Mandatory access control with Tomoyo Linux

High Sheriff

Article from ADMIN 09/2012

By Tim Schürmann

The Tomoyo Linux security module locks each process away into a separate jail, monitors all of the process's actions, and even helps with debugging, if so desired. Unlike other security solutions, Tomoyo is fairly easy to manage.

Contrary to what you might think, Tomoyo Linux [1] is not a full-fledged Linux distribution, it is a kernel module for Linux that monitors active processes directly and restricts their access and actions as needed (Mandatory Access Control, MAC). Additionally, it has a couple of command-line tools that help administrators configure Tomoyo. Security rules define what a process is allowed or not allowed to do; you can either create these rules manually or allow Tomoyo Linux to determine the rules in a semi-automatic learning mode. In this mode, Tomoyo monitors a program for a while and allows actions it sees during that time – all other actions are denied.

Versionitis

Back in 2003, Japan's NTT Data Corporation (a subsidiary of Japanese telecommunications giant Nippon Telegraph and Telephone, NTT) created a kernel patch that was capable of controlling processes and monitoring their behavior. If you wanted to use this first version of Tomoyo, you thus had to build your own kernel.

Starting with kernel version 2.6.0, security modules were supposed to use the standardized Linux Security Modules (LSMs) [2], which were created specifically for this purpose and which are also used by other popular security systems, such as SELinux, AppArmor, and SMACK.

Integration with the official kernel was an interesting prospect, so the Tomoyo developers changed their module to use the LSM interface. Because it would have been necessary to extend the LSM interface to port all of the Tomoyo Linux features, the developers opted for an approach that involved administrative action and much confusion. Now there are two versions of Tomoyo with different feature sets. The initial version of Tomoyo is still available and offers the complete feature set. When this issue went to press, this was version

...

Use Express-Checkout link below to read the full article (PDF).