Multilevel Filesystem Label Dominance in Virtualized Zones
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualized computer systems, maintaining fine-grained access control while utilizing virtualization features is challenging, often requiring compromises that limit either virtualization capabilities or access control granularity.
Innovation Solution
A multilevel filesystem (MLFS) is implemented with a global zone and non-global zones, where each file and directory is associated with a label, allowing for secure access management through label-based dominance, enabling read and write access based on process labels, and allowing non-global zones to access MLFS content via a loopback filesystem.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional access control mechanisms are implemented in a virtualized environment, then fine-grained access control is maintained, but virtualization features are limited
Solution Approach 1:
The system segments the filesystem into multiple security levels (MLS) where each file and directory is assigned a security label. This segmentation allows different access control policies to be applied at different levels, enabling both fine-grained access control and flexible virtualization. The MLFS divides the namespace into security domains that can be independently managed.
Solution Approach 2:
The patent implements local quality by allowing different security labels and access policies to be applied to different files and directories within the same filesystem. Each file system object can have its own security classification, enabling customized access control for specific resources while maintaining overall system virtualization capabilities.
2Productivity
If virtualization features are fully utilized, then resource utilization improves, but access control granularity is reduced
Solution Approach 1:
The MLFS acts as an intermediary layer between the virtualized resources and the access control mechanisms. It provides a unified filesystem interface that simultaneously supports virtualization operations and enforces multi-level security policies. The loopback filesystem mechanism serves as an intermediary that allows non-global zones to access MLFS content while maintaining security boundaries.
Solution Approach 2:
The system changes the security parameter representation by using labels assigned to each file and directory rather than traditional Unix permissions. This label-based security model allows dynamic assignment of security attributes that can adapt to virtualization requirements while maintaining granular access control. The security context can be modified based on the virtual machine's identity and permissions.
3Reliability
If a multilevel filesystem with labels is implemented, then secure access control is achieved, but system complexity increases
Solution Approach 1:
The MLFS implementation provides multi-functionality by serving as both a standard filesystem for virtual machines and a security enforcement mechanism simultaneously. The same filesystem structure supports both data storage and access control functions, reducing the need for separate security subsystems and minimizing overall system complexity despite the enhanced security capabilities.
Data Source
AI summary
A global zone executing on a host OS that includes a multilevel filesystem (MLFS) associated with a label range, where the MLFS includes files and directories, where each of the files is associated with its own label and where each of the directories is associated with its own label. The global zone further includes a first non-global zone, where the MLFS is mounted in the first non-global zone as a first loopback file system. The host OS is configured to receive, from a process executing on the host OS, a request to access a first file in the MLFS, make a first determination that a process label dominates a first file label, based on the first determination, make a second determination that the first file label is equal to the process label, and in response to the second determination, provide read and write access to the first file.