System and method for file system mandatory access control
View Patent ↗In one embodiment, the present invention is related to a computer system including compartments implemented on an operating system. A database contains access rules with the access rules defining which compartments are authorized to access particular file resources. A kernel module receives a system call to access a file from a user space application belonging to a compartment. A security module determines whether the user space application is authorized to access the file utilizing access rules stored in the database.
1. A method for controlling access to a file by a process, said method comprising:
receiving a request from said process to access said file, said process being associated with a compartment implemented on an operating system;
determining an identifier of said compartment; and
searching for access rules defining whether processes associated with particular compartments are permitted to access certain file resources, said rules retained in a database in a hierarchical manner that parallels a subdirectory structure of a file system containing said file;
wherein said request includes a filename containing a path identifier, said path identifier specifying a plurality of subdirectories, and wherein said step of searching includes the sub-steps of:
(a) searching said database according to a lowest subdirectory of said plurality of subdirectories for an access rule applicable to said compartment;
(b) when an access rule is found in step (a), proceeding to step (e);
(c) searching said database according a next higher subdirectory of said plurality of subdirectories for an access rule applicable to said compartment; and
(d) repeating step (c) until the first event of the following events occurs:
(i) an access rule applicable to said compartment is located;
(ii) said database is searched according to a root directory;
(e) when an access rule applicable to said compartment is located, providing access to said file when said access rule applicable to said compartment allows access.
2. The method of claim 1 wherein said step of searching further comprises:
(f) when an access rule applicable to said compartment is not located, providing access to said file.
3. The method of claim 1 wherein said file is stored on a file system that possesses a subdirectory structure, and wherein said database is structured to retain access rules in a hierarchical manner that parallels the subdirectory structure of said file system.
4. A method for controlling access to a file by a process, said method comprising:
receiving a request from said process to access said file stored in a file system having a subdirectory structure, said process being associated with a compartment implemented on an operating system;
determining an identifier of said compartment;
searching for access rules defining whether processes associated with particular compartments are permitted to access certain file, said rules retained in a database structured in a hierarchical manner that parallels the subdirectory structure; and
if said database does not include an access rule for a subdirectory containing said file, determining permission for said process to access said file according to an access rule for a parent directory of said subdirectory, and accessing said file if permitted.
5. The method of claim 4 , wherein the database does not include an access rule for each subdirectory of the file system.
6. The method of claim 4 , wherein said request includes a filename containing a path identifier specifying a plurality of subdirectories, and wherein the searching includes traversing a linked list structure of the access rules in the database according to the plurality of subdirectories of the path identifier.