Research and Implementation on Process Access Control Based on SELinux Mandatory Access Control

针对云主机常用的Linux服务器系统屡屡出现因为常用服务或进程的自身漏洞被利用而导致系统控制权轻易丢失的问题，文章提出了一种基于SELinux强制访问控制的进程权限控制系统（PBACS），可对系统内的文件、进程及服务等进行细粒度的访问权限控制，能有效缓解由于常见系统服务漏洞导致的安全威胁，具有较高的安全性和先进性。文章对PBACS进行了全面的功能测试和性能测试，测试结果表明PBACS完全达到了设计要求，可以在系统进程层面提供更细的访问控制颗粒度。该方案能够广泛应用到云主机环境下Linux服务器系统的安全加固场景中。In face of the problem that the vulnerabilities of the common service or process in the Linux system are used to cause the system control to be easily lost, the paper proposes a process access control based on SELinux mandatory access control (PBACS), which can do fine-grained access control for files, processes and services, and can effectively mitigate security threats that caused by the vulnerabilities of system services, thus makes the server system more secure. The paper gives functional test and performance test on PBACS. Test result shows that PBACS meets design requirements, and can provide lower access control granularity in system process level. PBACS can be widely applied to reinforce Linux server system.国家自然科学基金中国科技核心期刊(ISTIC)1234-4