TrustedBSD Mandatory Access Control Framework分析

本文分析FreeBSD 10.0【 http://xrefs.info/freebsd-10.0/ 】的MAC Framework的整体流程。

在【/usr/src/sys/security/mac/mac_framework.c】中有如下一段注释，描述了MAC Framework实现的三大功能：

也就是说，1）可以按照不同的安全保护策略，实现不同的策略模块，并通过在<security/mac/mac_policy.h> 中定义的接口向MAC Framework注册；2）各内核子系统可以通过<security/mac/mac_framework.h>中定义的与各子系统相关的接口来请求MAC Framework进行安全判定；3）MAC Framework在接收到安全判定请求时，会循序调用已经注册的各个策略模块的判定函数，实现安全判定；4）提供了用户空间接口用于设置受控资源对象的安全属性（label state）。

MAC代码布局

整体而言，FreeBSD的MAC相关代码位于【/usr/src/sys/security/】目录下面。其中mac目录是框架本身，audit目录是负责安全审计的模块（TrustedBSD Mandatory Access Control Framework分析

时间： 2024-10-25 03:08:27

TrustedBSD Mandatory Access Control Framework分析的相关文章

Enhancing network controls in mandatory access control computing environments

A?Mandatory?Access?Control?(MAC) aware firewall includes an extended rule set for MAC attributes, such as a security label or path. Application labels may be used to identify processes and perform firewall rule-checking. The firewall rule set may inc

Method and system for implementing mandatory file access control in native discretionary access control environments

A method is provided for implementing a mandatory access control model in operating systems which natively use a discretionary access control scheme. A method for implementing mandatory access control in a system comprising a plurality of computers,

Access control differentiation in trusted computer system

A trusted computer system that offers Linux? compatibility and supports contemporary hardware speeds. It is designed to require no porting of common applications which run on Linux, to be easy to develop for, and to allow the use of a wide variety of

A GUIDE TO UNDERSTANDINGDISCRETIONARY ACCESS CONTROL INTRUSTED SYSTEMS

1. INTRODUCTION ? The main goal of the National Computer Security Center is to encourage the widespread availability of trusted computer systems. In support of that goal a metric was created, the Department of Defense Trusted Computer System Evaluati

Browser security standards via access control

A computing system is operable to contain a security module within an operating system. This security module may then act to monitor?access?requests by a web browser and apply?mandatory?access?control?security policies to such requests. It will be ap

Risk Adaptive Information Flow Based Access Control

Systems and methods are provided to manage risk associated with access to information within a given organization. The overall risk tolerance for the organization is determined and allocated among a plurality of subjects within the organization. Allo

Security Access Control Strategy &amp;&amp; Method And Technology Research - 安全访问控制策略及其方法技术研究

catalog 0. 引言 1. 访问控制策略 2. 访问控制方法.实现技术 0. 引言 访问控制是网络安全防范和客户端安全防御的主要策略,它的主要任务是保证资源不被非法使用.保证网络/客户端安全最重要的核心策略之一.访问控制包括 1. 入网访问控制 2. 网络权限控制 3. 目录级控制 4. 属性控制等多种手段 访问控制相关领域知识是CISSP的重要章节,本文将重点讨论访问控制模型.及其相关的方法和技术 0x0: 访问控制概念组成 访问控制涉及到三个基本概念 1. 主体 是一个主动的实体,它包

Extensible Access Control List Framework

Methods, systems, and products for governing access to objects on a filesystem. In one general embodiment, the method includes providing a framework in an operating system environment for support of a plurality of access control list (ACL) types, the

Oracle Applications Multiple Organizations Access Control for Custom Code

文档 ID 420787.1 White Paper Oracle Applications Multiple Organizations Access Control for Custom Code Checked for relevance on 12-JAN-2011 See Change Record This document discusses how to update the customization code that is affected by the access co