00001: V*This file is automatically generated.Do not edit.* 00002: static char *initial_sid_to_string[]= 00003: 00004: "null", 00005: "kernel", 00006: "security", 00007: "unlabeled", 00008: "fs”, 00009: "file", 00010: "file labels", 00011: "init" 00012: "any_ ocket" 00013: port", 00014: "netif", 00015: "netmsg", 00016: "node", 00017: "igmp_packet", 00018: "icmp_socket", 00019: "tcp_socket", 00020: sysctl_modprobe" 00021: sysctl", 00022: sysctl_fs", 00023: sysctl_kernel", 00024: 'sysctl_net", 00025: "sysctl_net_unix", 00026: sysctl_vm", 00027: "sysctl_dev", 00028: "kmod", 00029: "policy", 00030: "scmp_packet", 00031: "devnull", 天统实验室 00032: STEM LABORATORY ADVANCED STUDY OF USTC
对象的生命期 冬根据生命期的不同，liux中的对象分成2种 transient objects and persistent objects *transient objects >通常是一些内核数据结构，例如：进程 > SELinux使用memory-resident table进行SID和安全上下 文的映射关系 00024: struct sidtab{ 00025: struct sidtab node **htable; 00026: unsigned int nel;/number of elements 00027: unsigned int next_sid;/next SID to allocate 00028: unsigned char shutdown; 00029: spinlock_t lock; 00030: }； 00031: 00012: struct sidtab_node{ 00013: u32 sid; /security identifier * 00014: struct context context;/security context structure 00015: struct sidtab node *next; ,系统实验室 00016: SYSTEM LABORATORY HOU INSTITUTE FON ADYANCED STUDY OF USTC
对象的生命期 ❖根据生命期的不同，linux中的对象分成2种 ➢transient objects and persistent objects ❖transient objects ➢通常是一些内核数据结构，例如：进程 ➢SELinux使用memory-resident table进行SID和安全上下 文的映射关系
00658: /米米 00659: security_sid_to_context-Obtain a context for a given SID. 00660: @sid:security identifier,SID 00661:@scontext:security context 00662:@scontext len:length in bytes 00663: 米 00664:Write the string representation of the context associated with @sid 00665: into a dynamically allocated string of the correct size.Set @scontext 00666:to point to this string and set @scontext_len to the length of the string. 00667: */ 00668: int security_sid_to_context(u32 sid,char **scontext,u32 *scontext_len) 00669: vof Science and Technolog 嵌入式系统实验室 EMBEDDED SYSTEM LABORATORY SUZHOU INSTITUTE FON ADVANCED STUDY OF USTC
persistent objects >例如文件、目录 >SELinuxi利用文件系统来存放永久安全描述符PSID ●例如，利用ext2/ext3的扩展属性 >在最初安装SELinux时，要为文件创建PSID ●labelingi进程利用setfile进行 Setfile根据一个称为file context的数据库进行 ●File context为一些特殊文件定义了初始安全上下文；为其他 文件定义了缺省的安全上下文 Science and Technol 嵌入式系统实验室 EMBEDDED SYSTEM LABORATORY SUZHOU INSTITUTE FON ADVANCED STUDY OF USTC
❖persistent objects ➢例如文件、目录 ➢SELinux利用文件系统来存放永久安全描述符PSID ⚫例如，利用ext2/ext3的扩展属性 ➢在最初安装SELinux时，要为文件创建PSID ⚫labeling进程利用setfile进行 ⚫Setfile根据一个称为file context的数据库进行 ⚫File context为一些特殊文件定义了初始安全上下文；为其他 文件定义了缺省的安全上下文
Access Decisions The SELinux security server makes two basic kinds of decisions: >Access decisions Transition decisions,also called labeling decisions 1958 h 嵌入式系统实验室 EMBEDDED SYSTEM LABORATORY SUZHOU INSTITUTE FON ADVANCED STUDY OF USTC
Access Decisions ❖The SELinux security server makes two basic kinds of decisions: ➢Access decisions ➢Transition decisions, also called labeling decisions