Abstract
This paper presents a Colored Petri Nets (CPN) approach to analyze the information flow in the policy file of Security-Enhanced Linux (SELinux). The SELinux access control decisions are based on a security policy file that contains several thousands of security rules. It becomes a challenge for policy administrator to determine whether the modification of the security policy file conforms to the pre-specified security goals. To address this issue, this paper proposes a formal information flow model for SELinux security policy file, and presents a simple query language to help administrators to express the expected/unexpected information flow. We developed a method to transform the SELinux policy and security goal into Policy CPN Diagram and Query CPN Diagram. A tool named SEAnalyzer that can automatically verify the SELinux policy has been developed and two application examples of this tool will be presented in the context.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Loscocco, P.A., Smalley, S.D., Muckelbauer, P.A., Taylor, R.C., Turner, S.J., Farrell, J.F.: The Inevitability of Failure: The Flawed Assumption of Security in Modern Computing Environments. In: Proceedings of the 21st National Information Systems Security Conference, pp. 303–314 (1998)
NSA SELinux, http://www.nsa.gov/selinux/
TCSEC, http://www.radium.ncsc.mil/tpep/library/rainbow/5200.28-STD.html
Loscocco, P.A., Smalley, S.D.: Meeting critical security objectives with Security- Enhanced Linux. In: Proceedings of the 2001 Ottawa Linux Symposium (2001)
Archer, M., Leonard, E., Pradella, M.: Towards a Methodology and tool for the Analysis of Security-Enhanced Linux Security Policies. NRL Memorandum Report NRL/MR/5540- 02-8629 (2002)
Jaeger, T., Sailer, R., Zhang, X.: Analyzing integrity protection in the SELinux example policy. In: Proc. USENIX Security Symposium, pp. 59–74 (2003)
Jaeger, T., Sailer, R., Zhang, X.: Resolving Constraint Conflicts. In: Proceedings of the 2004 ACM Symposium on Access Control Models and Technologies (2004)
Guttman, J.D., Herzog, A.L., Ramsdell, J.D.: Information Flow in Operating Systems: Eager Formal Methods. In: Workshop on Issues in the Theory of Security (WITS 2003) (2003)
Guttman, J.D., Herzog, A.L., Ramsdell, J.D.: SLAT: Information Flow Analysis in Security Enhanced Linux. Included in the SLAT distribution (2005), available from: http://www.nsa.gov/SELinux
Sarna-Starosta, B., Stoller, S.D.: Policy Analysis for security-Enhanced Linux. In: Workshop on Issues in the Theory of Security (WITS) (2004)
Zanin, G., Mancini, L.V.: Towards a Formal Model for Security Policies Specification and Validation in the SELinux System. In: The Proceeding of SACMAT 2004, Yorktown Heights, New York, USA, pp. 136–145 (2004)
Jensen, K.: Coloured Petri Nets. Basic Concepts, Analysis Methods and Practical Use. Basic Concepts. EATCS Monographs on Theoretical Computer Science, vol. 1, pp. 1–234. Springer, Heidelberg (1992)
Loscocco, P.A., Smalley, S.D.: Integrating Flexible Support for Security Policies into the Linux Operating System. In: USENIX Annual Technical Conference (2001)
Mccarty, B.: SELinux NSA’s Open Source Security Enhanced Linux, 256 pages. O’Reilly, Sebastopol, ISBN: 0-596-00716-7
Stubblebine, T.: Regular Expression Pocket Reference, p. 112. O’Reilly, Sebastopol (2003), ISBN: 0-596-00415-X
Gutnik, G., Kaminka, G.A.: Representing Conversations for Scalable Overhearing. JAIR 25, 349–387 (2006)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2006 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Chen, YM., Kao, YW. (2006). Information Flow Query and Verification for Security Policy of Security-Enhanced Linux. In: Yoshiura, H., Sakurai, K., Rannenberg, K., Murayama, Y., Kawamura, S. (eds) Advances in Information and Computer Security. IWSEC 2006. Lecture Notes in Computer Science, vol 4266. Springer, Berlin, Heidelberg. https://doi.org/10.1007/11908739_28
Download citation
DOI: https://doi.org/10.1007/11908739_28
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-47699-3
Online ISBN: 978-3-540-47700-6
eBook Packages: Computer ScienceComputer Science (R0)