The Reference Policy project is an effort to restructure the NSA example policy for SELinux, which has evolved through many years of community involvement and is the basis for nearly all sample SELinux Policy in use today. The Reference Policy is rigorously structured using modularity, layering, encapsulation, and abstraction, making it simpler to maintain, modify, and use. The goal of this restructuring is to allow greater adaptation and adoption of SELinux while maintaining the knowledge gained through the years of policy evolution, while increasing our ability to validate the security properties of a given SELinux policy. 1. Motivations When expressing security goals for an application in an Security Enhanced Linux (SELinux) policy, it is impor- tant to have a strong foundation to build upon. The problem with the sample policy that evolved from the original NSA policy (1) is that the policy is difficult to understand, develop, and maintain unless you are inti- mately familiar with the SELinux enforcement mecha- nism and the policy language. In the example policy, source files have loose structure and policy modules are closely coupled. A policy writer must have detailed knowledge of most if not the entire policy in order to use it as a basis for new application policy modules. Creating third-party modules is difficult, requiring de- tailed understanding of type, role, user, attributes, etc. definitions throughout the entire policy. While most policies in use today, e.g., (2) (3), are based on the original NSA sample policy, the single largest com- plaint about SELinux is that writing policy is too diffi- cult and complex. Tresys started the Reference Policy (4) project to re- factor the community knowledge gained through evolu- tion of the NSA example policy, into a form that exhib- its many of the strengths and features of modern soft- ware engineering, thereby making the policy more maintainable, verifiable, and useable.
更多
分享
引用
