is typeattribute init appdomain.

[0090] (8) Associate the object security context extracted from the alarm described in point 7 with the attribute of the object part in the neverallow rule described in point 4, and use the checkpolicy command to check whether the SELinux policy described in point 3 violates the neverallow rule. If not, generate a file with the suffix te based on the name of the subject according to this SELinux policy. If the file already exists, append this SELinux policy to the end of the file, associate the object security context with the attribute of the object part of the neverallow rule, write it into the file, and jump to point 7. If it violates, repeat point 9 and associate the object security context with the next attribute of the object part in the neverallow rule. If there is no attribute, go to point 10. Using the neverallow rule described in point 4 to explain "the object part in the neverallow rule", the object part in the neverallow rule is exec_type (rootfs is not an attribute). Taking the SELinux warning described in point 7 as an example, the syntax example of the attribute that associates the security context of the object to the object part in the neverallow rule is typeattribute system_file exec_type.

[0091] (9) Extract the object (name) described in point 7 and use the SELinux type syntax to use its file name (or path name combined with file name) as the new type of SELinux, and generate a contexts file. Use the selinux syntax to mark the newly defined SELinux security context for the object. If contexts exists, add it after contexts. Replace the object security context part of the SELinux policy described in point 7 with the newly defined type. Use checkpolicy again to check whether the SELinux policy violates the neverallow rule. If not, generate a file with the suffix te according to the name of the subject for this SELinux policy, and then jump to item 7. If it violates, jump to item 11.

[0092] (10) Use the extracted subject (comm) described in point 7, the type of the subject part of neverallow described in point 4, to redefine the subject's security context, and replace the subject security context part of the SELinux policy described in point 7 with the subject's new security context. Use checkpolicy again to check whether the SELinux policy violates the neverallow rule. If not, generate a file with the suffix te based on the name of the subject, and then jump to point 7. If it is violated, store the alarm in text file C, wait for manual processing, and then jump to point 7.

[0093] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A method for intelligently generating SELinux policies, It is characterized in that The following steps are involved: S1: Use the log information generated during system operation as the input source; S2: Extract SELinux alerts and store all SELinux alerts as text file A; S3: Use the auditallow command to convert the SELinux alarm into a SELinux policy; S4: Use the checkpolicy command to check whether the SELinux policy violates the neverallow rule. If so, store the SELinux policy that violates the neverallow rule and the corresponding neverallow rule in a text file B; if not, go to S6; S5: Take out a SELinux policy to be tested and the corresponding neverallow rule from the text file B, extract the SELinux alarm of the SELinux policy to be tested from the SELinux alarm, associate the SELinux alarm with the corresponding neverallow rule, generate a new SELinux policy, and use the checkpolicy command to check the new SELinux policy again until it does not violate the corresponding neverallow rule, then go to S6; otherwise, store the SELinux alarm of the SELinux policy to be tested in the text file C; S6: Generate a first file with a suffix of te according to the name of the subject; The alarm content of the SELinux alarm is defined as: comm is the subject; scontext is the subject security context; name is the object; tcontext is the object security context; tclass is the access category; {} indicates the required permissions; Wherein, the step S5 further includes: S51: extract the scontext in the SELinux alarm, and associate it with the attribute of the main part in the corresponding neverallow rule, and then perform a checkpolicy command check. If the neverallow rule is violated, go to S52; S52: extract tcontext in the SELinux alarm, and associate it with the attribute of the object part in the corresponding neverallow rule, and then perform a checkpolicy command check. If the neverallow rule is violated, go to S53; S53: extract the name in the SELinux alarm, use the SELinux type syntax, take the file name or path name or the combined file name as the new type of SELinux and generate a contexts file, use the selinux syntax to mark the newly defined SELinux security context for the object; replace the object security context part of the SELinux policy with the newly defined type, and then perform a checkpolicy command check. If the neverallow rule is violated, go to S54; S54: extract the comm in the SELinux alarm, redefine the subject's security context according to the type of the subject part in the corresponding neverallow rule, and replace the subject's security context part of the SELinux policy with the subject's new security context, and then perform a checkpolicy command check.

2. According to claim 1, a method for intelligently generating SELinux policies, It is characterized in that Also includes: The association syntax adopted by S51 is type attribute init appdomain, and the appdomain is the main part in the neverallow rule.

3. A SELinux policy intelligent generation method according to claim 2, It is characterized in that Also includes: The associated syntax adopted by S52 is typeattribute system_file exec_type, and the exec_type is the object part in the neverallow rule.

4. A method for intelligently generating SELinux policies according to claim 3, It is characterized in that The S6 further includes: determining whether the first file exists, and if so, appending the SELinux policy to the end of the file; if not, creating a new first file and appending the SELinux policy to the end.

5. A SELinux policy intelligent generation tool based on the SELinux policy intelligent generation method according to any one of claims 1 to 4, It is characterized in that The tool is embedded in a system in an enforcing mode, and the tool includes at least: a data acquisition unit for acquiring log information generated during the operation of the system as an input source; The alarm information processing unit is responsible for extracting SELinux alarms and storing all SELinux alarms as a text file A; using the auditallow command to convert the SELinux alarms into SELinux policies; The permission checking unit uses the checkpolicy command to check whether the SELinux policy violates the neverallow rule. If so, the SELinux policy that violates the neverallow rule and the corresponding neverallow rule are uniformly stored in the text file B; if not, a first file with a suffix of te is generated according to the name of the subject; The SELinux policy generation unit takes out a SELinux policy to be tested and a corresponding neverallow rule from the text file B, extracts the SELinux alarm of the SELinux policy to be tested from the SELinux alarm, associates the SELinux alarm with the corresponding neverallow rule through the policy adjustment module, generates a new SELinux policy, and uses the checkpolicy command to check the new SELinux policy again until the corresponding neverallow rule is not violated; otherwise, the SELinux alarm of the SELinux policy to be tested is stored in the text file C, waiting for manual processing.

6. The tool according to claim 5, It is characterized in that The SELinux policy generation unit and the policy adjustment module further include: According to the SELinux policy to be tested, the corresponding neverallow rule and its SELinux alarm, extract the scontext in the SELinux alarm and associate it with the attribute of the main part in the corresponding neverallow rule; Or extracting tcontext in the SELinux warning and associating it with the attribute of the object part in the corresponding neverallow rule; or extracting the name in the SELinux alarm, using the SELinux type syntax, taking the file name or path name or a combination of the file name as a new type of SELinux and generating a contexts file, using the selinux syntax to mark the newly defined SELinux security context for the object; replacing the object security context part of the SELinux policy with the newly defined type; Or extract the comm in the SELinux alarm, redefine the subject's security context according to the type of the subject part in the corresponding neverallow rule, and replace the subject's security context part of the SELinux policy with the subject's new security context.

7. A storage medium, It is characterized in that The storage medium is arranged at the in-vehicle infotainment system end, and the storage medium stores a computer program executable by a processor, and the computer program is used to execute the method according to any one of claims 1 to 4.

Images