Maintaining the correct of the Linux Security Modules framework

In this paper, we present an approach, sup-ported by software tools, for maintaining the correctness of the Linux Security Modules (LSM) framework (the LSM community is aiming for inclusion in Linux 2.5). The LSM framework consists of a set of function call hooks placed at locations in the Linux kernel that enable greater control of user-level pro-cesses ’ use of kernel functionality, such as is necessary to enforce mandatory access control. However, the placement of LSM hooks within the kernel means that kernel modifications may inadvertently introduce security holes. Funda-mentally, our approach consists of complemen-tary static and runtime analysis; runtime anal-ysis determines the authorization requirements and static analysis verifies these requirements across the entire kernel source. Initially, the fo-cus has been on finding and fixing LSM errors, but now we examine how such an approach may be used by kernel development commu-nity to maintain the correctness of the LSM framework. We find that much of the verifica-tion process can be automated, regression test-ing across kernel versions can be made resilient to several types of changes, such as source line numbers, but reduction of false positives re-mains a key issue