Starting from the 5.0 Lollipop release all Android processes must be run inside confined SEAndroid access control domains. As a result, Android device manufacturers were compelled to develop SEAndroid expertise in order to create policies for their device-specific components. In this paper we analyse SEAndroid policies from a number of 5.0 Lollipop devices on the market, and identify patterns of common problems we found. We also suggest some practical tools that can improve policy design and analysis. We implemented the first of such tools, SEAL.
Formal methods have been used for SELinux policy analysis. Gokyo @cite_21 is a policy analysis tool designed to identify and resolve conflicting policy specifications. Usage of the HRU security model @cite_6 has been proposed as an approach to SELinux policy analysis @cite_18 . Information flow analysis has been applied to SELinux policies @cite_20 . These analysis methods are not SELinux-specific, and can be easily adapted to SEAndroid.
@cite_18 @cite_21 @cite_20 @cite_6
154231405 2033223116 1969848899 2116860113
In this paper, we present an approach for analyzing the integrity protection in the SELinux example policy. The SELinux example policy is intended as an example from which administrators customize to create a policy for their site's security goals, but the complexity of the model and size of the policy make this quite complex. Our aim is to provide an access control model to express site security goals and resolve them against the SELinux policy. Ultimately, we aim to define a minimal trusted computing base (TCB) that satisfies Clark-Wilson integrity, by first testing for the more restrictive Biba integrity policy and resolving conflicts using Clark-Wilson semantics. Our policy analysis tool, Gokyo, implements the following approach: (1) it represents the SELinux example policy and our integrity goals; (2) it identifies conflicts between them; (3) it estimates the resolutions to these conflicts; and (4) provides information for deciding upon a resolution. Using Gokyo, we derive a proposal for a minimal TCB for SELinux includes 30 subject types, and we identify the work remaining to ensure that TCB is integrity-protected. Our analysis is performed on the SELinux example policy for Linux 2.4.19. Performing SELinux policy analyses can be difficult due to the complexity of the policy language and the sheer number of policy rules and attributes involved. For example, the default policy on most SELinux-enabled systems has over 1; 500; 000 flat rules, involving over 1; 780 types. Simple analyses between types can result in a large amount of data, which is poorly presented to administrators in existing analysis tools. We propose and implement a policy analysis tool “SEGrapher” that addresses the above challenges. SEGrapher visually presents analysis results as a simplified directed graph, where nodes are types, and edges are corresponding policy rules between types. Graphs are generated via a proposed clustering algorithm that clusters types based on their accesses. Clusters provide an abstraction layer that removes undesired data, and focuses on analysis attributes specified by the administrator. SELinux can enforce a policy based on mandatory access control (MAC) for Linux so as to fulfill the security requirements of more strict access control for those hierarchical and classified management organizations or situations. But security policy configuration is a hard and intractable task for SELinux due to its recondite policy description language and huge number of complicated security policies. Thereafter, it is rather significant to build a powerful assistant tool to help security managers to perform security policy configurations. And the key problem is to analyze configured security policies automatically or semi-automatically so that as many configuration loopholes as possible can be detected and then be eliminated. In this paper, both security models and policy description language supported by SELinux are summarized at first. While methods for analyzing security policies are discussed in details secondly. Then a prototype for a tool to analyze security policies automatically is designed, implemented and tested as well as some preliminary test results are given. Finally, the research work in this paper is summed up and some further research directions are pointed out. In this paper, we present a systematic way to determine the information flow security goals achieved by systems running a secure O S, specifically systems running Security-Enhanced Linux. A formalization of the access control mechanism of the SELinux security server, together with a labeled transition system representing an SELinux configuration, provides our framework. Information flow security goal statements expressed in linear temporal logic provide a clear description of the objectives that SELinux is intended to achieve. We use model checking to determine whether security goals hold in a given system. These formal models combined with appropriate algorithms have led to automated tools for the verification of security properties in an SELinux system. Our approach has been used in other security management contexts over the past decade, under the name rigorous automated security management.