The CDS Framework Toolkit concepts are translated into SELinux security policy. This section described how CDS Framework concepts relate into SELinux policy.
The CDS Framework definition of a domain differs from the SELinux concept of domain types, which are simply types associated with processes. Furthermore, SELinux domains cannot be decomposed.
Shared resources are similar to SELinux object classes, but shared resources are a higher-level concept. A single shared resource may contain any number of system object classes (files, pipes, sockets, etc.) that together represent a single conceptual resource. For example, a definition of the shared resource unixStreamSockets would include permissions on the directory containing the sock_files, permissions on the actual sock_files and permissions on the unix_stream_sockets.
There is no concept of decomposing domains in SELinux policy.
SELinux provides significantly more granular forms of access permission than read, write, and readwrite, although most SELinux permissions imply information flow in one or both directions. To translate to the more granular permissions in SELinux the CDS Framework Toolkit must map its simple access categories to the more complex SELinux object class permissions. For example, both random access writing and appending to a file can both be characterized as a write in terms of information flow but are treated differently in SELinux policy. As a further example, for the resource definition unixStreamSockets, write access may be defined in SELinux as the ability to create sock_files in a directory, set up unix stream sockets, and the ability to delete sock_files within a directory. The CDS Framework Toolkit dictionary file supplies the detailed mappings of simple read, write, and readwrite accesses in the CDS Framework language and translating them to the more complex SELinux Policy language.
SELinux Reference Policy is the underlying type enforcement policy used by SELinux. Base Domains and Base Resources provide an abstracted way to interface with Reference Policy modules.
Entry Points relate to the concept of domain transitions in SELinux.
Control Resources are so closely coupled with a domain that SELinux actually assigns the same label to these resources as the domain itself.
©2005 - 2008 Tresys Technology, LLC
Patent Pending