Starting from the 5.0 Lollipop release all Android processes must be run inside confined SEAndroid access control domains. As a result, Android device manufacturers were compelled to develop SEAndroid expertise in order to create policies for their device-specific components. In this paper we analyse SEAndroid policies from a number of 5.0 Lollipop devices on the market, and identify patterns of common problems we found. We also suggest some practical tools that can improve policy design and analysis. We implemented the first of such tools, SEAL.
Some researchers have applied information visualization techniques to SELinux policy analysis @cite_12 , also in combination with clustering @cite_14 . These techniques are also system-agnostic, and we may use them in future SEAndroid tools.
@cite_14 @cite_12
2033223116 109885913 2116860113 1969848899
Performing SELinux policy analyses can be difficult due to the complexity of the policy language and the sheer number of policy rules and attributes involved. For example, the default policy on most SELinux-enabled systems has over 1; 500; 000 flat rules, involving over 1; 780 types. Simple analyses between types can result in a large amount of data, which is poorly presented to administrators in existing analysis tools. We propose and implement a policy analysis tool “SEGrapher” that addresses the above challenges. SEGrapher visually presents analysis results as a simplified directed graph, where nodes are types, and edges are corresponding policy rules between types. Graphs are generated via a proposed clustering algorithm that clusters types based on their accesses. Clusters provide an abstraction layer that removes undesired data, and focuses on analysis attributes specified by the administrator. Analyzing and administrating system security policies is difficult as policies become larger and more complex every day. The paper present work toward analyzing security policies and sessions in terms of security properties. Our intuition was that combining both visualization tools that could benefit from the expert's eyes, and software analysis abilities, should lead to a new interesting way to study and manage security policies as well as users' sessions. Rather than trying to mine large and complex policies to find possible flaws within, work may concentrate on which potential flaws are really exploited by attackers. Actually, the paper presents some methods and tools to visualize and manipulate large SELinux policies, with algorithms allowing to search for paths, such as information flows within policies. The paper also introduces a complementary original approach to analyze and visualize real attack logs as session graphs or information flow graphs, or even aggregated multiple-sessions graphs. Our wishes is that in the future, when those tools will be mature enough, security administrator can then confront the statical security view given by the security policy analysis and the dynamical and real-world view given by the parts of attacks that most often occurred. In this paper, we present a systematic way to determine the information flow security goals achieved by systems running a secure O S, specifically systems running Security-Enhanced Linux. A formalization of the access control mechanism of the SELinux security server, together with a labeled transition system representing an SELinux configuration, provides our framework. Information flow security goal statements expressed in linear temporal logic provide a clear description of the objectives that SELinux is intended to achieve. We use model checking to determine whether security goals hold in a given system. These formal models combined with appropriate algorithms have led to automated tools for the verification of security properties in an SELinux system. Our approach has been used in other security management contexts over the past decade, under the name rigorous automated security management. SELinux can enforce a policy based on mandatory access control (MAC) for Linux so as to fulfill the security requirements of more strict access control for those hierarchical and classified management organizations or situations. But security policy configuration is a hard and intractable task for SELinux due to its recondite policy description language and huge number of complicated security policies. Thereafter, it is rather significant to build a powerful assistant tool to help security managers to perform security policy configurations. And the key problem is to analyze configured security policies automatically or semi-automatically so that as many configuration loopholes as possible can be detected and then be eliminated. In this paper, both security models and policy description language supported by SELinux are summarized at first. While methods for analyzing security policies are discussed in details secondly. Then a prototype for a tool to analyze security policies automatically is designed, implemented and tested as well as some preliminary test results are given. Finally, the research work in this paper is summed up and some further research directions are pointed out.