基于SELinux的三权分离技术的研究  

Research on the Separation of Privilege Based on SELinux

作　　者：杨霞[1,2] 石鹏[1] 杨姗[1] 任飞 

机构地区：[1]电子科技大学信息与软件工程学院,成都610054 [2]保密通信重点实验室,成都610041

出　　处：《电子科技大学学报》2016年第6期958-963,共6页Journal of University of Electronic Science and Technology of China

基　　金：国家核高基重大专项(M1401060112ZX0103301);国家科技支撑计划(2012BAH44F00)

摘　　要：随着Linux操作系统的广泛使用,由于root权限过大所暴露出来的安全问题逐步被引起关注。针对Linux操作系统的特权管理问题,首先建立了三权分离安全模型,将Linux系统中的特权用户分解为系统管理员、安全管理员、审计管理员3个不同的管理员角色。然后,基于SELinux的强制访问控制技术设计并实现了三权分离机制和安全策略,对每个管理员的权限进行细粒度划分和严格的访问控制。最后,基于嵌入式平台实现了一个实验原型系统,验证了三权分离方法的正确性和可行性。该方法可广泛应用于Linux操作系统,以提高系统的安全性。With the widespread use of Linux operating systems, security problems is gradually exposed and become a hot topic because of excessive root privileges. To solve this problem and enhance security of Linux operating system, firstly, we model the separation of privilege, which divides the privilege of Linux system into three roles, system administrator, security administrator, and auditor. Then, this paper designs and implements the separation of privilege mechanism based on the SELinux＇s mandatory access control technology, which can define fine-grained permissions and security policy for each role and control user＇s access strictly. Finally, we implement a prototype system based on the embedded platform, which verifies the correctness and feasibility of our approaches presented in this paper. These approaches presented in this paper can be used in Linux operating system to enhance system security.

关 键 词：强制访问控制技术 安全模型 安全策略 SELINUX 三权分离技术 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]