Pastures: Towards Usable Security Policy Engineering

Sergey Bratus, Alex Ferguson, Doug McIlroy, Sean Smith
2007 The Second International Conference on Availability, Reliability and Security (ARES'07)  
Whether a particular computing installation meets its security goals depends on whether the administrators can create a policy that expresses these goals-security in practice requires effective policy engineering. We have found that the reigning SELinux model fares poorly in this regard, partly because typical isolation goals are not directly stated but instead are properties derivable from the type definitions by complicated analysis tools. Instead, we are experimenting with a security-policy
more » ... pproach based on copy-on-write "pastures", in which the sharing of resources between pastures is the fundamental security policy primitive. We argue that it has a number of properties that are better from the usability point of view. We implemented this approach as a patch for the 2.6 Linux kernel.
doi:10.1109/ares.2007.114 dblp:conf/IEEEares/BratusFMS07 fatcat:qrk6xdxffzhzdhzrm3iuboz6um