Evaluation of Linux Security Frameworks
نویسندگان
چکیده
The number of threats to computers attached to networks continually increases. The focus of preventing security exploits has been on the network, while local exploits has been mostly overlooked. Many security problems in Unix systems stem from the way security is managed; by delegating all security decisions to object owners. There are a number of security frameworks which aim to remedy this in Linux by restricting access to kernel objects, such as files. Ericsson is interested in finding the best possible security frameworks for use with their Linux products. In this thesis, the available security frameworks are evaluated based on criteria given by Ericsson. First, the theoretical foundation of computer security is explored to serve for an overview of the security frameworks and their properties. Then specific attributes are refined and their values gathered from each framework. These attributes then serve as a basis for selecting two frameworks for further testing. The selected frameworks are SELinux and AppArmor, based on commerical support, ease of integration, and overall protection measures. Tables with the collected attributes are presented for comparison. The frameworks TOMOYO and SMACK should have been given more consideration. AppArmor is not useful for the server-centric environment used at Ericsson.
منابع مشابه
Security considerations related to the use of mobile devices in the operation of critical infrastructures
An increasing number of attacks by mobile malware have begun to target critical infrastructure assets. Since malware attempts to defeat the security mechanisms provided by an operating system, it is of paramount importance to understand the strengths and weaknesses of the security frameworks of mobile device operating systems such as Android. Many recently discovered vulnerabilities suggest tha...
متن کاملConnecting SCADA Systems to Corporate IT Networks Using Security-Enhanced Linux
Substation networks have traditionally been isolated from corporate Information Technology (IT) networks. Hence, the security of substation networks has depended heavily upon limited access points and the use of point-to-point Supervisory Control and Data Acquisition (SCADA) specific protocols. With the introduction of Ethernet into substations, pressure to reduce expenses and provide Internet ...
متن کاملAndroid Security Framework: Enabling Generic and Extensible Access Control on Android
We introduce the Android Security Framework (ASF), a generic, extensible security framework for Android that enables the development and integration of a wide spectrum of security models in form of codebased security modules. The design of ASF reflects lessons learned from the literature on established security frameworks (such as Linux Security Modules or the BSD MAC Framework) and intertwines...
متن کاملEvaluation of Performance of Secure OS Using Performance Evaluation Mechanism of LSM-Based LSMPMON
Security focused OS (Secure OS) is attracting attention as a method for minimizing damage caused by various intrusions. Secure OSes can restrict the damage due to an attack by using Mandatory Access Control (MAC). In some projects, secure OSes for Linux have been developed. In these OSes, different implementation methods have been adopted. However, there is no method for easily evaluating the p...
متن کاملAutoscopy: Detecting Pattern-Searching Rootkits via Control Flow Tracing
Traditional approaches to rootkit detection [24] [45] [25] [34] assume the execution of code at a privilege level below that of the operating system kernel, with the use of virtual machine technologies to enable the detection system itself to be immune from the virus or rootkit code. In this thesis, we approach the problem of rootkit detection from the standpoint of tracing and instrumentation ...
متن کامل