基于LSM架构对Linux文件系统进行安全性增强

Security-Enhancement of Linux File System Based on LSM framework

Linux内核只提供了经典的UNIX自主访问控制。Linux安全模块(LSM)是Linux内核的一个轻量级通用访问控制框架,它使得各种不同的安全访问控制模型能够以Linux可加载内核模块的形式实现出来。首先对Linux安全模块(LSM)的实现机制和接口进行了介绍,然后提出了一种对Linux文件系统的基于LSM架构的强访问控制增强,同时改进了LSM机制引入了多级安全策略的机制。

Linux kernel only provides classical Unix discretionary access control.Linux security module(LSM) is a general framework of lightweight access control for Linux kernel.LSM makes it possible for different modules of security access control to be implemented in the forms of Linux kernel loadable modules.This paper introduces the implementation mechanism and interfaces of Linux security module(LSM).Then a mandatory access control method for Linux file system and a multi-level security mechanism are provided based on LSM.