The National Security Agency (NSA) released Security-Enhanced Linux (SELinux) in December of 2000 under the General Public License (GPL). An integration of the Flask mandatory access control (MAC) architecture with Linux, SELinux provides a flexible mechanism to enforce the separation of information based on confidentiality and integrity requirements. This integration of MAC mechanisms into a mainstream operating system has allowed the NSA to transfer such security concepts to a wider community and demonstrate their viability. SELinux addresses the threats of tampering and the bypass of application security mechanisms, and can strictly confine any damage caused by malicious or flawed applications.
The MITRE Corporation has been involved with the SELinux project since 2000, beginning with the modification of several user utilities to provide SELinux-related information to the user. Since then, MITRE's contribution to the SELinux community has been two-fold: development of individual application policies (roughly between 2000 and 2002), and the design and development of SELinux policy management tools.
The MITRE policy generation tools, polgen, provide a systematic way to generate policy for programs on an SELinux system. Specifically, polgen attempts to generate policy for a program based on patterns in the program's behavior. The policy that polgen suggests is tailored to the behavior of the program and includes suggestions for new system types when appropriate to support least-privilege on an SELinux system. This process is predictable and repeatable, but interactive. The user, presented with a suggested policy description, can modify that description before actual policy is produced. The current version of polgen is included here.
Please subscribe to our mailing lists, polgen-devel or polgen-user. MITRE has written other SE Linux tools, including an information flow analyzer.
Last modified: Tue Feb 27 16:16:14 EST 2007