文档介绍：A Security Policy Configuration for the Security-Enhanced Linux
Stephen Smalley, NAI Labs, sds@
Timothy Fraser, NAI Labs, tfraser@
February 2001
Contents 6 Constraints Configuration 18
1 Introduction 1 7 Security Context Configuration 18
Initial SID Contexts . . . . . . . . . . . . 19
2 Overview 2 File System Contexts . . . . . . . . . . . 19
Contexts . . . . . . . . . . . . . 19
3 TE Configuration 3
Global Macros . . . . . . . . . . . . . . 3 8 File Contexts 19
Class and Permission Macros . . 3
Rule Macros . . . . . . . . . . . 4 9 Extensions for Installing 20
Type Attributes . . . . . . . . . . . . . . 5
General Types . . . . . . . . . . . . . . . 6 1 Introduction
Security Types . . . . . . . . . . 6 The National Security Agency’s Information Assur-
Device Types . . . . . . . . . . . 6 ance Research Office is integrating a flexible manda-
File Types . . . . . . . . . . . . . 7 tory access control architecture called Flask into the
Procfs Types . . . . . . . . . . . 9 Linux operating system [1]. The Secure Execution En-
Devpts Types . . . . . . . . . . . 9 vironments (SEE) group at NAI Labs is developing a
Role-Based Access Control (RBAC) and Type Enforce-
NFS Types . . . . . . . . . . . . 9
ment (TE) security policy configuration for this security-
Types . . . . . . . . . . 9 enhanced Linux system using the security policy config-
Domains . . . . . . . . . . . . . . . . . . 10 uration language described in [1, Sec ]. This configu-
Every Domain . . . . . . . . . . 10 ration draws from a preliminary configuration developed
System Domains . . . . . . . . . 11 by puting Corporation and from the prior
Domain and Type Enforcement (DTE) configuration de-
User Program Domains . . . . . . 14
veloped by the SEE group [2]. The configuration also
User Login Domains . . . . . . . 16 includes contributions by researcher