SELinux Documentation

Researchers in the National Information Assurance Research Laboratory of the National Security Agency (NSA) worked with Secure Computing Corporation (SCC) to develop a strong, flexible mandatory access control architecture based on Type Enforcement, a mechanism first developed for the LOCK system. The NSA and SCC developed two Mach-based prototypes of the architecture: DTMach and DTOS. The NSA and SCC then worked with the University of Utah's Flux research group to transfer the architecture to the Fluke research operating system. During this transfer, the architecture was enhanced to provide better support for dynamic security policies. This enhanced architecture was named Flask. The NSA integrated the Flask architecture into the Linux® operating system to transfer the technology to a larger developer and user community. The architecture has been subsequently mainstreamed into Linux and ported to several other systems, including the Solaris™ operating system, the FreeBSD® operating system, and the Darwin kernel, spawning a wide range of related work.

Two papers provide background information for the project:

• The Inevitability of Failure: The Flawed Assumption of Security in Modern Computing Environments explains the need for mandatory access controls in operating systems.
• The Flask Security Architecture: System Support for Diverse Security Policies describes the operating system security architecture through its prototype implementation in the Fluke research operating system.

The documentation for the security-enhanced Linux consists of papers and presentations describing the goals, design, implementation and policy configuration of the project. There are also a number of external resources for SELinux documentation, such as the resources linked from http://selinuxproject.org, and there are a number of external papers and talks published on http://selinuxsymposium.org.

Published Papers & Technical Reports

To access our published papers and technical reports, please visit the

Research Publications section of the Digital Media Center

Presentations

• SELinux: Information Assurance Through Partnership 2007 SELinux Symposium Keynote Author(s): Richard C. Schaeffer, Jr (NSA)
• What's New with SELinux 2007 SELinux Symposium Author(s): Stephen D. Smalley (NSA)
• Using GConf as an Example of How to Create an Userspace Object Manager 2007 SELinux Symposium Author(s): James Carter (NSA)
• Application of the Flask Architecture to the X Window System Server 2007 SELinux Symposium Author(s): Eamon Walsh (NSA)
• A Mechanism for Risk Adaptive Access Control (RAdAC) 2007 SELinux Symposium Author(s): Machon Gregory (NSA)
• BOF presentation 2006 Ottawa Linux Symposium Author(s): Stephen D. Smalley (NSA)
• SELinux Year in Review 2006 SELinux Symposium Author(s): Stephen D. Smalley (NSA)
• Integrating Flexible Support for Security Policies into the Linux Operating System 2005 SELinux Symposium Author(s): Stephen D. Smalley (NSA)
• Implementing SELinux Support for NFS 2005 SELinux Symposium Author(s): James Carter (NSA)
• BOF presentation 2004 Ottawa Linux Symposium Author(s): Stephen D. Smalley (NSA)
• Extensible Security For X: Motivation and Design 2004 X Window System Developers Conference Author(s): Eamon Walsh (NSA)
• BOF Presentation 2003 Ottawa Linux Symposium Author(s): Stephen D. Smalley (NSA)
• Meeting Critical Security Objectives with Security-Enhanced Linux Paper Presentation 2001 Ottawa Linux Symposium Author(s): Peter A. Loscocco (NSA), Stephen D. Smalley (NAI Labs)
• Presentation on SELinux 2001 Linux 2.5 Kernel Summit Author(s): Peter A. Loscocco (NSA)

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
FreeBSD® is a registered trademark of the FreeBSD Foundation.
Solaris™ and OpenSolaris™ are trademarks or registered trademarks of Sun Microsystems, Inc in the United States and other countries.
Secure Computing® is a registered trademark of Secure Computing Corporation