Method and system for implementing mandatory file access control in native discretionary access control environments
View Patent ↗A method for implementing a mandatory access control model in operating systems which natively use a discretionary access control scheme. A method for implementing mandatory access control for a plurality of computers, the system comprising information assets, stored as files on the computers, and a network communicatively connecting the computers, wherein each of the computers includes an operating system that uses a discretionary access control policy, and wherein each of a subset of computers includes a software agent component operable to intercept a request for a file operation on a file from a user of one of the computers including the software agent, determining whether the file is protected, if the file is protected, altering ownership of the file from the user to another owner, and providing access based on a mandatory access control policy.
1. A computer system comprising:
a processor;
a discretionary access control (DAC) operating system executing on the processor;
a mandatory access control (MAC) agent configured to implement a mandatory access control (MAC) environment; and
one or more storage devices communicatively coupled to the processor, wherein the processor is configured to:
execute the MAC agent;
receive a request pertaining to accessing a target file stored on the one or more storage devices;
intercept, by the MAC agent, the request for access to the target file;
determine if the target file is subject to a MAC policy;
alter a permission attribute of the target file; and
provide access to the target file in compliance with the MAC policy, the provided access based on the altered permissions.
2. A computer implemented method to enforce mandatory access control (MAC) in a computer system natively using a discretionary access control (DAC) operating system, the method comprising:
receiving a request for a file operation, at a local computer system, wherein the local computer system is executing a DAC operating system and a MAC agent running with system privileges, the DAC operating system using discretionary file access control by default and the MAC agent configured to enforce mandatory file access control;
intercepting, by the MAC agent, the request for the operation;
determining if a file targeted by the file operation should be protected by a MAC policy; and
providing access to the file via the MAC agent wherein providing access comprises altering permissions associated with the target file based on the determination.
3. The method of claim 2 , wherein altering permissions associated with the target file comprises altering an access control list (ACL) associated with the target file.
4. The method of claim 2 , wherein altering permissions associated with the target file comprises altering access permissions of the target file itself.
5. A non-transitory computer readable medium comprising program instructions stored thereon to configure one or more processors to:
receive a request for a the operation, at a local computer system, wherein the local computer system is executing a discretionary access control (DAC) operating system and a mandatory access control (MAC) agent running with system privileges, the DAC operating system using discretionary file access control by default and the MAC agent configured to enforce mandatory file access control;
intercept, by the MAC agent, the request for the file operation;
determine if a file targeted by the file operation should be protected by a MAC policy; and
provide access to the file via the MAC agent wherein providing access comprises altering permissions associated with the target file based on the determination.
6. The non-transitory computer readable medium of claim 5 , wherein the instructions to configure one or more processors to alter permissions associated with the target file comprise instructions to configure one or more processors to alter an access control list (ACL) associated with the target file.
7. The non-transitory computer readable medium of claim 5 , wherein the instructions to configure one or more processors to alter permissions associated with the target file comprise the instructions to configure one or more processors to alter access permissions of the target file itself.
8. The non-transitory computer readable medium of claim 5 , wherein the requested file operation is at least one of creating the file, writing to the file, or closing the file.
9. A non-transitory computer readable medium comprising program instructions stored thereon to configure one or more processors to:
receive a read request for a target file from a process executing for a user associated with a first login session;
intercept the read request at a mandatory access control (MAC) agent configured to implement a mandatory access control policy in a native discretionary access control (DAC) environment;
alter the read request to be associated with a second login session independent of the first login session;
submit the read request using the second login session; receive a result of the read request; and
provide at least a portion of the result to the process,
wherein the first login session does not have read permissions to read the target file and the second login session does have permissions to read the target file.
10. The non-transitory computer readable medium of claim 9 , wherein the first login session and the second login session have different group membership attributes.
11. The non-transitory computer readable medium of claim 10 , wherein the first login session belongs to at least one group that the second login session does not belong to.
12. The non-transitory computer readable medium of claim 9 , wherein the program instructions to configure the one or more processors to provide at least a portion of the result to the process comprise program instructions to configure the one or more processors to provide a file handle to the process.
13. The non-transitory computer readable medium of claim 9 , wherein the program instructions to configure the one or more processors to provide at least a portion of the result to the process comprise program instructions to configure the one or more processors to provide a portion of the contents of the target file to the process.
14. A non-transitory computer readable medium comprising program instructions stored thereon to configure one or more processors to:
receive a read request for a target file from an executing process associated with a first login session and an original group membership;
intercept the read request at a mandatory access control (MAC) agent configured to implement a mandatory access control policy in a native discretionary access control (DAC) environment;
alter the original group membership associated with the first login session to create a new group list;
establish a second login session consistent with the new group list;
submit the read request using the second login session; and
receive a result of the read request,
wherein the first login session does not have read permission to read the target file and the second login session does have permission to read the target file.
15. The non-transitory computer readable medium of claim 14 further comprising program instructions to configure the one or more processors to:
restore the group membership associated with the first login session back to the original group membership.
16. The non-transitory computer readable medium of claim 14 further comprising program instructions to configure the one or more processors to:
terminate the second login session after completing the read request.
17. The non-transitory computer readable medium of claim 14 further comprising program instructions to configure the one or more processors to:
terminate the second login session after completing the read request; and
restore the group membership associated with the first login session to the original group membership.