SEFlow SEFlow can be use the SELinux technology on controlling the data flow inside an information processing system.
Download

SEFlow Ranking & Summary

SEFlow Tags

data flow SELinux SELinux technology control data flow information processing

SEFlow Description

SEFlow can be use the SELinux technology on controlling the data flow inside an information processing system. SEFlow can be use the SELinux technology on controlling the data flow inside an information processing system. While the SELinux policies most commonly found focus on controlling access to static system facilities like an httpd or a system logger, SEFlow is meant to secure the data itself, whose location inside the system is dynamic.Technologymathematical policy model: SEFlow tries to model the policy using mathematical primitives. The core aims to be able to combine small sub-policies by computing operations like unions, intersections and cartesian products between them, making a more orthogonal approach to policy design possible. Possible applicationslicense management: In a sufficiently large development environment, there is often a large pool of data governed under a variety of licenses to be combined to create the final product. It becomes important to keep track of the different licenses. This can conveniently be done by adding licensing information to the security contexts of the files. This way, the operating system kernel can keep track of what licensing conditions apply to the resulting data.strategic approach to security: Using the license management described above, it becomes possible to employ a mechanism similar to the tainting mechanism of the Linux kernel on the operating system layer. Critical system facilities can be constrained to interference by open source data, thereby ensuring better possibilities for investigating and fixing possible problems.State of the projectPlease note that the applications described above are not possible yet. The project is currently in a state of prototyping and could serve as a technology demo. What you can do now is to look at the already existing code and to experiment with it. There is the possibility to create a minimal policy which does not provide any security but instead makes it easy to extend upon it. Computing cartesian products of sub-policies is also working. The provide_sandbox macro can be used as a facility to test the security contexts without interfering with the running system.Requirements:· NSA Security-enhanced LinuxWhat's New in This Release:· To demonstrate the possibility of combining independent policy factors, a factor that blocks network access was created.· This way, network access of processes can be disabled without interfering with other constraints.

SEFlow Related Software