Extending SELinux policy with enforcement of file name translation
AssigneeRed Hat, Inc.
InventorsEric Paris, Daniel J. Walsh
Life of this patent
Estimating the term…
Abstract
An operating system identifies a request of a process to create, in a file system of the computing device, a new object, the new object having a name. The operating system identifies a policy rule applicable to the new object using a label of the process, a label of a parent object pertaining to the new object, a class of the new object, and the name of the new object. The operating system creates a label for the new object using the applicable policy rule and associates the new object with the associated label.
Claims21
A method comprising:
- identifying, by a processing device, a request of a process to create a new object in a file system of the processing device, the new object having a name;
- identifying, by the processing device, a policy rule applicable to the new object in view of parameters for a label of the process, a label of a parent object pertaining to the new object, a class of the new object, and the name of the new object;
- creating, by the processing device, a label for the new object using the applicable policy rule in view of the parameters;
- and
- associating, by the processing device, the new object with the created label.
A method comprising:
- receiving, by a processing device, user input identifying a label of a process, a class of a new object to be created by the process, a label of a parent object pertaining to the new object, and a name of the new object;
- defining a policy rule for creating a label of the new object in view of parameters for the label of the process, the class of the new object, and the label of the parent object and the name of the new object;
- compiling the policy rule using a policy language compiler;
- and
- creating an operating system package using the compiled policy rule.
A system comprising:
- a processing device to:
- identify, by the processing device, a request of a process to create a new object in a file system of the processing device, the new object having a name;
- identify, by the processing device, a policy rule applicable to the new object in view of parameters for a label of the process, a label of a parent object pertaining to the new object, a class of the new object, and the name of the new object;
- create, by the processing device, a label for the new object using the applicable policy rule in view of the parameters;
- and
- associate, by the processing device, the new object with the created label.
A non-transitory computer readable storage medium comprising instructions to cause a processing device to:
- identify, by the processing device, a request of a process to create a new object in a file system of the processing device, the new object having a name;
- identify, by the processing device, a policy rule applicable to the new object in view of parameters for a label of the process, a label of a parent object pertaining to the new object, a class of the new object, and the name of the new object;
- create, by the processing device, a label for the new object using the applicable policy rule in view of the parameters;
- and
- associate, by the processing device, the new object with the created label.
Dependencies are inferred from the claim text.