Meeting Critical Security Objectives with Security-Enhanced Linux

Security-enhanced Linux incorporates a strong, flex­ ible mandatory access control architecture into Linux. It provides a mechanism to enforce the sep­ aration of information based on confidentiality and integrity requirements. This allows threats of tam­ pering and bypassing of application security mech­ anisms to be addressed and enables the confine­ ment of damage that can be caused by malicious or flawed applications. Using the system’s type enforcement and role-based access control abstrac­ tions, it is possible to configure the system to meet a wide range of security needs. This paper describes how Security-enhanced Linux was used to meet a number of general-purpose system security objec­ tives.