基于有色Petri网的SELinux安全策略自动化分析

SELinux是嵌入到Linux内核中并得到推广应用的安全增强模块。由于其安全策略配置复杂且工作量较大,故而研究相关的安全策略辅助配置手段及SELinux安全策略的自动化分析方法与技术很有必要。本文基于有色Petri网建立了SELinux安全策略的自动化分析模型,给出了原型实现和测试结果。相关结果表明,有色Petri网分析方法和对应原型能较好地完成SELinux安全策略的有效性分析,并可实现带有中间过滤类型的信息流查询且更加方便简洁。

Automation Analysis of SELinux Security Policy Based on Colored Petri-net

SELinux is a typical security-enhanced module in Linux. But it is hard to configure SELinux for large amounts of security policies. Therefore it＇ s necessary to develop a tool to analyze the security policies automatically, which can be potentially used for SELinux security policy configuration. In this paper, a model for automatic analysis of SELinux security policies based on colored petri-net is build and corresponding prototype is designed and implemented. Test results show that the prototype can perform effectiveness analysis task very well. Moreover, it can do queries about information flows including in-between filtering types simply and conveniently.