Evaluation of Linux Security Frameworks

• Main Author: Karlsson, Erik
• Format: Others
• Language: English
• Published: Umeå universitet, Institutionen för datavetenskap 2010
• Subjects: Computer Sciences; Datavetenskap (datalogi)
• Online Access: http://urn.kb.se/resolve?urn=urn:nbn:se:umu:diva-36664

  The number of threats to computers attached to networks continually increases. The focus of preventing security exploits has been on the network, while local exploits has been mostly overlooked. Many security problems in Unix systems stem from the way security is managed; by delegating all security decisions to object owners. There are a number of security frameworks which aim to remedy this in Linux by restricting access to kernel objects, such as files. Ericsson is interested in finding the best possible security frameworks for use with their Linux products.In this thesis, the available security frameworks are evaluated based on criteria given by Ericson. First, the theoretical foundation of computer security is explored to serve for an overview of the security frameworks and their properties. Then specific attributes are refined and their values gathered from each framework. These attributes then serve as a basis for selecting two frameworks for further testing.The selected frameworks are  SELinux  and AppArmor, based on commerical support, ease of integration, and overall protection measures. Tables with the collected attributes are presented for comparison.The frameworks  TOMOYO and SMACK  should have been given more consideration. AppArmor is not useful for the server-centric environment used at Ericsson.