NSA.gov: Integrating Flexible Support for Security Policies into the Linux Operating System

“The protection mechanisms of current mainstream operating
systems are inadequate to support confidentiality and integrity
requirements for end systems. Mandatory access control (MAC) is
needed to address such requirements, but the limitations of
traditional MAC have inhibited its adoption into mainstream
operating systems. The National Security Agency (NSA) worked with
Secure Computing Corporation (SCC) to develop a flexible MAC
architecture called Flask to overcome the limitations of
traditional MAC. The NSA has implemented this architecture in the
Linux operating system, producing a Security-Enhanced Linux
(SELinux) prototype, to make the technology available to a wider
community and to enable further research into secure operating
systems. NAI Labs has developed an example security policy
configuration to demonstrate the benefits of the architecture and
to provide a foundation for others to use. This paper describes the
security architecture, security mechanisms, application programming
interface, security policy configuration, and performance of
SELinux…”

Complete
Story