In the evolution of Android, the Mandatory Access Control (MAC) at the level of Linux kernel is assuming a central role. In the commonly used Discretionary Access Control (DAC), every resource has an owner that defines who can access the resource. In the MAC schema, instead, the access privileges are defined in a global policy, that is enforced by the kernel. Only the system administrator can change the policy, thus preventing many security threats coming from malicious or misbehaving applications. SELinux is the MAC that has been integrated into Android since version 4.3. Nevertheless it is currently used only to protect system resources from threats originating from applications. Much research studied how to integrate SELinux access control checks into more system components. AppPolicyModules [1] allow developers to ship an SELinux module along with the application or to derive an ad-hoc one based on the permissions requested in the application manifest. This improves the protection of the application resources and permits the realization of the classical least privilege principle. The project SeSQLite [2] integrates SELinux into SQLite databases, both at schema and row level. SQLite is widely used in Android even for system components. SeSQLite permits to state that a contact’s phone number is more sensitive than the e-mail, even if they are in the same table. Finally, SEIntentFirewall [3] leverages SELinux to filter the Intents that an application can send to other applications or to system services. These improvements tighten the security of Android, providing better protection for the system. BODY The Android security ecosystem can greatly benefit from a deeper integration of SELinux Mandatory Access Control into system components.

The exponential growth of modern information systems has introduced several new challenges in the management of security requirements. Nowadays, the technological scenario has evolved and the introduction of MAC models provides a better isolation among software components and reduces the damages that the malicious or defective ones can cause to the systems. On one hand it is important to confine applications and limit the privileges that they can request. On the other hand we want to let applications benefit from the flexibility given by MAC models, such as SELinux. In this paper we show how the constructs already available in SELinux and the specialization of security domains can be leveraged to define boundaries where the applications are confined but still able to introduce sophisticated security patterns, such as application isolation and the least privilege principle. After defining the proposed model, we describe how it can be integrated into real systems through the use of examples on Android and Apache Web Server.

SQLite is the most widely deployed in-process library that implements a SQL database engine. It offers high storage efficiency, fast query operation and small memory needs. Due to the fact that a complete SQLite database is stored in a single cross-platform disk file and SQLite does not support multiple users, anyone who has direct access to the file can read the whole database content. SELinux was originally developed as a Mandatory Access Control (MAC) mechanism for Linux to demonstrate how to overcome DAC limitations. However, SELinux provides per-file protection, thus the database file is treated as an atomic unit, impeding the definition of a fine-grained mandatory access control (MAC) policy for database objects. We introduce SeSQLite, an SQLite extension that integrates SELinux access controls into SQLite with minimal performance and storage overhead. SeSQLite implements labeling and access control at both schema level (for tables and columns) and row level. This permits the management of a fine-grained access policy for database objects. A prototype has been implemented and it has been used to improve the security of Android Content Providers.

Android has recently introduced the support for Mandatory Access Control, which extends previous security services relying on the Android Permission Framework and on the kernel-level Discretionary Access Control. This extension has been obtained with the use of SELinux and its adaptation to Android (SEAndroid). Currently, the use of the MAC model is limited to the protection of system resources. All the apps that are installed by users fall in a single undifferentiated domain, untrusted_app. We propose an extension of the architecture that permits to associate with each app a dedicated MAC policy, contained in a dedicated appPolicyModule, in order to protect app resources even from malware with root privileges. A crucial difference with respect to the support for policy modules already available in some SELinux implementations is the need to constrain the policies in order to guarantee that an app policy is not able to manipulate the system policy. We present the security requirements that have to be satisfied by the support for modules and show that our solution satisfies these requirements. The support for appPolicyModules can also be the basis for the automatic generation of policies, with a stricter enforcement of Android permissions. A prototype has been implemented and experimental results show a minimal performance overhead for app installation and runtime.

The wide adoption of Docker and the ability to retrieve images from different sources impose strict security constraints.Docker leverages Linux kernel security facilities, such as namespaces, cgroups and Mandatory Access Control, to guarantee an effective isolation of containers.In order to increase Docker security and flexibility, we propose an extension to the Dockerfile format to let image maintainers ship a specific SELinux policy for the processes that run in a Docker image, enhancing the security of containers.

SQLite is the most widely deployed in-process library that implements a SQL database engine. It offers high storage efficiency, fast query operation and small memory needs. Due to the fact that a complete SQLite database is stored in a single cross-platform disk file and SQLite does not support multiple users, anyone who has direct access to the file can read the whole database content. SELinux was originally developed as a Mandatory Access Control (MAC) mechanism for Linux to demonstrate how to overcome DAC limitations. However, SELinux provides per-file protection, thus the database file is treated as an atomic unit, impeding the definition of a fine-grained mandatory access control (MAC) policy for database objects.

Solutions like SELinux have recently regenerated interest toward Mandatory Access Control (MAC) models. The role of MAC models can be expected to increase in modern systems, which are exposed to significant threats and manage high-value resources, due to the stronger protection they are able to offer. Android is a significant representative of these novel systems and the integration of MAC models is an important recent development in its security architecture. Opportunities indeed exist to further enrich the support offered by MAC models, increasing their flexibility and integrating them with other components of the system. We discuss a number of proposals that have recently been made in this domain. First, we illustrate the integration of SELinux and SQLite, named SeSQLite, which permits to apply MAC permissions at a fine granularity into relational databases, offering both a schema-level and row-level support. Then, AppPolicyModules are presented, which let app developers specify extensions to the system-level policy that protect the resources of each specific app. Finally, an integration between SELinux and the interprocess communication services is proposed, to further regulate the cooperation among separate apps and services. All these enhancements lead to a stronger and more detailed support of the complex security requirements that characterize modern environments.

The support for Mandatory Access Control offered by SELinux has become a significant component of the security design of the Android operating system, offering robust protection and the ability to support system-level policies enforced by all the elements of the system. A well-known security-sensitive aspect of Android that currently SELinux does not cover is the abuse of intents, which represent the Android approach to inter-process communication. We propose SEIntentFirewall, an SELinux intent manager that provides fine-grained access control over Intent objects, permitting to cover within MAC policies the use of intents.

To protect Android users, researchers have been analyzing unknown, potentially-malicious applications by using systems based on emulators, such as the Google's Bouncer and Andrubis. Emulators are the go-to choice because of their convenience: they can scale horizontally over multiple hosts, and can be reverted to a known, clean state in a matter of seconds. Emulators, however, are fundamentally different from real devices, and previous research has shown how it is possible to automatically develop heuristics to identify an emulated environment, ranging from simple flag checks and unrealistic sensor input, to fingerprinting the hypervisor's handling of basic blocks of instructions. Aware of this aspect, malware authors are starting to exploit this fundamental weakness to evade current detection systems. Unfortunately, analyzing apps directly on bare metal at scale has been so far unfeasible, because the time to restore a device to a clean snapshot is prohibitive: with the same budget, one can analyze an order of magnitude less apps on a physical device than on an emulator. In this paper, we propose BareDroid, a system that makes bare-metal analysis of Android apps feasible by quickly restoring real devices to a clean snapshot. We show how BareDroid is not detected as an emulated analysis environment by emulator-aware malware or by heuristics from prior research, allowing BareDroid to observe more potentially malicious activity generated by apps. Moreover, we provide a cost analysis, which shows that replacing emulators with BareDroid requires a financial investment of less than twice the cost of the servers that would be running the emulators. Finally, we release BareDroid as an open source project, in the hope it can be useful to other researchers to strengthen their analysis systems.

Current IT systems consist usually of several components and services that communicate and exchange data over the Internet. They have security requirements that aim at avoiding information disclosure and at showing compliance with government regulations. In order to effectively handle the security management of complex IT systems, techniques are needed to help the security administrator in the design and configuration of the security architecture. We propose a model-driven security approach for the design and generation of concrete security configurations for software architectures. In our approach the system architect models the architecture of the system by means of UML class diagrams, and then the security administrator adds security requirements to the model by means of Security4UML, a UML profile. From the model enriched with security requirements, the concrete security configuration is derived in a semi-automated way. We present a tool that supports this model-driven approach, and a case study that involves a distributed multi-user meeting scheduler application.

Tools are needed to support the analysis of the security policies, and a crucial element that signals problems in the policies is represented by the presence of conflicts (contradictions or ambiguities in the policy specification, which may lead to anomalies in the application of the policy). Several types of conflict can be identified. Each type has recently been the subject of significant investigation, and several approaches and techniques have been examined for their detection and management. Rather than presenting exhaustive coverage, the chapter seeks to identify common approaches to identification of security conflicts, considering three relevant scenarios: access control policies, policy execution, and network protection. The chapter focuses on detection of the conflicts. Limited attention is given to ways to manage a detected conflict. The basic assumption of the chapter is that the security administrator is notified of each detected conflict and that he will have the responsibility to choose the correct approach to manage the conflict. In large policies, the number of notifications can be quite large, and the need arises to have tools that automatically manage conflicts by introducing corrections to the policy that follow a specific optimization criterion. We give only limited attention to this aspect.

The evolution of information systems sees an increasing need of flexible and sophisticated approaches for the automated detection of anomalies in security policies. One of these anomalies is redundancy, which may increase the total cost of management of the policies and may reduce the performance of access control mechanisms and of other anomaly detection techniques. We consider three approaches that can remove redundancy from access control policies, progressively reducing the number of authorizations in the policy itself. We show that several problems associated with redundancy are NP-hard. We propose exact solutions to two of these problems, namely the Minimum Policy Problem, which consists in computing the minimum policy that represents the behaviour of the system, and the Minimum Irreducible Policy Problem, consisting in computing the redundancy-free version of a policy with the smallest number of authorizations. Furthermore we propose heuristic solutions to those problems. We also present a comparison between the exact and heuristics solutions based on experiments that use policies derived from bibliographical databases.

The widespread diffusion of Android OS has led to a rapid explosion of the Google Play store (previously Android Market). As of 2011, the Play store includes more applications than the Apple App Store. It is natural to compare this growth to what happened years ago in the area of the World Wide Web, although in the second case, the need was to allow users to interact and collaborate in a more easy way (e.g., social network), while now the need is to try to use the same device everywhere (e.g., office, home) and for everything (e.g., work, free time). This reflects the rising concept of “Bring Your Own Device” (BYOD). In this vision, University of Bergamo decided to develop its own Android application (named MyUniBG) in order to provide to their students and staff members advanced features (e.g., information about lessons hours and course details). In this paper, we want to highlight how, thanks to the support provided by Eclipse framework, we can make a step toward the “BYOD vision”. The aim of the tool is to ease the notification (e.g., variations in lessons hours) using Google Cloud Messaging for Android, a service that allows you to send data from your server to your users’ Android-powered device, and also to receive messages from devices on the same connection. The tool, implemented as an Eclipse RAP plug-in, will provide two main functionalities: (a) “push” information to the community of devices (communication server-client), and (b) “pop” notifications from a device and share this information with others. In this scenario, MyUniBG app will be extended in order to be the front-end for the new features.

The design of efficient and effective techniques for security policy analysis is a crucial open problem in modern information systems. Significant attention has been dedicated in the past to the use of logical tools for the analysis of security policies, but this work has produced a limited impact on enterprise information systems. Important reasons of the limited success of past research were the difficult integration of these approaches with the technological scenario and the limited scalability of many proposals. Nowadays Semantic Web tools are increasingly used in modern information systems. We show how the tools provided by Semantic Web and ontology management technologies offer an adequate basis for the realization of techniques able to support conflict analysis in security policies. Based on the use of these techniques, we propose a solution for two different variants of conflict analysis: (a) Policy Incompatibility, and (b) Separation of Duty Satisfiability. Experiments that test the techniques on large security policies demonstrate the scalability of the approach.

In this paper we want to show how the Eclipse platform can offer very interesting support and be an adequate infrastructure in the realization of a software environment for the design and development of security policies. The efficient and effective design of security policies for modern information systems is a crucial open problem, important and at the same time quite difficult. The lifecycle of a company-wide security system is complex. Its correct management requires conceptual depth, with the ability to describe the security configuration at different abstraction levels, from a representation that is near to the way security requirements arise from business applications, to the concrete configuration of the security components that characterizes the implementation of the system. Also, information systems present a large variety of securityenabled tools and devices, each one tailored to a specific task and operating on a specific representation of a system subset, and a correct security management environment has to be able to cover as many of them as possible. Ideally, an integrated security management environment should provide interoperability among all the security tools and assist the user in such a complex job. In such a scenario, Eclipse is able, with its open source technology and its flexible architecture, to support the realization of such systems, facilitating the integration among the separate models required to describe the security configuration of a heterogeneous system. For instance, formal ontologies can be easily integrated and they can be used for the definition of the involved models, with clear benefits in terms of automatization of model definition and control.