SELinux strategy configuration method, SELinux strategy configuration tool and computer equipment

Abstract

The invention relates to the technical field of information security, and discloses an SELinux strategy configuration method and tool and computer equipment, and the method comprises the steps: creating a container environment to enable to-be-adapted software to run in the container environment; performing static analysis on the to-be-adapted software to obtain an installation file list of the to-be-adapted software; configuring a working mode of SELinux as an alarm mode, performing dynamic analysis on the to-be-adapted software, and recording an SELinux operation log; obtaining triple information of all the unauthorized behaviors based on matching of the installation file list and the running log; and generating a target strategy packet based on the triple information, and configuring the target strategy packet for the SELinux. According to the method, the strategy packet is generated through the triple information of all the unauthorized behaviors of the to-be-adapted software, all necessary accesses are covered, the complexity and error rate of manual configuration are reduced, and through automatic and accurate strategy configuration, it is ensured that software operation cannot be functionally abnormal due to security strategy limitation.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a SELinux policy configuration method, tool and computer equipment. Background Art

[0002] At present, all industries are loading their own businesses into computer systems for operation. A large amount of business data is flowing in computer systems, and information system security issues are becoming increasingly prominent. At present, there are operation and maintenance services or security tool software with "data security" and "network security" as the main goals. Most of the operating systems used in enterprises are based on Unix-like systems, and the Linux system itself provides two permission control mechanisms. One is to control the user's "read, write, and execute" permissions of files in the form of user management and file / directory permission management, and the other is a more detailed mandatory access control system - SELinux.

[0003] The former is easy to configure, but the control granularity is not fine enough, and ordinary hacker methods can access a wide range of system files as long as they gain privileges, thereby causing damage or stealing information. The latter is more finely controlled, and compared with upper-level security software applications, because its essence is a scheduling module based on the system kernel, when triggered, hacker attacks from the user level are difficult to penetrate into this level, and the control rate is fast, and performance will not be slowed down by auditing and control.

[0004] Nevertheless, when SELinux is enabled in a system environment, in the enforcing working mode, SELinux will enforce security policies. When a process is found to access a resource without authorization, it will prohibit the process from accessing it and record relevant information in the system log. If a newly developed third-party software does not have security policy rules specifically configured in SELinux, it is very likely that the default inherited security level is not enough to meet the business permission requirements for the program to run, resulting in SELinux prohibiting the software from accessing it. When SELinux enables the most stringent control policy, it is too difficult to operate the release policy for many software, which will form a "contradiction between the system security requirements for specific business scenarios and the guarantee of normal operation of business processes." Therefore, how to accurately configure security policies for SELinux to ensure that business software has the permissions required to run the program is a problem that needs to be solved. Summary of the invention

[0005] In view of this, the present invention provides a SELinux policy configuration method, tool and computer device to solve the problem of accurately configuring security policies for SELinux.

[0006] In a first aspect, the present invention provides a SELinux policy configuration method, the method comprising:

[0007] Create a container environment so that the software to be adapted can run in the container environment;

[0008] Perform static analysis on the software to be adapted to obtain a list of installation files of the software to be adapted;

[0009] Configure SELinux to work in warning mode, dynamically analyze the software to be adapted, and record the SELinux operation log, which includes unauthorized unauthorized behaviors of the software to be adapted.

[0010] Based on the matching of the installation file list and the operation log, the triple information corresponding to all the unauthorized behaviors of the software to be adapted is obtained. Any triple information includes the subject, the object and the operation behavior;

[0011] Based on each triplet of information, a target policy package is generated, and the target policy package is configured for SELinux.

[0012] The SELinux policy configuration method provided by the embodiment of the present invention creates a container environment so that the software to be adapted can run in the container environment, performs static analysis on the software to be adapted, obtains the installation file list of the software to be adapted, configures the working mode of SELinux to the alarm mode, so that all unauthorized and unauthorized behaviors of the software to be adapted are recorded without interrupting the operation of the software, and obtains the triplet information corresponding to all the unauthorized behaviors of the software to be adapted by matching the installation file list with the operation log, ensuring that the generated policy package covers all necessary access control rules, thereby generating a target policy package based on each triplet information, configuring the target policy package for SELinux, reducing the complexity and error rate of manual configuration, and ensuring that the software will not have functional abnormalities due to security policy restrictions during operation through automated and precise policy configuration, thereby improving the user experience.

[0013] In an optional implementation, static analysis is performed on the software to be adapted to obtain an installation file list of the software to be adapted, including:

[0014] When the software installation package of the software to be adapted is an RPM package, the software installation package of the software to be adapted is installed into a virtual directory of the container environment, and an installation file list of the software installation package is obtained;

[0015] When the software installation package of the software to be adapted is a compressed package of other types except the RPM package, the software installation package is decompressed and then traversed to obtain an installation file list.

[0016] The SELinux policy configuration method provided in the embodiment of the present invention performs static analysis on different types of software installation packages. If the software installation package is an RPM package, the software installation package is installed in a virtual directory of the container environment to obtain a complete installation file list. If the software installation package is another type of compressed package, it is decompressed and traversed to obtain a complete installation file list to provide support for the subsequent policy generation process.

[0017] In an optional implementation, a target policy package is generated based on each triplet of information, including:

[0018] For any triplet of information, security labels are determined for the subject and object in the triplet of information respectively;

[0019] Based on the security labels corresponding to the subject and the object respectively and the operation behaviors in the triple information, the policies corresponding to the triple information are generated, and the policies corresponding to all the triple information are taken as the target policy package.

[0020] The SELinux policy configuration method provided by the embodiment of the present invention can ensure that the access control rules of each subject and object are accurate by respectively determining security labels for the subject and object in the triplet information, generate policies based on the security labels and operation behaviors, ensure that each policy is targeted at specific access control requirements, avoid loose policies with excessive permissions, ensure that each subject can only access the resources it needs through fine-grained access control, follow the principle of least privilege, and improve the security of the system. At the same time, policies are automatically generated based on triplet information, which reduces the complexity and error rate of manual configuration and improves the efficiency and accuracy of configuration.

[0021] In an optional implementation, the SELinux working mode is configured as an alarm mode, and before dynamically analyzing the software to be adapted and recording the SELinux operation log, the method further includes:

[0022] Assign security labels to all files and directories in the installation file list of the software to be adapted;

[0023] For any security label corresponding to a file or directory, determine the permissions corresponding to the security label;

[0024] Generate an initial policy package based on the permissions corresponding to the security labels of all files and directories in the installation file list;

[0025] Configure the initial policy package for SELinux.

[0026] The SELinux policy configuration method provided by the embodiment of the present invention ensures that the access control rules of each file and directory are clear by assigning security labels to all files and directories, determines the permissions of each file and directory based on the security labels, ensures that each operation has clear permission restrictions, and automatically generates an initial policy package based on the permissions corresponding to the security labels of all files and directories in the installation file list, thereby reducing the complexity and error rate of manual configuration.

[0027] In an optional implementation, after generating a target policy package based on each triplet of information, the method further includes:

[0028] Merge redundant policies in the target policy package;

[0029] Clear invalid policies from the target policy package.

[0030] The SELinux policy configuration method provided by the embodiment of the present invention reduces redundant and invalid policies by optimizing the target policy package, thereby improving the policy execution efficiency. Meanwhile, the optimized policy package is easier to manage and maintain.

[0031] In an optional embodiment, the method further includes:

[0032] Initialize the container environment;

[0033] Configure SELinux to work in mandatory mode, so that the software to be adapted can execute all functions of the software to be adapted in the initialized container environment;

[0034] When all functions of the software to be adapted can run normally, export the software installation package and target policy package of the software to be adapted.

[0035] The SELinux policy configuration method provided by the embodiment of the present invention enables the software to be adapted to run in an initialized container environment, configures a mandatory execution mode for SELinux, executes all functions in a strict access control environment, and tests whether the target policy package of SELinux is valid. After confirming that all functions are running normally, it indicates that SELinux follows the target policy package to enable the software to be adapted to run normally, ensuring that the software will not have functional abnormalities during operation due to restrictions on security policies.

[0036] In a second aspect, the present invention provides a SELinux policy configuration tool, the tool comprising:

[0037] Podman scheduler, used to create a container environment so that the software to be adapted can run in the container environment;

[0038] The directory retrieval module is used to perform static analysis on the software to be adapted and obtain the installation file list of the software to be adapted;

[0039] The log retriever is used to dynamically analyze the software to be adapted, record the operation log of SELinux, and match the operation log with the installation file list obtained by the directory retrieval module to obtain the triple information corresponding to all unauthorized behaviors of the software to be adapted. The operation log includes the unauthorized unauthorized behaviors of the software to be adapted. Any triple information includes the subject, object and operation behavior.

[0040] A strategy generator, used for generating a target strategy package based on each triplet information;

[0041] The SELinux configuration module is used to configure the working mode of SELinux to the warning mode when the log retriever performs dynamic analysis, and configure the target policy package for SELinux after the policy generator generates the target policy package.

[0042] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the SELinux policy configuration method of the first aspect or any corresponding implementation method thereof by executing the computer instructions.

[0043] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to cause a computer to execute the SELinux policy configuration method of the first aspect or any corresponding implementation manner thereof.

[0044] In a fifth aspect, the present invention provides a computer program product, including computer instructions, where the computer instructions are used to enable a computer to execute the SELinux policy configuration method of the first aspect or any corresponding implementation method thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0046] Figure 1 is a schematic diagram of a SELinux policy configuration tool according to an embodiment of the present invention;

[0047] Figure 2 is a flowchart of a SELinux policy configuration method according to an embodiment of the present invention;

[0048] Figure 3 is a flowchart of another SELinux policy configuration method according to an embodiment of the present invention;

[0049] Figure 4 is a flowchart of a method for performing SELinux policy configuration using a SELinux policy configuration tool according to an embodiment of the present invention;

[0050] Figure 5 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0052] SELinux enforces security policies. When a process is found to access a resource without authorization, it will prohibit the process from accessing it and record relevant information in the system log. When SELinux opens the most stringent control policy, it is too difficult to operate the release policy for many software, which will form a "contradiction between the system security requirements of specific business scenarios and the guarantee of normal operation of business processes". Therefore, how to accurately configure security policies for SELinux to ensure that business software has the permissions to meet the program operation is a problem that needs to be solved. The SELinux policy configuration method provided by the embodiment of the present invention records all unauthorized unauthorized behaviors of the software to be adapted without interrupting the software operation, obtains the triple information corresponding to all unauthorized behaviors of the software to be adapted, generates a target policy package based on each triple information, and configures the target policy package for SELinux, thereby reducing the complexity and error rate of manual configuration, and through automated and accurate policy configuration, ensures that the software will not have functional abnormalities due to the restrictions of the security policy during operation, thereby improving the user experience.

[0053] Figure 1 is a schematic diagram of a SELinux policy configuration tool according to an embodiment of the present invention, such as Figure 1As shown, the SELinux policy configuration tool includes a Podman scheduler, a directory retrieval module, a log retriever, a policy generator and a SELinux configuration module. Among them, the Podman scheduler is used to create a container environment so that the software to be adapted can run in the container environment; the directory retrieval module is used to perform static analysis on the software to be adapted and obtain the installation file list of the software to be adapted; the log retriever is used to perform dynamic analysis on the software to be adapted, record the operation log of SELinux, and match the installation file list obtained based on the operation log and the directory retrieval module to obtain the triple information corresponding to all unauthorized behaviors of the software to be adapted, and the operation log includes unauthorized unauthorized behaviors of the software to be adapted, and any triple information includes subject, object and operation behavior; the policy generator is used to generate a target policy package based on each triple information; the SELinux configuration module is used to configure the working mode of SELinux to the alarm mode when the log retriever performs dynamic analysis, and configure the target policy package for SELinux after the policy generator generates the target policy package.

[0054] Specifically, the Podman scheduler has a built-in container scheduling module, which matches the matching scenario and creates a virtual sandbox to provide a virtual operating environment; the directory retrieval module is used to retrieve the installation file list of the software to be adapted. The log retriever is used to collect the logs of the software to be adapted during its operation, and filter out the triplet information of the unauthorized behavior of the software to be adapted in combination with the installation file list retrieved by the directory retrieval module. The policy generator is the core module of the policy configuration, which configures a specific security label for the triplet information and adds a permission authorization policy to the label. The SELinux configuration module is used to configure SELinux, such as configuring the working mode and policy package. When the policy generator generates a target policy package, the target policy package is configured for SELinux to ensure that the software to be adapted can still operate normally when the mandatory access mechanism is enabled in the current system.

[0055] According to an embodiment of the present invention, an embodiment of a SELinux policy configuration method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0056] In this embodiment, a SELinux policy configuration method is provided, which can be used for the above-mentioned SELinux policy configuration tool. Figure 2 is a flow chart of a SELinux policy configuration method according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0057] Step S201, create a container environment so that the software to be adapted can run in the container environment. Specifically, the SELinux security policy defines the scope of permissions of the software to be adapted. In the SELinux enforcement mode, if some functions of the software to be adapted exceed the scope of permissions defined in the SELinux security policy, then SELinux will force the access of the software to be adapted and limit its functions, thereby affecting the normal operation of the software to be adapted. Therefore, if the permissions of the software to be adapted to execute all functions normally are to be met, the security policy of SELinux needs to be configured. First, the Podman scheduler in the above-mentioned SELinux policy configuration tool is used to create a virtual container environment for the software to be adapted so that the software to be adapted can run in the container environment.

[0058] Step S202, statically analyze the software to be adapted to obtain a list of installation files of the software to be adapted. Specifically, the directory retrieval module in the SELinux policy configuration tool is used to statically analyze the software installation package of the software to be adapted to obtain a list of installation files, which includes paths of files and directories, such as installation files of the software to be adapted, temporary files generated during operation, directory structures, etc.

[0059] Step S203, configure the working mode of SELinux to the alarm mode, perform dynamic analysis on the software to be adapted, and record the operation log of SELinux, which includes the unauthorized unauthorized behavior of the software to be adapted. Specifically, the SELinux module in the SELinux policy configuration tool is used to configure the working mode of SELinux to the alarm mode. In this mode, SELinux will not block any unauthorized behavior of the software to be adapted, but will record the unauthorized unauthorized behavior in the operation log. More specifically, the operation log can only be obtained through the log audit administrator account, so the log retriever first switches to the log audit administrator account and regularly collects the operation log of SELinux.

[0060] Step S204, based on the matching of the installation file list and the operation log, obtain the triple information corresponding to all the unauthorized behaviors of the software to be adapted, and any triple information includes a subject, an object, and an operation behavior. Specifically, by matching the installation file list and the operation log, all the unauthorized behaviors of the software to be adapted are determined and expressed in the form of triples. First, all unauthorized unauthorized behaviors are extracted from the operation log. Then, these unauthorized behaviors are matched with the installation file list to determine the files involved in each unauthorized behavior. Finally, each unauthorized behavior is expressed in the form of a triple, including a subject (the process of the software to be adapted), an object (the file or resource accessed), and an operation behavior (such as reading, writing, executing, etc.).

[0061] Step S205, based on each triplet information, a target policy package is generated, and the target policy package is configured for SELinux. Specifically, based on all triplet information, a log analysis and policy generation tool, such as the audit2allow tool, is used to generate a target policy package, and the target policy package is configured to SELinux to ensure that the software to be adapted can run normally in the mandatory execution mode of SELinux.

[0062] The SELinux policy configuration method provided by the embodiment of the present invention creates a container environment so that the software to be adapted can run in the container environment, performs static analysis on the software to be adapted, obtains the installation file list of the software to be adapted, configures the working mode of SELinux to the alarm mode, so that all unauthorized and unauthorized behaviors of the software to be adapted are recorded without interrupting the operation of the software, and obtains the triplet information corresponding to all the unauthorized behaviors of the software to be adapted by matching the installation file list with the operation log, ensuring that the generated policy package covers all necessary access control rules, thereby generating a target policy package based on each triplet information, configuring the target policy package for SELinux, reducing the complexity and error rate of manual configuration, and ensuring that the software will not have functional abnormalities due to security policy restrictions during operation through automated and precise policy configuration, thereby improving the user experience.

[0063] In this embodiment, a SELinux policy configuration method is provided, which can be used for the above-mentioned SELinux policy configuration tool. Figure 3 is a flowchart of another SELinux policy configuration method according to an embodiment of the present invention, such as Figure 3 As shown, the process includes the following steps:

[0064] Step S301: Create a container environment so that the software to be adapted can run in the container environment. Figure 2 Step S201 of the illustrated embodiment will not be described in detail here.

[0065] Step S302: statically analyze the software to be adapted to obtain a list of installation files of the software to be adapted.

[0066] Specifically, the above step S302 includes:

[0067] Step S3021: If the software installation package of the software to be adapted is an RPM package, install the software installation package of the software to be adapted to the virtual directory of the container environment, and obtain the installation file list of the software installation package. Specifically, if the software installation package of the software to be adapted is an RPM (Red Hat Package Manager) package, install the software installation package directly to the virtual directory of the container environment, and obtain the installation file list of the software installation package through the "rpm" command. Taking the following code as an example, executing rpm-ql zimg-2.9.3-2.cq24.x86_64.rpm will print out the installation file list provided after the installation package zimg-2.9.3-2.cq24.x86_64.rpm is installed:

[0068] / usr / lib / .build-id

[0069] / usr / lib / .build-id / 30

[0070] / usr / lib / .build-id / 30 / 0a81648a09eac1b3ccece16c3154e3a880dc2d

[0071] / usr / lib64 / libzimg.so.2

[0072] / usr / lib64 / libzimg.so.2.0.0

[0073] / usr / share / doc / zimg

[0074] / usr / share / doc / zimg / ChangeLog

[0075] / usr / share / doc / zimg / README.md

[0076] / usr / share / licenses / zimg

[0077] / usr / share / licenses / zimg / COPYING.

[0078] Step S3022: If the software installation package of the software to be adapted is a compressed package of a type other than the RPM package, the software installation package is decompressed and then traversed to obtain a list of installation files. Specifically, if the software installation package is a common compressed package, that is, a compressed package of a type other than the RPM package, the directory retrieval module first decompresses the software installation package, and after decompression, the "find" command can be used to traverse the directory of the software installation package to obtain a list of installation files.

[0079] Step S303, assign security labels to all files and directories in the installation file list of the software to be adapted. Specifically, SELinux uses security labels to control permissions. The specific elements of the security label can be set by yourself, for example, it can include the name of the software to be adapted, file type, operation action, security level, etc.

[0080] Step S304: for a security label corresponding to any file or directory, determine the permission corresponding to the security label. Specifically, according to the security label corresponding to any file or directory, add the most basic permission to the security label.

[0081] Step S305: Generate an initial policy package based on the permissions corresponding to the security labels of all files and directories in the installation file list. Specifically, generate the initial policy package based on the most basic permissions corresponding to each file and directory.

[0082] Step S306, configure an initial policy package for SELinux. Specifically, the SELinux configuration module configures the initial policy package for SELinux so that SELinux uses the initial policy package to control the permissions of the software to be adapted. By assigning security labels to all files and directories, ensuring that the access control rules for each file and directory are clear, determining the permissions of each file and directory based on the security labels, ensuring that each operation has clear permission restrictions, and automatically generating an initial policy package based on the permissions corresponding to the security labels of all files and directories in the installation file list, the complexity and error rate of manual configuration are reduced.

[0083] Step S307: Configure SELinux to work in warning mode, dynamically analyze the software to be adapted, and record the SELinux operation log, which includes the unauthorized unauthorized behavior of the software to be adapted. Figure 2 Step S203 of the illustrated embodiment will not be described in detail here.

[0084] Step S308: Matching is performed based on the installation file list and the operation log to obtain the triplet information corresponding to all unauthorized behaviors of the software to be adapted. Any triplet information includes a subject, an object, and an operation behavior. Figure 2 Step S204 of the illustrated embodiment will not be described in detail here.

[0085] Step S309: Generate a target policy package based on each triplet of information, and configure the target policy package for SELinux.

[0086] Specifically, the above step S309 generates a target policy package based on each triplet information, including:

[0087] Step S3091, for any triplet information, determine the security label for the subject and object in the triplet information respectively. Specifically, referring to the above step S303, determine the security label for the subject and object in each triplet information respectively. The security label of the subject identifies which process is requesting access to a certain resource, and the security label of the object identifies which resource is being accessed. The security label of the subject and the security label of the object together determine whether the subject can perform specific operations on the object.

[0088] Step S3092, based on the security labels corresponding to the subject and the object respectively and the operation behavior in the triple information, generate the policy corresponding to the triple information, and use the policies corresponding to all triple information as the target policy package. Specifically, assuming that any triple information is: httpd_t (subject), systemd_passwd_var_run_t:dir (object) and watch (operation behavior), the policy generated based on the triple information can be expressed by the permission rule: allow httpd_t systemd_passwd_var_run_t:dir watch, which means that the httpd_t type process is allowed to view the systemd_passwd_var_run_t type directory. This policy is based on the security labels of the subject and the object, ensuring that only subjects that meet the specific security labels can execute the policy on the object. By determining the security labels for the subjects and objects in the triplet information respectively, the access control rules for each subject and object can be ensured to be accurate. Policies are generated based on security labels and operation behaviors to ensure that each policy is targeted at specific access control requirements, avoiding loose policies with excessive permissions. Through fine-grained access control, each subject can only access the resources it needs, following the principle of least privilege, thereby improving the security of the system. At the same time, policies are automatically generated based on triplet information, reducing the complexity and error rate of manual configuration and improving the efficiency and accuracy of configuration.

[0089] In some optional implementations, after the above step S309 generates a target policy package based on each triplet information, the method further includes:

[0090] Step a1, merge the redundant policies in the target policy package. Specifically, the generated policy package may include policies with the same subject and object, such as the following code:

[0091] allow httpd_t systemd_passwd_var_run_t:dir watch;

[0092] allow httpd_t systemd_passwd_var_run_t:dir rename;

[0093] The two policies shown in the above code have the same subject httpd_t and the same object systemd_passwd_var_run_t:dir. At this time, the two policies will be automatically merged to obtain allow httpd_tsystemd_passwd_var_run_t:dir{watch rename}.

[0094] Step a2, clear invalid policies in the target policy package. Specifically, clear policies that are no longer applicable or needed to ensure the effectiveness and simplicity of the target policy package. By optimizing the target policy package, redundant and invalid policies are reduced, the execution efficiency of the policy is improved, and the optimized policy package is easier to manage and maintain.

[0095] Step S310, initialize the container environment. Specifically, the target policy package is obtained through the above steps S301 to S309, and the target policy package is configured for SELinux. Steps S310 to S312 are used to test whether the software to be adapted can run normally with minimum permissions in the mandatory execution mode of SELinux after SELinux configures the target policy package. First, the Podman scheduler initializes the container environment.

[0096] Step S311, configure the working mode of SELinux to the mandatory execution mode, so that the software to be adapted can execute all functions of the software to be adapted in the container environment after initialization. Specifically, the working mode of SELinux is configured to be mandatory execution mode. In this mode, if the permission of the software to be adapted to execute the function is not defined in the target policy package of SELinux, SELinux will prohibit the software to be adapted from executing the function. Therefore, by judging whether the software to be adapted can execute all functions normally, it can be judged whether the target policy package contains the permission for the software to be adapted to execute all functions.

[0097] Step S312, if all functions of the software to be adapted can run normally, export the software installation package and target policy package of the software to be adapted. Specifically, if all functions of the software to be adapted can run normally, it means that when SELinux configures the target policy package, the software to be adapted can run normally under mandatory access control.

[0098] In some optional embodiments, Figure 4 is a flow chart of a method for performing SELinux policy configuration using a SELinux policy configuration tool according to an embodiment of the present invention. Figure 4As shown in Figure 1, the Podman scheduler creates a container environment in which the software to be adapted runs. Then, the directory retrieval module retrieves the software installation package of the software to be adapted and obtains the installation file list. Then, based on the installation file list, the initial policy package is generated, and the SELinux configuration module ( Figure 4 (not shown) configures the initial policy package for SELinux. At the same time, the SELinux configuration module configures the working mode of SELinux to the alarm mode. The software to be adapted runs in the alarm mode, and the log retriever retrieves the operation log of SELinux. Then, based on the matching of the operation log and the installation file list, the triplet information of the unauthorized behavior of the software to be adapted during the operation is obtained. Then, the policy generator generates the corresponding policy based on the triplet information to obtain the target policy package. Then, the target policy package is tested, and the Podman scheduler initializes the container environment. Then, the SELinux configuration module configures the working mode of SELinux to the enforcement mode, in which the software to be adapted is tested whether it can perform all functions normally.

[0099] The SELinux policy configuration method provided by the embodiment of the present invention creates a container environment so that the software to be adapted can run in the container environment, performs static analysis on the software to be adapted, obtains the installation file list of the software to be adapted, configures the working mode of SELinux to the alarm mode, so that all unauthorized and unauthorized behaviors of the software to be adapted are recorded without interrupting the operation of the software, and obtains the triplet information corresponding to all the unauthorized behaviors of the software to be adapted by matching the installation file list with the operation log, ensuring that the generated policy package covers all necessary access control rules, thereby generating a target policy package based on each triplet information, configuring the target policy package for SELinux, reducing the complexity and error rate of manual configuration, and ensuring that the software will not have functional abnormalities due to security policy restrictions during operation through automated and precise policy configuration, thereby improving the user experience.

[0100] The embodiment of the present invention also provides a computer device, see Figure 5 , Figure 5 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 5As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 5 A processor 10 is taken as an example.

[0101] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0102] The memory 20 stores instructions executable by at least one processor 10, so that at least one processor 10 executes the method shown in the above embodiment.

[0103] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0104] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0105] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 5 The example of connecting through bus is taken in the following.

[0106] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0107] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0108] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0109] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A SELinux policy configuration method, characterized in that: The method comprises: Creating a container environment so that the software to be adapted can run in the container environment; Performing static analysis on the software to be adapted to obtain an installation file list of the software to be adapted; Configure the working mode of SELinux to the alarm mode, perform dynamic analysis on the software to be adapted, and record the operation log of SELinux, wherein the operation log includes unauthorized unauthorized behavior of the software to be adapted; Based on the matching of the installation file list and the operation log, triplet information corresponding to all unauthorized behaviors of the software to be adapted is obtained, where any triplet information includes a subject, an object, and an operation behavior; Based on each triplet of information, a target policy package is generated, and the target policy package is configured for SELinux.

2. The method according to claim 1, characterized in that The static analysis of the software to be adapted to obtain the installation file list of the software to be adapted includes: In the case where the software installation package of the software to be adapted is an RPM package, installing the software installation package of the software to be adapted into a virtual directory of the container environment, and obtaining an installation file list of the software installation package; In the case that the software installation package of the software to be adapted is a compressed package of other types except the RPM package, the software installation package is decompressed and then traversed to obtain the installation file list.

3. The method according to claim 1, characterized in that The target strategy package is generated based on each triplet information, including: For any triplet of information, respectively determine security labels for the subject and object in the triplet of information; Based on the security labels corresponding to the subject and the object respectively and the operation behaviors in the triplet information, the policies corresponding to the triplet information are generated, and the policies corresponding to all the triplet information are used as the target policy package.

4. The method according to claim 1, characterized in that Before configuring the SELinux working mode to be an alarm mode, dynamically analyzing the software to be adapted, and recording the SELinux operation log, the method further includes: Assigning security labels to all files and directories in the installation file list of the software to be adapted; For a security label corresponding to any file or directory, determine the permissions corresponding to the security label; Generate an initial policy package based on permissions corresponding to security labels of all files and directories in the installation file list; Configure the initial policy package for SELinux.

5. The method according to claim 1, characterized in that: After generating the target policy package based on each triplet information, the method further includes: Merging redundant policies in the target policy package; Clear invalid policies in the target policy package.

6. The method according to claim 1, characterized in that The method further comprises: Initializing the container environment; Configure the working mode of SELinux to be a mandatory execution mode, so that the software to be adapted executes all functions of the software to be adapted in the initialized container environment; When all functions of the software to be adapted can run normally, the software installation package of the software to be adapted and the target policy package are exported.

7. A SELinux policy configuration tool, characterized in that: The tools include: Podman scheduler, used to create a container environment so that the software to be adapted can run in the container environment; A directory retrieval module, used to perform static analysis on the software to be adapted to obtain an installation file list of the software to be adapted; A log retriever, used to dynamically analyze the software to be adapted, record the operation log of SELinux, and match the operation log with the installation file list obtained by the directory retrieval module to obtain triple information corresponding to all unauthorized behaviors of the software to be adapted, wherein the operation log includes unauthorized unauthorized behaviors of the software to be adapted, and any triple information includes subject, object and operation behavior; A strategy generator, used for generating a target strategy package based on each triplet information; The SELinux configuration module is used to configure the working mode of SELinux to the alarm mode when the log retriever performs dynamic analysis, and configure the target policy package for SELinux after the policy generator generates the target policy package.

8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the SELinux policy configuration method according to any one of claims 1 to 6 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the SELinux policy configuration method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises computer instructions, wherein the computer instructions are used to enable a computer to execute the SELinux policy configuration method according to any one of claims 1 to 6.

Images