Linux security modules: General security support for the Linux Kernel

Foundations of Intrusion Tolerant Systems, OASIS 2003

Volumn , Issue , 2003, Pages 213-226

  Wright, Chris ^a,e   Cowan, Crispin ^a,f   Morris, James ^b,g   Smalley, Stephen ^c,f   Kroah Hartman, Greg ^d  

^a WireX Communications Inc   (United States)

^b Intercode Pty Ltd   (Australia)

^c Network Associates Inc   (United States)

^d IBM   (United States)

^e Open Source Development Lab   (United States)

^f Immunix ^*  (United States)

^g RED HAT   (United States)

Author keywords

Access control; Communication system security; Control systems; Kernel; Linux; Operating systems; Permission; Protection

Indexed keywords

ACCESS CONTROL; COMPUTER OPERATING SYSTEMS; CONTROL SYSTEMS; MERCURY (METAL); NETWORK SECURITY;

ACCESS CONTROL MECHANISM; COMMUNICATION SYSTEM SECURITY; DESIGN AND IMPLEMENTATIONS; DOMAIN AND TYPE ENFORCEMENT; KERNEL; LOADABLE KERNEL MODULES; PERMISSION; PROTECTION;

LINUX;

EID: 57349162823     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/FITS.2003.1264934     Document Type: Conference Paper

References (47)

1. M. D. Abrams, L. J. LaPadula, K. W. Eggers, and I. M. Olson. A generalized framework for access control: An informal description. In Proceedings of the 13th National Computer Security Conference, pages 135-143, Oct. 1990.
2. J. Anderson. Computer Security Technology Planning Study. Report Technical Report ESD-TR-73-51, Air Force Elect. Systems Div., October 1972.
3. Argus. Pitbull LX. http://www.argus-systems.com/product/overview/lx/, March 2001.
4. L. Badger, D. F. Sterne, and et al. Practical Domain and Type Enforcement for UNIX. In Proceedings of the IEEE Symposium on Security and Privacy, Oakland, CA, May 1995.
5. L. Badger, D. F. Sterne, D. L. Sherman, K. M. Walker, and S. A. Haghighat. A Domain and Type Enforcement UNIX Prototype. In Proceedings of the USENIX Security Conference, 1995.
6. D. Baker. Fortresses built upon sand. In Proceedings of the New Security Paradigms Workshop, 1996.
7. B. N. Bershad, S. Savage, P. Pardyak, E. G. Sirer, M. Fiuczynski, D. Becker, S. Eggers, and C. Chambers. Extensibility, Safety and Performance in the SPIN Operating System. In Symposium on Operating Systems Principles (SOSP), Copper Mountain, Colorado, December 1995.
8. M. Bishop and M. Digler. Checking for Race Conditions in File Accesses. Computing Systems, 9(2):131-152, Spring 1996. Also available at http://olympus.cs.ucdavis.edu/~bishop/scriv/index.html.
9. W. Bobert and R. Kain. A Practical Alternative to Hierarchical Integrity Policies. In Proceedings of the 8th National Computer Security Conference, Gaithersburg, MD, 1985.
10. C. Cowan, S. Beattie, C. Pu, P. Wagle, and V. Gligor. SubDomain: Parsimonious Server Security. In USENIX 14th Systems Administration Conference (LISA), New Orleans, LA, December 2000.
11. C. Cowan, A. Black, C. Krasic, C. Pu, J. Walpole, C. Consel, and E.-N. Volanschi. Specialization Classes: An Object Framework for Specialization. In Proceedings of the Fifth International Workshop on Object-Orientation in Operating Systems (IWOOOS '96), Seattle, WA, October 27-28 1996.
12. S. Designer". Non-Executable User Stack. http://www.openwall.com/linux/.
13. A. Edwards, T. R. Jaeger, and X. Zhang. Verifying Authorization Hook Placement for the Linux Security Modules Framework. Report RC22254, IBM T.J. Watson Research Center, December 2001. http://domino.watson.ibm.com/library/cyberdig.nsf/1e4115aea78b6e7c85256b3600%66f0d4/fd3bffacfd2bbd9385256b30005ec7ee?OpenDocument.
14. N. Edwards, J. Berger, and T. H. Choo. A Secure Linux Platform. In Proceedings of the 5th Annual Linux Showcase and Conference, November 2001.
15. D. R. Engler, M. F. Kaashoek, and J. O. Jr. Exokernel: An Operating System Architecture for Application-level Resource Management. In Symposium on Operating Systems Principles (SOSP), Copper Mountain, Colorado, December 1995.
16. M. A. et al. Information Security: An Integrated Collection of Essays. IEEE Comp., 1995.
17. T. Fraser. LOMAC: Low Water-Mark Integrity Protection for COTS Environments. In Proceedings of the IEEE Symposium on Security and Privacy, Oakland, CA, May 2000.
18. T. Fraser. LOMAC: MAC You Can Live With. In Proceedings of the FREENIX Track, USENIX Annual Technical Conference, Boston, MA, June 2001.
19. T. Fraser, L. Badger, and M. Feldman. Hardening COTS Software with Generic Software Wrappers. In Proceedings of the IEEE Symposium on Security and Privacy, Oakland, CA, May 1999.
20. V. D. Gligor, S. I. Gavrila, and D. Ferraiolo. On the Formal Definition of Separation-of-Duty Policies and their Composition. In Proceedings of the IEEE Symposium on Security and Privacy, Oakland, CA, May 1998.
21. A. Grunbacher. Extended Attributes and Access Control Lists for Linux. World-wide web page available at http://acl.bestbits.at/, December 2001.
22. S. Hallyn and P. Kearns. Domain and Type Enforcement for Linux. In Proceedings of the 4th Annual Linux Showcase and Conference, Oct. 2000.
23. J. Inouye, R. Konuru, J. Walpole, and B. Sears. The Effects of Virtually Addressed Caches on Virtual Memory Design & Performance. Operating Systems Review, 24(4):896-908, October 1992.
24. Also published as OGI technical report CSE-92-010, ftp://cse.ogi.edu/pub/tech-reports/1992/92-010.ps.gz.
25. SNARE. World-wide web page available at http://intersectalliance.com/projects/Snare/.
26. J. Lepreau, B. Ford, and M. Hibler. The persistent relevance of the local operating system to global applications. In Proceedings of the ACM SIGOPS European Workshop, pages 133-140, Sept. 1996.
27. Linux Intrusion Detection System. World-wide web page available at http://www.lids.org.
28. T. Linden. Operating System Structures to Support Security and Reliable Software. ACM Computing Surveys, 8(4), December 1976.
29. P. Loscocco and S. Smalley. Integrating Flexible Support for Security Policies into the Linux Operating System. In Proceedings of the FREENIX Track: 2001 USENIX Annual Technical Conference (FREENIX '01), June 2001.
30. P. A. Loscocco, S. Smalley, P. A. Muckelbauer, R. C. Taylor, S. J. Turner, and J. F. Farrel. The Inevitability of Failure: The Flawed Assumptions of Security in Modern Computing Environments. In Proceedings of the 21st National Computer Security Conference, Washington, DC, October 1998.
31. L. W. McVoy and C. Staelin. lmbench: Portable Tools for Performance Analysis. In USENIX Annual Technical Conference, 1996. http://www.bitmover.com/lmbench/.
32. Medusa. World-wide web page available at http://medusa.fornax.sk.
33. Mindcraft. WebStone Standard Web Server Benchmark. http://www.mindcraft.com/webstone/.
34. D. Mosberger and L. L. Peterson. Making Paths Explicit in the Scout Operating System. In Symposium on Operating Systems Design and Implementation (OSDI), pages 153-168, October 1996. http://www.cs.arizona.edu/scout/Papers/osdi96/.
35. G. Nelson. System Programming in Modula-3. Prentice Hall, 1991.
36. Netfilter Core Team. The Netfilter Project: Packet Mangling for Linux 2.4, 1999. http://www.netfilter.org/.
37. A. Ott. The Rule Set Based Access Control (RSBAC) Linux Kernel Security Extension. In Proceedings of the 8th International Linux Kongress, November 2001.
38. C. Pu, T. Autrey, A. Black, C. Consel, C. Cowan, J. Inouye, L. Kethana, J. Walpole, and K. Zhang. Optimistic Incremental Specialization: Streamlining a Commercial Operating System. In Symposium on Operating Systems Principles (SOSP), Copper Mountain, Colorado, December 1995.
39. J. H. Saltzer and M. D. Schroeder. The Protection of Information in Computer Systems. Proceedings of the IEEE, 63(9), November 1975.
40. S. Smalley, T. Fraser, and C. Vance. Linux Security Modules: General Security Hooks for Linux. http://lsm.immunix.org/, September 2001.
41. R. Spencer, S. Smalley, P. Loscocco, M. Hibler, D. Andersen, and J. Lepreau. The Flask Security Architecture: System Support for Diverse Security Policies. In Proceedings of the Eighth USENIX Security Symposium, pages 123-139, Aug. 1999.
42. W. Trumper. Summary about POSIX.1e. http://wt.xpilot.org/publications/posix.1e, July 1999.
43. E. N. Volanschi, C. Consel, G. Muller, and C. Cowan. Declarative Specialization of Object-Oriented Programs. In Proceedings of the Conference on Object-Oriented Programming Systems, Languages, and Applications (OOPSLA'97), Atlanta, GA, October 1997.
44. R. N. Watson. TrustedBSD: Adding Trusted Operating System Features to FreeBSD. In Proceedings of the FREENIX Track: 2001 USENIX Annual Technical Conference (FREENIX '01), June 2001.
45. WireX Communications. Linux Security Module. http://lsm.immunix.org/, April 2001.
46. M. Zelem and M. Pikula. ZP Security Framework. http://medusa.fornax.sk/English/medusa-paper.ps.
47. X. Zhang, A. Edwards, and T. Jaeger. Using CQUAL for Static Analysis of Authorization Hook Placement. In USENIX Security Symposium, San Francisco, CA, August 2002.