Pastures: Towards Usable Security Policy Engineering

Whether a particular computing installation meets its security goals depends on whether the administrators can create a policy that expresses these goals—security in prac-tice requires effective policy engineering. We have found that the reigning SELinux model fares poorly in this regard, partly because typical isolation goals are not directly stated but instead are properties derivable from the type definitions by complicated analysis tools. Instead, we are experiment-ing with a security-policy approach based on copy-on-write “pastures”, in which the sharing of resources between pas-tures is the fundamental security policy primitive. We argue that it has a number of properties that are better from the usability point of view. We implemented this approach as a patch for the 2.6 Linux kernel.