一种新的Capability实现机制

A Novel Realization Mechanism for Capability in Trusted Operating System

1 引言 信息安全,除CPU、编译器和网络安全外,最重要的组成部分就是操作系统的安全核心.POSIX.1e[1]和POSIX.2c[2]分别定义了操作系统安全核心中可选的(alternative)和附加的(additional)安全机制Capability(命令与系统功能调用控制),MAC (Mandatory Access Control,强制访问控制),Audi (Security Auditing,安全审计),ACL(Access Control Lists,访问控制表),IL(Information Labeling,信息标签)的C接口和shell命令接口.但是对各种安全机制的精确语义和完全实现机制未做出定义.此外,文[1,2]还允许对各种安全机制所包含的内容进行扩充.

Generally the realization of the capability in trusted OS needs rewriting lots of the kernel code related to the syscalls. This paper introduces a new kind of realization mechanism for the trusted OS capability. Using the mechanism,not only the root user is removed,the root privileges are decomposed and can be issued to the common user,but also some user rights such as calling the syscall and taking use of shell commands related to root privilege,and the processes requesting the syscall,etc. can be controlled by system secure capability set. The new realization mechanism of the capability doesn't change lots of the kernel code and has been implemented successfully on Linux-based trusted OS.