Browse > Article
http://dx.doi.org/10.5392/JKCA.2017.17.04.307

Performance Improvements through Policy Reorganization in SELinux  

Ko, Jae-Yong (충남대학교 컴퓨터공학과)
Choi, Jeong-In (한화시스템(주))
Cho, Kyung-Yeon (충남대학교 컴퓨터공학과)
Lee, Cheol-Hoon (충남대학교 컴퓨터공학과)
Publication Information
The Journal of the Korea Contents Association / v.17, no.4, 2017 , pp. 307-319 More about this Journal
Abstract
SELinux is known as a secure operating system that is easily accessible to users due to the popularization of Linux, and is applied to various security operating system references deployed on systems such as embedded systems and servers. However, if SELinux is applied without considering the performance overhead of activating the SELinux kernel module, the performance of the entire system may be degraded. In this paper, we describe the factors directly affecting the performance inside the SELinux kernel and show that it is possible to improve performance by simply reorganizing the policy without changing the SELinux kernel. This can be used as a reference when security administrators or developers apply SELinux.
Keywords
Secure OS; SELinux; Policy; Overhead; Type Enforcement;
Citations & Related Records
Times Cited By KSCI : 4  (Citation Analysis)
연도 인용수 순위
1 A. Kalyanasundaram, B. B. Roy, and S. Rao, "Exploiting Data Parallelism in SELinux Using a Multicore Processor," in Proceedings of the 47th Annual National Convention of Computer Society of India (CSI), 2012.
2 Haines, Richardm, The selinux notebook, 2014.
3 김정녀, 손승원, 이철훈, "안전한 운영체제 접근 제어 정책에 대한 보안성 및 성능시험," 정보처리학회논문지, Vol.10, No.5, pp.773-780, 2003.
4 고영웅, "보안 운영체제의 오버헤드 분석," 한국컴퓨터정보학회, Vol.10, No.2, pp.11-19, 2005.
5 Yuichi Nakamura and Yoshiki Sameshima, "SELinux for consumer electronics devices," 2008 Linux Symposium, 2008.
6 Bjorn Vogel and Bernd Steinke, "Using selinux security enforcement in linux-based embedded devices," Proceedings of the 1st international conference on MOBILe Wireless MiddleWARE, Operating Systems, and Applications, ICST (Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering), 2008.
7 Toshihiro YOKOYAMA, Miyuki HANAOKA, Makoto SHIMAMURA, and Kenji KONO, Takahiro SHINAGAWA, "Reducing security policy size for internet servers in secure operating systems," IEICE transactions on information and systems, 2009.
8 Vikhyath Rao and Trent Jaegerm, "Dynamic mandatory access control for multiple stakeholders," Proceedings of the 14th ACM symposium on Access control models and technologies, 2009.
9 Leandro Fiorin, "Security enhanced linux on embedded systems: A hardware-accelerated implementation," 17th Asia and South Pacific Design Automation Conference, IEEE, 2012.
10 이재서, 김민수, 노봉남, "SELinux 보안 정책 복잡성 개선을 위한 보안 정책 설정 도구," 정보보호학회지, 제19권, 제2호, pp.43-52, 2009.
11 https://fedoraproject.org/wiki/SELinux/Policies
12 https://github.com/TresysTechnology/refpolicy
13 https://fedoraproject.org/wiki/SELinux/checkpolicy
14 https://github.com/SELinuxProject/selinux
15 https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security-Enhanced_Linux/S/Red_Hat_Enterprise_Linux/6/html/Security-Enhanced_Linux/
16 이상길, 이승율, 이철훈, "리눅스 사용자 영역에 실시간성 제공을 위한 미들웨어," 한국콘텐츠학회논문지, 제16권, 제5호, pp.217-228, 2016.   DOI
17 이상길, 이철훈, "멀티프로세서 기반 리눅스에 실시간성 지원 방안 연구," 한국콘텐츠학회 종합 학술대회 논문집, pp.57-58, 2015.
18 김주만, 송창인, 이철훈, "RTiK-Linux: 리눅스용 실시간 이식 커널의 설계," 한국콘텐츠학회논문지, 제11권, 제9호, pp.45-53, 2011.   DOI
19 Frank Mayer, Karl Macmillan, and David Caplan, SELinux by Example, 2006.
20 http://www.crypt.gen.nz/selinux/faq.html#0.1
21 정재엽, 박성종, 임재석, 이철훈, "임무컴퓨터를 위한 고가용 시스템의 구현 및 성능분석," 한국콘텐츠학회논문지, 제8권, 제8호, pp.47-56, 2008.   DOI
22 https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/4/html/SELinux_Guide/rhlcommon-section-0104.html