-
Welcome
-
Subscribe to
Proposals
Smack and the Application Ecosystem
*Excerpt
Our sample application is a commercial database server. It provides database services over the network using TCP connections. The security goal we're using Smack to address is the isolation of the database files from the users on the server.
We'll cover two different ways to provide access to the database, allowing either remote or local users access to the services of the database while protecting the database itself.
Description
This talk provides an overview of the requirements, challenges, and progress of bringing the promise of the Simplified Mandatory Access Contorl Kernel (Smack) to user space. The talk uses a well known commercial application as an example of both how using Smack can add value and how it can be done. The talk covers modest changes that make applciations more friendly in a Smack environment. Additionally, the implications of adding Smack support to the Xorg server as a policy enforcing application are covered.
There is a brief overview of Smack and its design goals to ensure no one gets lost. This includes Mandatory Access Control, Smack interfaces, and the security model. Networking receives special attention due to the importance it plays in application deployment.
Tags
Mandatory Access Control
Speaker
-
Casey Schaufler
The Smack Project- Website: http://schaufler-ca.com/
Biography
Casey Schaufler founded the Smack project in 2006 after an
especially heated debate with the SELinux developers on a
topic now long forgotten. He has been developing secure operating systems since the late 1980’s, starting the system that became Trusted Solaris and architecting Trusted Irix. He was the technical editor for the influential POSIX P1003.1e/2c security draft standard and worked as a member of the Trusted Systems Interoperability Group (TSIG), the source of the CIPSO IP protocol option. His development group at SGI proposed the initial LSM implementation.
