在Linux中实现域和类型访问控制

Implementing the Domain and Type Enforcement for Linux

安全域隔离是对安全操作系统的基本要求。通过安全域划分,可以限制用户和进程对资源的访问,从而将恶意攻击对系统的影响控制在最小范围之内。文章阐述了安全域隔离在红旗安全Linux中的构建机制——域和类型访问控制,并对其具体实现进行了简要介绍。

Separate secure domain is the basic requirement for secure OS.By separating secure domain for every process and every user,we can restrict the impact of hostile attack into the minimal level.In this paper,domain and type enforcement which is a type of separate secure domain is put forward and implemented in RedFlag secure Linux.