SELinux安全机制和安全目的研究

SELinux在Linux中实现了高强度但又灵活的强制访问控制(MAC)体制，提供基于机密性和完整性的信息隔离．能对抗欺骗和试图旁路安全机制的威胁．限制了因恶意代码和应用程序缺陷造成的危害。SELinux支持多种安全策略模型，支持策略的灵活改变．使用类型裁决和基于角色的访问控制来配置系统。文章给出了SELinux体系结构和安全模型，表述了安全加强的Linux是如何支持策略的灵活性和如何配置访问控制策略来满足通用操作系统的安全要求．

Research of SElinux Security Policy and Security Object

SELinux can implement highly strong and flexible compulsive MAC system, can provide information isolation with secrecy and integrality, and can prevent from deceivability and bypass trying security system, and can limit the harm due to vicious codes and defect of the application program. SELinux supports several kinds of security strategy model and flexible modification of strategy. It uses type enforcement and access control based on role to configure system. In this article, the system structure and security model of SELinux is presented. In addition, I described how security enforced Linux can support strategy flexibility and how to satisfy the operation system's security requirement by configuring control strategy.