Apparatus and method for automatically generating SELinux security policy based on selt

An apparatus for automatically generating a SELinux (Security Enhanced Linux) security policy based on SELT (SELinux Template), the apparatus comprising:

• a testing module for preparing process generation by receiving execution file names of a program destined for policy generation;
• a tracing module for storing a system call log traced by generating a process by executing the received execution file of the program after the process generation is prepared by the testing module;
• a parsing module purifying the traced system call log into data necessary for generation of a security policy;
• a normalizing module grouping objects in consideration of the relationship between the objects based on information purified by the parsing module;
• a recording module for recording a normalized data structure in a system in an SELT description language format using a security policy file;
• and
• a verifying module for detecting duplication and collision between the SELT security policy generated by the recording module and the previous security policy in the system.

A method for automatically generating a SELinux (Security Enhanced Linux) security policy based on SELT (SELinux Template), the method comprising:

• preparing process generation by receiving execution file names of a program destined for policy generation;
• storing a system call log traced by generating a process by executing the received execution file of the program;
• purifying the traced system call log into data necessary for generation of a security policy;
• grouping objects in consideration of the relationship between the objects based on purified information;
• and
• recording a normalized data structure in a system in an SELT description language format using a security policy file.

An apparatus for automatically generating a SELinux (Security Enhanced Linux) security policy based on SELT (SELinux Template), the apparatus comprising:

• a testing module for preparing process generation by receiving execution file names of a program destined for policy generation;
• a tracing module for storing a system call log traced by generating a process by executing the received execution file of the program after the process generation is prepared by the testing module;
• a parsing module purifying the traced system call log into data necessary for generation of a security policy;
• a normalizing module grouping objects in consideration of the relationship between the objects based on information purified by the parsing module;
• and
• a recording module for recording a normalized data structure in a system in an SELT description language format using a security policy file.