IP Library › Granted Patent US 9,641,552
Granted Patent B2
US 9,641,552 · App. 14/754,411 · Granted May 2, 2017

Extending SELinux policy with enforcement of file name translations

Inventors: Eric Paris (Raleigh, NC); Daniel J. Walsh (Marlborough, MA)
Assignee: Red Hat, Inc.
H04L63/20G06F21/00G06F21/6218H04L67/20G06F2221/2141
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 9,641,552
App. No.
14/754,411
Granted
May 2, 2017
Kind
B2
Abstract

An operating system identifies a request of a process to create a new object with a name in a file system of the processing device. The operating system identifies a policy rule applicable to the new object in view of at least the name of the new object. The operating system creates a label for the new object using the applicable policy rule and associates the new object with the created label.

Claims (28)

1. A method comprising:

identifying, by a processing device, a request of a process to create a new object in a file system of the processing device, the new object having a name;

identifying, by the processing device, a policy rule applicable to the new object in view of at least the name of the new object;

creating, by the processing device, a label for the new object using the applicable policy rule in view of at least the name of the new object; and

associating, by the processing device, the new object with the created label.

2. The method of claim 1 , wherein the new object is one of a file, a directory, or a sub-directory.

3. The method of claim 1 , further comprising identifying, by the processing device, a policy rule applicable to the new object using a portion of the name.

4. The method of claim 1 , wherein a parent object pertaining to the new object is a directory.

5. The method of claim 1 , wherein the label for the new object is a label for a mandatory access control mechanism.

6. The method of claim 1 , wherein the policy rule is a file transition rule of policy for a mandatory access control mechanism.

7. A method comprising:

identifying, by a processing device, a request of a process to create a policy for a file system of the processing device, the policy applicable to a plurality of subsequently created new objects on the file system having a name, wherein the policy assigns a label to at least one subsequently created new object of the plurality of subsequently created new objects in view of a label of the process that created the at least one subsequently created new object, a label of a parent object pertaining to the at least one subsequently created new object, a class of the at least one subsequently created new object, and the name of the at least one subsequently created new object; and

associating, by the processing device, the label to the at least one subsequently created new object responsive to the creation of the object.

8. The method of claim 7 , wherein the at least one subsequently created new object is one of a file, a directory, or a sub-directory.

9. The method of claim 8 , wherein the name of the at least one subsequently created new object comprises at least a portion of a path name of the new object.

10. The method of claim 7 , wherein the class of the at least one subsequently created new object is one of a file, a directory, a character file or a block file.

11. The method of claim 7 , wherein the at least a portion of the name is provided by the process.

12. The method of claim 7 , wherein the at least a portion of the name is generated by an operating system.

13. The method of claim 7 , wherein the associated label is a label for a mandatory access control mechanism.

14. A method comprising:

identifying, by a processing device, a request of a process to create a policy for a file system of the processing device, the policy applicable to a plurality of subsequently created new objects on the file system having a name, wherein the policy assigns a label to at least one subsequently created new object of the plurality of subsequently created new objects in view of characteristics comprising a label of the process that created the at least one subsequently created new object, a label of a parent object pertaining to the at least one subsequently created new object, a class of the at least one subsequently created new object, and the name of the at least one subsequently created new object; and

associating, by the processing device, the label to the at least one subsequently created new object in response to the creation of the object.

15. The method of claim 14 , wherein the at least one subsequently created new object is one of a file, a directory, or a sub-directory.

16. The method of claim 14 , wherein the name of the at least one subsequently created new object comprises at least a portion of a path name of the new object.

17. The method of claim 14 , wherein the at least a portion of the name is provided by the process.

18. The method of claim 14 , wherein the at least a portion of the name is generated by an operating system.

19. The method of claim 14 , wherein the associated label is a label for a mandatory access control mechanism.

20. The method of claim 14 , wherein the parent object pertaining to the at least one subsequently created new object is a directory.

Continuity (2)
Continuation 13492388 · Jun 8, 2012
Related Publication 20150304357A1 · Oct 22, 2015