WO2022183912A1 - 一种强制访问控制mac方法及相关设备 - Google Patents

一种强制访问控制mac方法及相关设备 Download PDF

Info

Publication number
WO2022183912A1
WO2022183912A1 PCT/CN2022/076569 CN2022076569W WO2022183912A1 WO 2022183912 A1 WO2022183912 A1 WO 2022183912A1 CN 2022076569 W CN2022076569 W CN 2022076569W WO 2022183912 A1 WO2022183912 A1 WO 2022183912A1
Authority
WO
WIPO (PCT)
Prior art keywords
subject
perform
access
security
security policy
Prior art date
Application number
PCT/CN2022/076569
Other languages
English (en)
French (fr)
Inventor
钱锋
王磊
邝继欧
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP22762378.2A priority Critical patent/EP4293552A1/en
Publication of WO2022183912A1 publication Critical patent/WO2022183912A1/zh
Priority to US18/459,593 priority patent/US20230409729A1/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/45—Structures or tools for the administration of authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices

Definitions

  • the present application relates to the field of communication technologies, and in particular, to a mandatory access control (English: mandatory access control, MAC for short) method and related equipment.
  • a mandatory access control English: mandatory access control, MAC for short
  • a security module is added to the operating system, and the security module implements mandatory access control to the operating system.
  • the security-enhanced Linux (English: Security-Enhanced Linux, SELinux) in the Linux operating system improves the security of Linux; for another example, the SEAndroid in the Android (English: Android) operating system improves the security of Android.
  • the security module adopts the MAC mechanism to manage one or some operations that the subject (or process) in the operating system accesses the object (or resource) to perform.
  • the security policy (English: security policy)
  • Rules pre-set in the object limit the operations that the subject can access the object to perform.
  • the security module works in the enforcing mode, the subject is denied access to the object; if the security module works in the permission ( English: permissive) mode, the subject is allowed to access the object and perform the operation.
  • the above MAC mechanism performs the same control on the behavior of all the subjects to access the object to perform the operation, and there are many problems.
  • the embodiments of the present application provide a mandatory access control MAC method and related equipment.
  • the security module can flexibly determine that the subject accesses an object to perform an operation on the premise of ensuring security. Whether the behavior of performing an operation should be allowed or denied improves the flexibility and security of the MAC mechanism.
  • the operating system may be an operating system that performs MAC based on a security tag, for example, may be a Linux-based operating system, an Android-based operating system, or an Apple operating system. If the operating system is a Linux operating system, the security module in the operating system can be SELinux; if the operating system is an Android operating system, the security module in the operating system can be SEAndroid.
  • an embodiment of the present application provides a MAC method, which is applied to a security module in an operating system.
  • the MAC method may include, for example: accessing a first object when a first subject When performing the first operation, if the security module determines based on the security policy that the first subject does not have the authority to access the first object to perform the first operation, but the first object is configured in permissive mode, the first subject can be allowed to access the first object. object and perform the first operation.
  • the security module can flexibly determine whether the subject's access to the object to perform the operation should be allowed or denied according to whether the object is configured with the permissive mode, which improves the flexibility of the MAC mechanism. and security.
  • the security policy of combing omits the authority of the subject to access the object to perform the operation
  • the subject can also be configured to be in permissive mode to ensure that the subject can access the object and execute the operation. This operation ensures that the business including the subject accessing the object to perform the operation runs normally and will not be interrupted.
  • the security module can sort out the security policy based on the object, and set the object that requires open permissions to the permissive mode.
  • the security policy (English: security policy) includes different rules, and the types of rules include but are not limited to: the security label of each subject, the security label of each object, the authority of the subject to access the object to perform operations (such as allow (English: allow) rule) and the rule that the object type corresponding to the configuration object is permissive mode.
  • the security policy in the security module includes a first rule, and the first rule indicates that the first object works in a permissive mode.
  • the object type corresponding to the first object is os_dev_t
  • the first rule included in the security policy may be: permissive os_dev_t, which is used to indicate that all objects corresponding to os_dev_t are configured in permissive mode, thus indicating that the first object is configured as permissive mode.
  • the security module when the security module is configured in the permissive mode according to the first object, the first subject is allowed to access the first object and perform the first operation, then, after allowing the first subject to access the first object and perform the first operation Afterwards, the security module may further generate a first log, where the first log is used to record information associated with the first subject accessing the first object to perform the first operation.
  • the security module can analyze and understand the security of the operating system and the completeness and accuracy of the security policy based on the recorded logs.
  • the security module may further improve the security policy through verification or testing. As an example, if, through verification or testing, it is determined that the behavior of the first subject accessing the first object to perform the first operation is a safe access behavior, it is determined from the security policy that the first subject does not have access due to the omission in sorting out the security policy. The first object has the right to perform the first operation, then the security module can update the security policy so that the updated security policy includes a second rule indicating that the first subject is allowed to access the first object to perform the first operate.
  • the first rule can be deleted from the security policy, In this way, when the behavior of the first subject accessing the first object to perform the first operation occurs again, it is not only determined based on the security policy that the first subject does not have the right to access the first object to perform the first operation, but also determines that the first object does not have the right to access the first object to perform the first operation.
  • the configuration is in the permissive mode, so that the first subject is denied access to the first object to perform the first operation, thereby ensuring the security of the operating system. In this way, by improving the security policy, when a subsequent behavior of the first subject accessing the first object to perform the first operation occurs, the behavior can be accurately processed according to the improved security policy.
  • the MAC method may further include: when the second subject accesses the second object to perform the second operation, if the security module determines based on the security policy that the second subject does not access the second object to perform the second operation and the second object is not configured in permissive mode, then the second subject is denied access to the second object to perform the second operation.
  • the security policy of the security module some non-critical objects in the operating system can be configured in permissive mode to achieve loose access to non-critical objects; in order to ensure the security of the operating system, critical objects may not be configured or sufficient
  • the verified objects are permissive mode, thus realizing the mandatory protection of these objects.
  • the security module may further generate a second log, where the second log is used to record the information associated with the second subject accessing the second object to perform the second operation.
  • the security module can analyze and understand the security of the operating system and the completeness and accuracy of the security policy based on the recorded logs.
  • the embodiments of the present application also provide another MAC method, which is applied to a security module in an operating system.
  • the MAC method may include, for example: when the first subject accesses the first When an object is used to perform the first operation, if the security module determines based on the security policy that the first subject does not have the right to access the first object to perform the first operation, but the first object or the first subject is configured in enforcing mode, it can be rejected The first subject accesses the first object to perform the first operation.
  • the security module flexibly determines whether the subject's access to the object to perform the operation should be allowed or denied according to whether the subject or object is configured with the enforcing mode, which improves the flexibility of the MAC mechanism. sex and safety.
  • the security module when the security module sorts out the security policy, it can sort out based on the object or subject, and set the subject or object that needs to be forcibly refused to be executed as the enforcing mode, so as to ensure the security enhancement effect of the security module on the operating system, without the need for comprehensive
  • the permissions of all subjects to access objects to perform operations are sorted into the security policy, which reduces the workload of sorting out the security policy.
  • the security module can support the enforcing mode of the subject in the security policy, or the enforcing mode of the object in the security policy, but in order for the security module to effectively control the permissions based on the security policy, the security module usually does not support the subject at the same time. and the enforcing mode of the object.
  • the security policy may include a first rule that instructs the first subject to operate in the enforcing mode. Then, when the security policy supports the enforcing mode of the subject, after it is determined that the first subject does not have the right to access the first object to perform the first operation, it can be determined that the first subject is denied access to the first subject according to the first subject being configured in the enforcing mode. object to perform the first operation.
  • the security policy may also include a second rule, the second rule instructs the first object to work in the enforcing mode.
  • the security policy supports the enforcing mode of the object, after it is determined that the first subject does not have the right to access the first object to perform the first operation, it may be determined that the first subject is denied access to the first object according to the first object being configured in the enforcing mode. object to perform the first operation.
  • the method may further include: generating a third log, where the third log is used to record that the first subject accesses the first object to execute the described Information associated with the first operation.
  • the third log may be a system log
  • the method may also include: generating a fifth log, where the fifth log is used to record information associated with the first subject accessing the first object to perform the first operation.
  • the fifth log may be a system log
  • the security policy can also be further refined through verification or testing. As an example, if, through verification or testing, it is determined that the behavior of the first subject accessing the first object to perform the first operation is a safe access behavior, it is determined from the security policy that the first subject does not have access due to the omission in sorting out the security policy. The first object has the right to perform the first operation, then the security module can update the security policy so that the updated security policy includes a third rule indicating that the first subject is allowed to access the first object to perform the first operate. In this way, by improving the security policy, when a subsequent behavior of the first subject accessing the first object to perform the first operation occurs, the behavior can be accurately processed according to the improved security policy.
  • the MAC method may further include: when the second subject accesses the second object to perform the second operation, if the security module determines the second object based on the security policy If the subject does not have the right to access the second object to perform the second operation, and the second object is not configured in the enforcing mode, the second subject is allowed to access the second object and perform the second operation.
  • the MAC method may further include: when the second subject accesses the second object to perform the second operation, if the security module determines based on the security policy that the second subject does not access the second subject The object has the right to perform the second operation, and the second subject is not configured in the enforcing mode, then the second subject is allowed to access the second object and perform the second operation.
  • some non-critical subjects or objects in the operating system can be configured in enforcing mode to achieve loose access to non-critical subjects or objects; in order to ensure the security of the operating system, key Subjects and objects (or well-verified subjects and objects) are enforcing mode, thus realizing the mandatory protection of these subjects and objects.
  • the security module when the security module allows the second subject to access the second object and perform the second operation according to the second object or the second subject is not configured in the enforcing mode, then, after allowing the second subject to access the second object and perform the second operation After the second operation is performed, the security module may further generate a system log for recording information associated with the second subject accessing the second object to perform the second operation.
  • the present application provides a communication device, which is applied to a security module in an operating system, and the communication device works in a mandatory enforcing mode.
  • the communication apparatus may include, for example, a first processing unit and a second processing unit.
  • a first processing unit configured to determine, based on a security policy, that the first subject does not have the authority to access the first object to perform the first operation when the first subject accesses the first object to perform the first operation, The first object is configured in a permissive mode;
  • a second processing unit is configured to allow the first subject to access the first object and perform the first operation.
  • the security policy includes a first rule, and the first rule instructs the first object to work in the permissive mode.
  • the communication apparatus further includes: a third processing unit.
  • the third processing unit is configured to generate a first log after allowing the first subject to access the first object and perform the first operation, where the first log is used to record that the first subject accesses all information associated with the first object to perform the first operation.
  • the communication apparatus further includes: a fourth processing unit.
  • the fourth processing unit is configured to update the security policy, the updated security policy includes a second rule, and the second rule indicates that the first subject is allowed to access the first object to execute the first operation.
  • the communication apparatus further includes: a fifth processing unit.
  • the fifth processing unit is configured to delete the first rule from the security policy.
  • the first processing unit is further configured to determine that the second subject does not access the second object based on the security policy when the second subject accesses the second object to perform the second operation the permission to execute the second operation, wherein the second object is not configured in a permissive mode; the second processing unit is further configured to deny the second subject to access the second object to execute the first Second operation.
  • an embodiment of the present application further provides another communication device, where the communication device is applied to a security module in an operating system, and the communication device works in a permissive mode.
  • the communication apparatus may include, for example, a first processing unit and a second processing unit.
  • a first processing unit configured to determine, based on a security policy, that the first subject does not have the authority to access the first object to perform the first operation when the first subject accesses the first object to perform the first operation, The first subject or the first object is configured in a mandatory enforcing mode; and a second processing unit is configured to deny the first subject access to the first object to perform the first operation.
  • the security policy includes a first rule, the first rule instructs the first subject to work in the enforcing mode; or, the security policy includes a second rule, the second rule Instructs the first object to operate in the enforcing mode.
  • the communication apparatus further includes: a third processing unit.
  • the third processing unit is configured to update the security policy, the updated security policy includes a third rule, and the third rule indicates that the first subject is allowed to access the first object to execute the first operation.
  • the first processing unit is further configured to determine that the second subject does not access the second object based on the security policy when the second subject accesses the second object to perform the second operation to perform the second operation, wherein the second object is not configured in the enforcing mode; the second processing unit is configured to allow the second subject to access the second object and the second subject and perform the second operation.
  • the present application provides a communication device, the communication device includes a memory and a processor; the memory is used for storing a program code; the processor is used for running the instructions in the program code, so that The communication device executes the method described in any one of the first aspect and the first aspect above, or causes the communication device to execute the method described in any one of the second aspect and the second aspect above.
  • the present application provides a computer-readable storage medium, where instructions are stored in the computer-readable storage medium, which, when executed on a computer, cause the computer to perform the above first aspect and any of the first aspects.
  • the present application provides a computer program product, including a program that, when the program runs on a processor, implements the first aspect and the method described in any one of the first aspects, or implements the above-mentioned first aspect.
  • the present application provides a server, where program codes are stored in the server, and when the program codes are run by a processor, the above first aspect and any one of the methods described in the first aspect are implemented, or, The above second aspect and the method described in any one of the second aspect.
  • FIG. 1 is a schematic structural diagram of a Linux operating system 10 in an embodiment of the application.
  • FIG. 2 is a schematic flowchart of an example of a MAC method in an embodiment of the present application
  • FIG. 3 is a schematic flowchart of a MAC method 100 in an embodiment of the present application.
  • FIG. 4 is a schematic flowchart of another MAC method 200 in an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of another MAC method 300 in an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a communication device according to an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of a communication apparatus according to an embodiment of the present application.
  • ordinal numbers such as “1”, “2”, “3”, “first”, “second” and “third” are used to distinguish multiple objects, and are not used to limit the order of multiple objects .
  • a and/or B mentioned in this application should be understood to include the following situations: only A, only B, or both A and B are included.
  • the embodiment of the present application provides a MAC method executed by a security module, which improves the flexibility and security of the MAC mechanism in the operating system.
  • the security module is integrated in an operating system that can perform MAC based on a security label (English: security label), for example, a security module in the operating system kernel.
  • the security module refers to a module that can enhance the security of the operating system where the security module is located based on the MAC mechanism, and is used to improve the security protection capability of the operating system.
  • the security module in the Linux operating system may be SELinux; for another example, the security module in the Android operating system may be SEAndroid.
  • the security module manages and controls the authority of the subject in the operating system to access the object to perform operations. This limitation of authority can effectively overcome the problem of attacking the operating system by the attack source disguised as the operating system administrator, and reduce the possibility of risk occurrence.
  • Subject may refer to a process in this embodiment of the present application.
  • Process may often be used interchangeably in the MAC mechanism, and it should be understood that both refer to the same meaning.
  • An object which may also be referred to as a resource in this embodiment of the present application, refers to an object accessed by a subject.
  • Objects may include, but are not limited to, files (English: file), directories (English: dir), file systems (English: filesystem), network ports, and devices, for example.
  • the operations performed by the subject accessing the object may include, but are not limited to, reading, writing, creating, querying, unloading, and mounting in this embodiment of the present application.
  • the operations performed by the subject accessing the object may include, but are not limited to: the process accesses the file to perform at least one of read, write, and create operations; for another example, when the object is a file system, the subject accesses the object to perform at least one operation.
  • the operations performed may include, but are not limited to, the process accessing the file system to perform at least one of mount and unmount operations.
  • the subject accesses the object to perform the operation can be embodied through the command line, and the command line is run to start the process of the "subject accesses the object to perform the operation", and the corresponding executable file is generated, so that the security module accesses the object to the "subject to perform the operation” process. Operation" for MAC.
  • Security policy (English: security policy) is the basis for the security module to manage and control the authority of the subject to access the object to perform operations.
  • the security policy includes different rules, and the types of the rules include but are not limited to: the security label of each subject, the security label of each object, and the authority of the subject to access the object to perform operations (eg allow (English: allow) rule).
  • a security label (English: security label) can also be called a security context (English: security context), which can usually be a statement including multiple fields.
  • a statement corresponds to a subject or an object and is used to describe the subject or object corresponding to the statement.
  • Object each field in this statement specifies an attribute of the described subject or object.
  • the security tag of the subject includes but is not limited to the following attributes of the subject: user, role and subject type
  • the security tag of the object includes but is not limited to the following attributes of the object: user, role and object type.
  • the security label of subject 1 (that is, the process ftpput) after the execution of the /usr/bin/ftpput file can be system_u:system_r:os_ftp_t, where system_u is the user name corresponding to subject 1, system_r is the role name corresponding to subject 1, os_ftp_t is the subject type corresponding to subject 1.
  • an attribute field of the security level corresponding to subject 1 can be added, such as s0:c0; the security label of object 1 can be: system_u:object_r:os_dev_t, Among them, system_u is the user name corresponding to object 1, object_r is the role name corresponding to object 1, and os_dev_t is the object type corresponding to object 1.
  • the attribute field of the security level corresponding to object 1 can also be added. , such as s0:c0. It should be noted that, for subjects and objects that may appear in the operating system, security labels corresponding to each subject and object can be defined in the security policy to describe the attributes of each subject and each object.
  • the subject type can be regarded as the unified name of one or more subjects in the security policy, and each subject type can correspond to one subject or multiple subjects; similarly, the object type can be regarded as one or more subjects in the security policy.
  • the unified name of multiple objects, each object type can correspond to one object or multiple objects.
  • One or more subject types can correspond to a role, and one or more object types can correspond to a role.
  • the authority of the subject to access the object to perform the operation which is used to indicate the type of the object that the subject can access, the classification of the object (English: Object class, which can also be understood as the specific format of the object that is allowed to be accessed) and the operation that is allowed to be performed.
  • a statement in the field indicates that a statement corresponds to a permission of the subject to access the object to perform an operation, and is used to describe the permission of the subject to access the object to perform an operation.
  • the format of the allow rule can be: allow subject type object Type: Object class ⁇ operations allowed ⁇ .
  • the allow rule 1 that includes subject 1 accessing object 1 to perform operations may be: allow os_ftp_t os_dev_t:file ⁇ read write ⁇ , where allow indicates that the type of rule 1 is to allow access, and os_ftp_t corresponds to subject 1
  • the subject type of os_dev_t is the object type corresponding to object 1
  • file indicates that the object whose format is normal file is allowed to be accessed
  • ⁇ read write ⁇ indicates that read and write operations are allowed.
  • the object classification and the allowed operation can include at least one, and when there are multiple object classifications or allowed operations, multiple object classifications or allowed operations can be written into a curly bracket ( That is, in ⁇ ).
  • the allow rule can be expressed as: allow subject label ⁇ subject type 1 subject type 2... ⁇ object type: object classification ⁇ operations allowed to be performed ⁇ ;
  • allow subject label ⁇ subject type 1 subject type 2... ⁇ object type: object classification ⁇ operations allowed to be performed ⁇ ;
  • the allow rule can be expressed as: allow subject type object label ⁇ object type 1 object type 2... ⁇ : object classification ⁇ operations allowed to be performed ⁇ ; or, when multiple When the individual object type and the permissions corresponding to multiple objects are the same, it can be represented by an allow rule in the security policy.
  • the allow rule can be expressed as: allow subject tag ⁇ subject type 1 subject type 2... ⁇ object tag ⁇ object type 1 Object Type 2... ⁇ : Object classification ⁇ operations allowed ⁇ .
  • the subject label may be a label defined in the security module for the multiple subject types with the same authority, and the multiple subject types correspond to the subject label; the object label may be defined in the security module for the multiple object types with the same authority tag, the multiple object types correspond to the object tag.
  • the subject type os_ftp_t1 and the subject type os_ftp_t2 have relevant permissions in the security module, and the subject label corresponding to the two is defined as A, and the object type os_dev_t1, object type os_dev_t2 and object type os_dev_t3 have relevant permissions in the security module.
  • the object tag corresponding to the subject tag is B
  • the security module includes an allow rule that allows subject tag A to access the resource in the file format in subject tag B to perform read and write operations
  • the allow rule can be expressed as: allow A ⁇ os_ftp_t1os_ftp_t2 ⁇ B ⁇ os_dev_t1os_dev_t2os_dev_t3 ⁇ :file ⁇ read write ⁇ .
  • the working modes of the security module include an enforcing (English: enforcing) mode and a permissive (English: permissive) mode.
  • the security module when the security module works in the enforcing mode, the security module always refuses the subject to access the object to perform the operation if the security policy does not have the permission of the subject to access the object to perform the operation. For example, in enforcing mode, when subject 1 accesses object 1 to perform operation 1, the security module obtains the subject type corresponding to subject 1 and the object type corresponding to object 1.
  • the security module denies subject 1 to access object 1 to perform operation 1.
  • the security module will always allow the subject to access the object and perform the operation if the subject does not have the authority to access the object in the security policy to perform the operation. For example, in permissive mode, when subject 2 accesses object 2 to perform operation 2, the security module obtains the subject type corresponding to subject 2 and the object type corresponding to object 2.
  • the security module determines that the subject does not have the right to access the object to perform the operation, it will generate a corresponding log to record the information associated with the subject's access to the object to perform the operation, for example, generate
  • the contents of the log records can include but are not limited to: the security label of the subject, the security label of the object, the situation of the current MAC task (which subject accesses which object, which operation is performed), and the execution result of the MAC task (is it allowed? execute or refuse to execute).
  • the generated log may be a system log, such as an access vector cache (English: access vector cache, avc for short) log, which may be stored in a system audit (English: audit) log file.
  • the working mode of the security module can be regarded as the "master switch” at the operating system level, and the state of the "master switch” affects all decisions that do not match the subject access object in the security policy to execute the operation authority. , which requires that the security policy combed in the early stage is absolutely comprehensive and accurate. Otherwise, the control granularity of the "master switch" at the operating system level is relatively coarse, which will affect the security of the operating system and the normal operation of the business. Based on this, the embodiments of the present application provide a more flexible and secure MAC method, which can specifically refine the control mode under the "master switch" at the operating system level.
  • the security policy As the communication device where the operating system is located becomes more and more complex, it is difficult for the security policy to include all the corresponding rules that should have the authority to access the object to perform operations. Therefore, when the security module is in the enforcing mode, "all access is denied "In many cases, the MAC mechanism of the operating system may not only fail to improve the security of the operating system, but also cause the risk of interruption of the normal operation of the business.
  • the permissive mode can be configured for some objects in the security policy according to actual needs.
  • the security module determines based on the security policy that the subject does not have Permission to access the object to perform the operation, if the object is configured in permissive mode, the subject is allowed to access the object and perform the operation.
  • the security module flexibly determines whether the subject's access to the object to perform the operation should be allowed or denied according to whether the object is configured with the permissive mode, which improves the flexibility of the MAC mechanism and safety. Even if the communication device where the operating system is located is relatively complex, and the security policy for combing omits the authority of the subject to access the object to perform the operation, it is still possible to configure the object to be in permissive mode to ensure that the subject can access the object and perform the operation. , so as to ensure that the business including the subject accessing the object to perform the operation runs normally and will not be interrupted.
  • the security module can sort out the security policy based on the object, and set the object that requires open permissions to the permissive mode. In the policy, the workload of sorting out the security policy is reduced. It should be noted that, for a specific implementation manner of the MAC method provided by this implementation manner and a related description of the technical effect achieved, reference may be made to the method 100 shown in FIG. 3 below.
  • the MAC mechanism of "all access is allowed" deviates from the effect of enhancing the security of the operating system through the way that the security module manages and controls the authority of the subject to access the object to perform operations.
  • the security of the operating system cannot be guaranteed.
  • the enforcing mode can be configured for some subjects or objects in the security policy according to actual needs.
  • the security module determines based on the security policy that the subject does not have Permission to access the object to perform the operation, if the subject or object is configured in enforcing mode, deny the subject access to the object and perform the operation.
  • the security module flexibly determines whether the subject's access to the object to perform the operation should be allowed or denied according to whether the subject or object is configured with the enforcing mode, which improves the flexibility of the MAC mechanism. sex and safety.
  • the security module when the security module sorts out the security policy, it can sort out based on the object or subject, and set the subject or object that needs to be forcibly refused to be executed as the enforcing mode, so as to ensure the security enhancement effect of the security module on the operating system, without the need for comprehensive
  • the permissions of all subjects to access objects to perform operations are sorted into the security policy, which reduces the workload of sorting out the security policy.
  • the security module provided by the embodiments of the present application may be integrated in an operating system, for example, the operating system may be installed on a single board of a network device, and a network communication device may include at least one single board.
  • the network device may be, for example, a router, a switch, a firewall, or an Internet of Things (English: Internet of Things, IoT for short) terminal.
  • the security module provided by the embodiment of the present application may also be a program product or a computer-readable storage medium to be integrated, for the user to integrate into the operating system when there is a need for security enhancement of the operating system.
  • the security module provided by the embodiment of the present application may also be a program code stored on a server for users to download from the server and integrate in the operating system when there is a need for security enhancement of the operating system, so as to Implement security enhancements to the operating system.
  • the communication device mentioned in the embodiment of this application may be a network device such as a switch, a router firewall, or an IoT terminal, or may be a part of a component on a network device, such as a single board or a line card on a network device, or a network device.
  • a functional module above may also be a chip for implementing the method of the present application, which is not specifically limited in the embodiment of the present application.
  • FIG. 1 is a schematic structural diagram of a Linux operating system 10 in an embodiment of the present application.
  • the Linux operating system 10 may include a user space (English: user space) 100 and a kernel space (English: kernel space) 200, wherein the user space 100 may include: an application program (English: application, abbreviation: App) 110 and SELinux policy management unit 120, the kernel space 200 may include autonomous access control check (English: discretionary access control check, referred to as: DAC Check) 210, Linux security module (English: Linux security module, referred to as: LSM) 220, SELinux 230 and Linux Audit (English: Audit) 240.
  • DAC Check autonomous access control check
  • Linux security module English: Linux security module, referred to as: LSM
  • SELinux 230 Linux Audit (English: Audit) 240.
  • the kernel space 200 and the user space 100 include a system call (English: Syscall) module 12 .
  • LSM 220 allows the security module to enter the kernel in the form of a plug-in, and provides a set of hooks in the kernel calling logic, and the hooks can refer to the function interface of permission checking.
  • DAC Check 210 is used to implement the DAC mechanism.
  • the DAC mechanism can be understood as restricting access to objects by the identity of the subject and the group to which the subject belongs. Subjects with access rights grant access rights to other subjects, restricting the management and control of rights more relaxed.
  • the security module in the Linux operating system 10 includes not only the SELinux policy management unit 120, but also the SELinux 230, wherein the SELinux 230 may include: SELinux hooks (English: Hooks) 231, SELinux file system (English: filesystem) 232, access A vector cache (English: access vector cache, avc for short) 233 , a security server (English: security server) 234 and a policy database (English: policy database) 235 .
  • the security policy can be defined in the SELinux policy management unit 120, and loaded into the policy database 235 through the SELinux filesystem 232 and the security server 234.
  • the MAC process of the Linux operating system 10 is shown in FIG. 2, for example, it may include: S11, the DAC Check 210 detects the behavior, and if it passes, Then execute S12, otherwise, execute S18; S12, SELinux 230 queries from the policy database 235 whether there is a matching rule in the security policy according to the subject type corresponding to subject 1, the object type corresponding to object 1 and operation 1, and if so, then , execute S16, otherwise, execute S13; S13, determine whether SELinux 230 is working in permissive mode or enforcing mode, if working in enforcing mode, execute S14, if working in permissive mode, execute S24.
  • S14 determines whether the object type corresponding to object 1 is configured in permissive mode. If so, execute S15 ⁇ S16, otherwise execute S17 ⁇ S18; S15, generate log 1, which records
  • S16 allow the subject 1 Access object 1 and perform operation 1;
  • S17 generate log 2
  • S24 determines whether the enforcing mode of the subject is supported or the enforcing mode of the object. If the enforcing mode of the subject is supported, S25 is executed, and if the enforcing mode of the object is supported, S35 is executed.
  • S25 judge whether the subject type corresponding to the subject 1 is configured as the enforcing mode, if so, execute S26 and S18, otherwise execute S27 and S16;
  • S26 generate log 3, the content recorded in log 3
  • S27 generate log 4,
  • S35 judge whether the object type corresponding to the object 1 is configured as the enforcing mode, if so, execute S36 and S18, otherwise execute S37 and S16;
  • S36 generate log 5, the content recorded in the log 5
  • S37 generate log 6,
  • FIG. 1 and the above MAC process in the embodiments of the present application are only shown as possible examples for the convenience of understanding the related content mentioned in the embodiments of the present application, and do not constitute limitations to the embodiments of the present application.
  • the following method may be performed by a security module of an operating system, wherein the operating system may be an operating system that performs MAC based on a security tag.
  • the security module integrated in the operating system may be SELinux; for another example, if the operating system is an Android-based operating system, the security module integrated in the operating system may be SEAndroid; for another example,
  • the operating system is an operating system based on Apple (referred to as: iOS), and an integrated security module in the operating system may be SEiOS.
  • FIG. 3 is a schematic flowchart of a MAC method 100 according to an embodiment of the present application.
  • the security module implementing the method 100 works in the enforcing mode and supports the permissive mode of the object.
  • the MAC method 100 may, for example, be executed by SELinux 230 in the Linux operating system 10 in FIG. 1 .
  • the method 100 may include, for example, S101 to S102:
  • the security policy may also include a rule for configuring the object type corresponding to the object to be a permissive mode. Assuming that the object type corresponding to the first object is os_dev_t, the security policy may include a first rule.
  • the first rule may be: permissive os_dev_t, which is used to indicate that all objects corresponding to os_dev_t work in permissive mode, for example, it can be used to indicate The first object works in permissive mode.
  • the subject type corresponding to the first subject and the object type corresponding to the first object can be obtained first, and then the subject included in the security policy can access the object to execute the first operation.
  • the permissions of the operation check whether there is a permission matching the behavior of the first subject accessing the first object to perform the first operation. If so, the first subject is allowed to access the first object and perform the first operation; if not, it can be determined that the first subject does not have the right to access the first object to perform the first operation, then, check whether the security policy is The first rule is included.
  • the first rule it can be determined that the first object is configured in the permissive mode, so that S102 is executed; if the first rule is not included, it can be determined that the first object is not configured in the permissive mode, so that according to the The "master switch" MACs the behavior, ie, denies the first subject access to the first object to perform the first operation.
  • the permission matching the behavior of the first subject accessing the first object to perform the first operation may refer to the permission of a subject in the security policy to access the object to perform the operation
  • the subject type is the subject type corresponding to the first subject
  • the object The type is the object type corresponding to the first object
  • the object classification includes the format of the first object
  • the operations allowed to be executed include the first operation.
  • the first object is configured in permissive mode, which means that the object type corresponding to the first object is configured in permissive mode.
  • some non-critical objects in the operating system can be configured in permissive mode to achieve loose access to non-critical objects; in order to ensure the security of the operating system, critical objects may not be configured or sufficient
  • the verified objects are permissive mode, thus realizing the mandatory protection of these objects.
  • the object types corresponding to some objects can be configured in the permissive mode in the security policy, so that when the subject accesses these objects, the access to these objects will not be denied because the security module works in the enforcing mode, which can avoid The problem that the business that was originally running safely was forced to be interrupted due to the incomplete authority of the subject to access the object in the security policy to perform the operation.
  • the method 100 may further include: generating a first log, the first log using Information associated with recording the first subject accessing the first object to perform the first operation.
  • the first log may be a system log
  • the security policy can be further improved through verification or testing, so that the first subject will access the first object to perform the first operation.
  • the behavior of the operation occurs, the behavior can be accurately handled according to the improved security policy.
  • the security module can update the security policy so that the updated security policy includes a second rule indicating that the first subject is allowed to access the first object to perform the first operate.
  • the security policy before the update does not include the second rule
  • the security policy after the update adds a second rule
  • the second rule may be: allow the subject type of the first subject
  • the object type of the first object the first object The object classification first operation.
  • the security policy after the update can be: allow the subject type of the first subject
  • the object type of the first object the object classification of the first object ⁇ Actions allowed before update first action ⁇ .
  • the first rule can be deleted from the security policy, In this way, when the behavior of the first subject accessing the first object to perform the first operation occurs again, it is not only determined based on the security policy that the first subject does not have the right to access the first object to perform the first operation, but also determines that the first object does not have the right to access the first object to perform the first operation.
  • the configuration is in the permissive mode, so that the first subject is denied access to the first object to perform the first operation, thereby ensuring the security of the operating system.
  • the method 100 may further include, for example, S103 to S104:
  • the method 100 may further include: generating a second log, where the second log is used to record that the second subject accesses the second object to execute the second log Information associated with the operation.
  • the second log may be a system log
  • the security module flexibly determines whether the behavior of the subject accessing the object to perform the operation should be allowed or rejected according to whether the object is configured with the permissive mode, which improves the MAC address. Flexibility and security of the mechanism. Even if the communication device where the operating system is located is relatively complex, and the security policy for combing omits the authority of the subject to access the object to perform the operation, it is still possible to configure the object to be in permissive mode to ensure that the subject can access the object and perform the operation. , so as to ensure that the business including the subject accessing the object to perform the operation runs normally and will not be interrupted. Moreover, in this MAC method, the security module can sort out the security policy based on the object, and set the object that requires open permissions to the permissive mode. In the policy, the workload of sorting out the security policy is reduced.
  • the MAC method 100 Compared with the MAC mechanism in which the current security module works in the enforcing mode and configures the permissive mode for some subjects, the MAC method 100 provided by the method 100 can be applied to the situation where the subject accesses the object to perform the operation, and the operating system is relatively complex. Larger cases can also implement MAC flexibly and securely. Moreover, in the embodiment of the present application, when the security module works in the enforcing mode, it can support the permissive mode of the subject or the permissive mode of the object according to actual needs, the MAC method is more flexible, and the use of the security module is more flexible for users. friendly.
  • an embodiment of the present application provides a MAC method 200 and a MAC method 300 .
  • the security module of the MAC method 200 works in the permissive mode, and the security module that executes the method 200 supports the enforcing mode of the subject.
  • the security module of the MAC method 300 operates in permissive mode, and the security module implementing the method 300 supports the enforcing mode of the object.
  • FIG. 4 is a schematic flowchart of a MAC method 200 according to an embodiment of the present application.
  • the security module in the method 200 works in the permissive mode and supports the subject's enforcing mode.
  • the MAC method 200 may, for example, be executed by SELinux 230 in the Linux operating system 10 in FIG. 1 .
  • the method 200 may include, for example, S201-S202:
  • S202 Deny the first subject to access the first object to perform the first operation.
  • the security policy may include a first rule, and the first rule indicates that the first subject works in the enforcing mode. Assuming that the subject type corresponding to the first subject is os_ftp_t, the security policy may include a first rule.
  • the first rule may be: enforcing os_ftp_t, which is used to indicate that all subjects corresponding to os_ftp_t work in the enforcing mode.
  • the subject type corresponding to the first subject and the object type corresponding to the first object can be obtained first, and then the subject included in the security policy can access the object to execute the first operation.
  • the permissions of the operation check whether there is a permission matching the behavior of the first subject accessing the first object to perform the first operation. If so, the first subject is allowed to access the first object and perform the first operation; if not, it can be determined that the first subject does not have the right to access the first object to perform the first operation, then, check whether the security policy is The first rule is included.
  • the first rule it can be determined that the first subject is configured in the enforcing mode, so that S202 is executed; if the first rule is not included, it can be determined that the first subject is not configured in the enforcing mode, so that according to the The "master switch" MACs this behavior, ie, allows the first subject to access the first object and perform the first operation.
  • the first subject is configured in the enforcing mode, which may mean that the subject type corresponding to the first subject is configured in the enforcing mode.
  • some key subjects or fully authenticated subjects in the operating system can be configured in the enforcing mode to implement mandatory protection for these subjects; non-critical subjects can not be configured in the enforcing mode to achieve Relaxed access to these principals.
  • the subject type corresponding to some subjects can be configured in the enforcing mode in the security policy, so that when these subjects access the object, they will not be allowed to access these subjects because the security module works in the permissive mode, which can effectively Improve the security of the operating system.
  • the method 200 may further include: generating a third log, the third log using Information associated with recording the first subject accessing the first object to perform the first operation.
  • the third log may be a system log
  • the security policy can be further improved through verification or testing, so that the first subject will access the first object to perform the first operation.
  • the behavior can be accurately handled according to the improved security policy.
  • the security module can update the security policy so that the updated security policy includes a third rule indicating that the first subject is allowed to access the first object to perform the first operate.
  • the method 200 may further include S203-S204:
  • the method 200 may further include: generating a fourth log, where the fourth log is used to record that the second subject accesses the second object to execute the second Information associated with the operation.
  • the fourth log may be a system log
  • the security module flexibly determines whether the behavior of the subject accessing the object to perform the operation should be allowed or rejected according to whether the subject is configured with the enforcing mode, which improves the MAC address. Flexibility and security of the mechanism.
  • the security module when the security module sorts out the security policy, it can sort out the subject based on the subject, and set the subject that needs to be forced to refuse to execute to the enforcing mode, so as to ensure the security enhancement effect of the security module on the operating system, and it is not necessary to comprehensively
  • the permissions of the subject to access the object to perform operations are sorted into the security policy, which reduces the workload of sorting the security policy.
  • FIG. 5 is a schematic flowchart of a MAC method 300 according to an embodiment of the present application.
  • the security module in the method 300 works in the permissive mode and supports the enforcing mode of the object.
  • the MAC method 300 may, for example, be executed by SELinux 230 in the Linux operating system 10 in FIG. 1 .
  • the method 300 may include, for example, S301-S302:
  • S302 Deny the first subject to access the first object to perform the first operation.
  • the security policy includes a second rule that instructs the first object to operate in an enforcing mode.
  • the security policy may include a second rule, and the second rule instructs the first object to work in the enforcing mode.
  • the security policy may include a second rule.
  • the second rule may be: enforcing os_dev_t, which is used to indicate that all objects corresponding to os_dev_t work in the enforcing mode.
  • the subject type corresponding to the first subject and the object type corresponding to the first object can be obtained first, and then the subject included in the security policy can access the object to execute the first operation.
  • the permissions of the operation check whether there is a permission matching the behavior of the first subject accessing the first object to perform the first operation.
  • the first subject is allowed to access the first object and perform the first operation; if not, it can be determined that the first subject does not have the right to access the first object to perform the first operation, then, check whether the security policy is Including the second rule, if the second rule is included, it can be determined that the first object is configured in the enforcing mode, so that S302 is executed; if the second rule is not included, it can be determined that the first object is not configured in the enforcing mode, so according to the security module
  • the first object is configured in the enforcing mode, which may mean that the object type corresponding to the first object is configured in the enforcing mode.
  • some key objects or fully verified objects in the operating system can be configured in the enforcing mode to implement mandatory protection of these objects; non-critical objects can not be configured in the enforcing mode to achieve loose access to these objects.
  • the object type corresponding to some objects can be configured in the enforcing mode in the security policy, so that when the subject accesses these objects, it will not allow access to these objects because the security module works in the permissive mode, which can effectively to improve the security of the operating system.
  • the method 300 may further include: generating a fifth log, and the fifth log uses Information associated with recording the first subject accessing the first object to perform the first operation.
  • the security policy can be further improved through verification or testing, so that the first subject will access the first object to perform the first operation.
  • the behavior can be accurately handled according to the improved security policy.
  • the security module can update the security policy so that the updated security policy includes a third rule indicating that the first subject is allowed to access the first object to perform the first operate.
  • the method 300 may further include, for example, S303 to S304:
  • the method 300 may further include: generating a sixth log, where the sixth log is used to record that the second subject accesses the second object to execute the second Information associated with the operation.
  • the sixth log may be a system log
  • the security module flexibly determines whether the behavior of the subject accessing the object to perform the operation should be allowed or denied according to whether the object is configured with the enforcing mode, which improves the MAC address. Flexibility and security of the mechanism.
  • the security module when the security module sorts out the security policy, it can sort out based on the object, and set the object that needs to be forcibly refused to be executed as the enforcing mode, so as to ensure the security enhancement effect of the security module on the operating system, and it is not necessary to comprehensively
  • the permissions of the subject to access the object to perform operations are sorted into the security policy, which reduces the workload of sorting the security policy.
  • the security module when the security module works in the permissive mode, the enforcing mode of the subject or the enforcing mode of the object can be supported according to actual needs, the MAC method is more flexible, and the use of the security module is more user-friendly.
  • the security module works in enforcing mode and supports object permissive mode.
  • the security policy includes:
  • system_u:system_r:os_ftp_a;//Security context of subject type a subject type a corresponds to at least subject 1
  • object type A corresponds to at least object 1
  • object type B corresponds to at least object 2
  • object type C corresponds to at least object 3
  • os_ftp_a os_dev_C filesystem ⁇ mount umount ⁇ //Allow os_ftp_a to access objects in filesystem format in os_dev_B to perform read and write operations
  • os_ftp_a os_dev_B file ⁇ read write ⁇ //Allow os_ftp_a to access objects in file format in os_dev_C to perform mount and unmount operations
  • the process of MAC performed when the subject 1 accesses the object 1 to perform the read operation may include: the security module may first determine that the subject type corresponding to the subject 1 is os_ftp_a, and determine that the object type corresponding to the object 1 is os_dev_A; Based on the security policy, confirm that there are no rules matching os_ftp_a and os_dev_A, so as to determine that subject 1 does not have permission to access object 1 to perform read operations; based on the security policy matching rule permissive os_dev_A, in this rule, configure the object type corresponding to object 1 For permissive mode; based on matching rules, subject 1 is allowed to access object 1 and perform read operations.
  • security policies include:
  • system_u:system_r:os_ftp_a;//Security context of subject type a subject type a corresponds to at least subject 1
  • object type A corresponds to at least object 1
  • object type B corresponds to at least object 2
  • object type C corresponds to at least object 3
  • os_ftp_a os_dev_C filesystem ⁇ mount umount ⁇ //Allow os_ftp_a to access objects in filesystem format in os_dev_B to perform read and write operations
  • os_ftp_a os_dev_B file ⁇ read write ⁇ //Allow os_ftp_a to access objects in file format in os_dev_C to perform mount and unmount operations
  • the MAC process for subject 1 to access object 2 to perform a query operation may include: the security module may first determine that the subject type corresponding to subject 1 is os_ftp_a, and determine that the object type corresponding to object 2 is os_dev_B;
  • the rules for matching os_ftp_a and os_dev_B in the above security policy are allow os_ftp_a os_dev_B: file ⁇ read write ⁇ , that is, the operations performed by subject 1 on object 2 are allowed to exclude query operations, so it can be determined that subject 1 does not access object 2 to execute queries Permission to operate; further, confirm that the security policy includes a rule enforcing os_ftp_a that matches subject 1.
  • the subject type corresponding to subject 1 is configured as enforcing mode; according to this rule, subject 1 is denied access to object 2 to execute the query operate.
  • Security policies include:
  • system_u:system_r:os_ftp_a;//Security context of subject type a subject type a corresponds to at least subject 1
  • object type A corresponds to at least object 1
  • object type B corresponds to at least object 2
  • object type C corresponds to at least object 3
  • os_ftp_a os_dev_C filesystem ⁇ mount umount ⁇ //Allow os_ftp_a to access objects in filesystem format in os_dev_B to perform read and write operations
  • os_ftp_a os_dev_B file ⁇ read write ⁇ //Allow os_ftp_a to access objects in file format in os_dev_C to perform mount and unmount operations
  • the MAC process performed for the subject 2 to access the object 2 to perform the read operation may include: the security module determines that the subject type corresponding to the subject 2 is os_ftp_b, and determines that the object type corresponding to the object 2 is os_dev_B; In the policy, it is determined that there is no rule matching os_ftp_b and os_dev_B at the same time, so as to determine that subject 2 does not have permission to access object 2 to perform read operations; then, confirm that the security policy includes the rule enforcing os_dev_B, in this rule, the object corresponding to object 2 is The type is configured in enforcing mode; according to this rule, subject 2 is denied access to object 2 for read operations.
  • the security module can flexibly determine whether the behavior of the subject accessing the object to perform the operation should be allowed or not under the premise of ensuring security. is rejected, which improves the flexibility and security of the MAC mechanism.
  • FIG. 6 is a schematic structural diagram of a communication apparatus 600 according to an embodiment of the present application.
  • the communication device 600 includes a first processing unit 601 and a second processing unit 602 .
  • the communication device 600 can be used to execute the method 100, the method 200 or the method 300 in the above embodiments.
  • the first processing unit 601 is configured to, when the first subject accesses the first object to perform the first operation, determine based on the security policy that the first subject does not have the authority to access the first object to perform the first operation,
  • the first object is configured in a permissive mode;
  • the second processing unit 602 is configured to allow the first subject to access the first object and perform the first operation.
  • the security policy includes a first rule, and the first rule instructs the first object to work in the permissive mode.
  • the communication apparatus 600 further includes: a third processing unit.
  • the third processing unit is configured to generate a first log after allowing the first subject to access the first object and perform the first operation, where the first log is used to record that the first subject accesses all information associated with the first object to perform the first operation.
  • the communication apparatus 600 further includes: a fourth processing unit.
  • the fourth processing unit is configured to update the security policy, the updated security policy includes a second rule, and the second rule indicates that the first subject is allowed to access the first object to execute the first operation.
  • the communication apparatus 600 further includes: a fifth processing unit.
  • the fifth processing unit is configured to delete the first rule from the security policy.
  • the first processing unit 601 is further configured to determine that the second subject does not access the second subject based on the security policy when the second subject accesses the second object to perform the second operation object to perform the second operation permission, wherein the second object is not configured in the permissive mode; the second processing unit 602 is further configured to deny the second subject access to the second object to perform all operations Describe the second operation.
  • the relevant description of S103 in the method 100 for the specific implementation manner of the operation performed by the second processing unit 602 and the effect achieved, reference may be made to the relevant description of S104 in the method 100 .
  • the first processing unit 601 is configured to, when the first subject accesses the first object to perform the first operation, determine based on the security policy that the first subject does not have the authority to access the first object to perform the first operation, The first subject is configured in a mandatory enforcing mode; the second processing unit 602 is configured to deny the first subject access to the first object to perform the first operation.
  • the security policy includes a first rule, and the first rule instructs the first subject to work in the enforcing mode.
  • the communication apparatus 600 further includes: a third processing unit.
  • the third processing unit is configured to update the security policy, the updated security policy includes a third rule, and the third rule indicates that the first subject is allowed to access the first object to execute the first operation.
  • the first processing unit 601 is further configured to determine that the second subject does not access the second subject based on the security policy when the second subject accesses the second object to perform the second operation the object to perform the second operation, wherein the second subject is not configured in the enforcing mode; the second processing unit 602 is configured to allow the second subject to access the second object and the first Second body and perform the second operation.
  • the relevant description of S203 in the method 200 for the specific implementation manner of the operation performed by the second processing unit 602 and the effect achieved, reference may be made to the relevant description of S204 in the method 200 .
  • the first processing unit 601 is configured to, when the first subject accesses the first object to perform the first operation, determine based on the security policy that the first subject does not have the authority to access the first object to perform the first operation,
  • the first object is configured in a mandatory enforcing mode;
  • the second processing unit 602 is configured to deny the first subject access to the first object to perform the first operation.
  • the security policy includes a second rule that instructs the first object to work in the enforcing mode.
  • the communication apparatus 600 further includes: a third processing unit.
  • the third processing unit is configured to update the security policy, the updated security policy includes a third rule, and the third rule indicates that the first subject is allowed to access the first object to execute the first operation.
  • the first processing unit 601 is further configured to determine that the second subject does not access the second subject based on the security policy when the second subject accesses the second object to perform the second operation object to perform the second operation permission, wherein the second object is not configured in the enforcing mode; the second processing unit 602 is configured to allow the second subject to access the second object and the first Second body and perform the second operation.
  • the relevant description of S303 in the method 300 for the specific implementation manner of the operation performed by the second processing unit 602 and the effect achieved, reference may be made to the relevant description of S304 in the method 300 .
  • FIG. 7 is a schematic structural diagram of a communication apparatus 700 provided by an embodiment of the present application.
  • the communication apparatus 700 can be used to execute the method 100, the method 200 or the method 300 in the above embodiments.
  • the communication apparatus 700 may include a processor 710 and a memory 720 coupled to the processor 710 .
  • the processor 710 may be a central processing unit (English: central processing unit, abbreviation: CPU), a network processor (English: network processor, abbreviation: NP), or a combination of CPU and NP.
  • the processor may also be an application-specific integrated circuit (English: application-specific integrated circuit, abbreviation: ASIC), a programmable logic device (English: programmable logic device, abbreviation: PLD) or a combination thereof.
  • the above-mentioned PLD can be a complex programmable logic device (English: complex programmable logic device, abbreviation: CPLD), field programmable logic gate array (English: field-programmable gate array, abbreviation: FPGA), general array logic (English: generic array logic, abbreviation: GAL) or any combination thereof.
  • the processor 710 may refer to one processor, or may include multiple processors.
  • the memory 720 may include volatile memory (English: volatile memory), such as random-access memory (English: random-access memory, abbreviation: RAM); the memory may also include non-volatile memory (English: non-volatile memory) , such as read-only memory (English: read-only memory, abbreviation: ROM), flash memory (English: flash memory), hard disk (English: hard disk drive, abbreviation: HDD) or solid-state drive (English: solid-state drive , abbreviation: SSD); the memory 720 may also include a combination of the above-mentioned types of memory.
  • the memory 720 may refer to one memory, or may include multiple memories.
  • computer-readable instructions are stored in the memory 720, and the computer-readable instructions include a plurality of software modules, such as a first processing module 721 and a second processing module 722, and may also include a third processing module , at least one of the fourth processing module and the fifth processing module, may respectively correspond to the first processing unit 601 , the second processing unit 602 , the third processing unit, the fourth processing unit and the fifth processing unit in the communication device 600 unit.
  • the processor 710 can perform corresponding operations according to the instructions of each software module. In this embodiment, an operation performed by a software module actually refers to an operation performed by the processor 710 according to the instruction of the software module.
  • the first processing module 721 determines that the first subject does not have the right to access the first object to perform the first operation based on the security policy. ", can actually refer to "when the first subject accesses the first object to perform the first operation, it is determined based on the security policy that the first subject does not access the The first object has the right to perform the first operation.”
  • the first processing module 721 may correspond to the first processing unit 601 in the communication device 600 .
  • the communication device 700 can execute the method 100 in the above embodiments.
  • the processor 710 is configured to execute all processing-related operations in the method 100.
  • the processor 710 is configured to determine, based on a security policy, when the first subject accesses the first object to perform the first operation, the first subject does not have the right to access the first object to perform the first operation, The first object is configured in a permissive mode, allowing the first subject to access the first object and perform the first operation.
  • the communication device 700 can execute the method 200 in the above embodiments.
  • the processor 710 is configured to execute all processing-related operations in the method 200 .
  • the processor 710 is configured to determine, based on a security policy, when the first subject accesses the first object to perform the first operation, the first subject does not have the right to access the first object to perform the first operation, The first subject is configured in an enforcing mode, denying the first subject access to the first object to perform the first operation.
  • the communication apparatus 700 can execute the method 300 in the above embodiments.
  • the processor 710 is used to execute all processing-related operations in the method 300 .
  • the processor 710 is configured to determine, based on a security policy, when the first subject accesses the first object to perform the first operation, the first subject does not have the right to access the first object to perform the first operation, The first object is configured in an enforcing mode, denying the first subject access to the first object to perform the first operation.
  • the present application also provides a computer-readable storage medium, where instructions are stored in the computer-readable storage medium, when the computer-readable storage medium runs on a computer, the computer causes the computer to perform the method described in any one of the foregoing embodiments. (eg, method 100, method 200, and method 300) any one or more operations.
  • the present application also provides a computer program product, including a computer program that, when run on a computer, causes the computer to perform the method described in any of the preceding embodiments (eg, method 100, method 200, and method). 300) any one or more operations.
  • the present application provides a server, where program code is stored in the server, and when the program code is executed by a processor, the method described in any one of the foregoing embodiments (eg, method 100 , method 200 and method 300 is implemented) ) any one or more of the operations.
  • the disclosed system, apparatus and method may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative.
  • the division of units is only a logical business division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or integrated. to another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • Units described as separate components may or may not be physically separated, and components shown as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each service unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit may be implemented in the form of hardware, or may be implemented in the form of a software business unit.
  • the integrated unit if implemented as a software business unit and sold or used as a stand-alone product, may be stored in a computer-readable storage medium.
  • the technical solutions of the present application can be embodied in the form of software products in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, and the computer software products are stored in a storage medium , including several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes .
  • the services described in the present invention may be implemented by hardware, software, firmware or any combination thereof.
  • the services may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.
  • Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another.
  • a storage medium can be any available medium that can be accessed by a general purpose or special purpose computer.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Databases & Information Systems (AREA)
  • Storage Device Security (AREA)

Abstract

本申请实施例公开了一种强制访问控制MAC方法及相关设备，该方法应用于操作系统中的安全模块，在安全模块工作在enforcing模式时，该方法包括：在第一主体访问第一客体以执行第一操作时，如果安全模块基于安全策略确定第一主体没有访问第一客体以执行第一操作的权限，但第一客体被配置为permissive模式，则，可以允许第一主体访问第一客体并执行第一操作。如此，在有待执行主体访问客体以执行操作的情况下，安全模块能够在确保安全的前提下灵活的确定该主体访问客体以执行操作的行为应该被允许还是被拒绝，提高了MAC机制的灵活性和安全性。

Description

一种强制访问控制MAC方法及相关设备
本申请要求于2021年03月05日提交中国国家知识产权局、申请号为202110245052.5、申请名称为“一种强制访问控制MAC方法及相关设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，特别是涉及一种强制访问控制(英文：mandatory access control，简称：MAC)方法及相关设备。
背景技术
为了提高操作系统的安全防护能力，通过在操作系统中增加安全模块，由该安全模块实现对操作系统的强制访问控制。例如，Linux操作系统中的安全增强Linux(英文：Security-Enhanced Linux，简称：SELinux)提高Linux的安全性；又例如，安卓(英文：Android)操作系统中的SEAndroid提高Android的安全性。
目前，安全模块采用MAC机制，针对操作系统中的主体(或称为进程)访问客体(或称为资源)以执行的某个或某些操作进行权限管理，根据安全策略(英文：security policy)中预先设置的规则，限定主体可以访问客体以执行的操作。当主体访问客体以执行操作的行为未匹配到security policy中的规则时，如果该安全模块工作在强制(英文：enforcing)模式，则，拒绝该主体访问该客体；如果该安全模块工作在许可(英文：permissive)模式，则，允许该主体访问该客体并执行该操作。如此，对于未匹配到security policy中规则的主体访问客体以执行操作的行为，上述MAC机制对所有的主体访问客体以执行操作的行为都进行一样的控制，存在许多的问题。
基于此，亟待提供一种MAC方法，能够灵活且安全的确定待执行的动作是否可以执行，实现合理的MAC。
发明内容
基于此，本申请实施例提供了一种强制访问控制MAC方法及相关设备，在有待执行主体访问客体以执行操作的情况下，安全模块能够在确保安全的前提下灵活的确定该主体访问客体以执行操作的行为应该被允许还是被拒绝，提高了MAC机制的灵活性和安全性。
本申请中，操作系统可以为基于安全标签进行MAC的操作系统，例如，可以为基于Linux的操作系统、基于Android的操作系统或苹果操作系统。如果操作系统为Linux的操作系统，则，该操作系统中的安全模块可以为SELinux；如果操作系统为Android的操作系统，则，该操作系统中的安全模块可以为SEAndroid。
第一方面，本申请实施例提供了一种MAC方法，该方法应用于操作系统中的安全模块，在安全模块工作在enforcing模式时，该MAC方法例如可以包括：在第一主体访问第一客体以执行第一操作时，如果安全模块基于安全策略确定第一主体没有访问第一客体以执行第一操作的权限，但第一客体被配置为permissive模式，则，可以允许第一主体访问第一客体并执行第一操作。可见，安全模块在“总开关”的状态为enforcing模式时，能够根据客体是否配置了permissive模式灵活的确定该主体访问客体以执行操作的行为应该被允许还是被拒绝，提高了MAC机制的灵活性和安全性。此外，即使在操作系统所在的通信 装置较为复杂，梳理的security policy中遗漏了该主体访问该客体以执行该操作的权限，也可以通过配置该客体为permissive模式保证该主体能够访问该客体并执行该操作，从而保证包括该主体访问该客体以执行该操作的业务正常运行，不会被中断。而且，该MAC方法中，安全模块在梳理security policy时，可以基于客体进行梳理，将需要开放权限的客体设置为permissive模式，无需全面的将所有的主体访问客体以执行操作的权限均梳理到security policy中，降低了梳理security policy的工作量。其中，安全策略(英文：security policy)中包括不同的规则，规则的类型包括但不限于：各个主体的安全标签、各个客体的安全标签、主体访问客体以执行操作的权限(如允许(英文：allow)规则)以及配置客体对应的客体类型为permissive模式的规则。
在一种实现方式中，安全模块中的该安全策略包括第一规则，该第一规则指示第一客体工作在permissive模式。例如，第一客体对应的客体类型为os_dev_t，安全策略中包括的第一规则可以为：permissive os_dev_t，用于指示os_dev_t对应的所有客体均被配置为permissive模式，从而可以指示第一客体被配置为permissive模式。
在一种实现方式中，当安全模块根据第一客体被配置为permissive模式才允许第一主体访问第一客体并执行第一操作，那么，在允许第一主体访问第一客体并执行第一操作之后，安全模块还可以生成第一日志，该第一日志用于记录所述第一主体访问所述第一客体以执行所述第一操作相关联的信息。其中，该第一日志可以是系统日志，记录的内容可以包括：第一主体的安全标签、第一客体的安全标签、第一主体访问第一客体执行第一操作被允许以及permissive＝1，其中，permissive＝1用于指示第一客体配置为permissive模式后该行为被允许执行。如此，使得安全模块能够基于所记录的日志，对操作系统的安全性以及安全策略的完备性和准确性进行分析和了解。
在一种实现方式中，安全模块还可以通过验证或测试进一步完善安全策略。作为一个示例，如果通过验证或测试，确定该第一主体访问第一客体以执行第一操作的行为属于安全的访问行为，由于梳理安全策略时的遗漏导致从安全策略中确定第一主体没有访问第一客体以执行第一操作的权限，那么，安全模块可以更新所述安全策略，使得更新后的安全策略包括第二规则，该第二规则指示允许第一主体访问第一客体以执行第一操作。作为另一个示例，如果通过验证或测试，确定该第一主体访问第一客体以执行第一操作的行为属于不安全的攻击行为，那么，为了安全起见，可以从安全策略中删除第一规则，这样，再有第一主体访问第一客体以执行第一操作的行为发生时，不仅基于安全策略确定第一主体没有访问第一客体以执行第一操作的权限，而且还可以确定第一客体未配置为permissive模式，从而，拒绝第一主体访问第一客体以执行第一操作，确保了操作系统的安全性。如此，通过完善安全策略，使得后续再有第一主体访问第一客体以执行第一操作的行为发生时，能够按照完善后的安全策略准确的处理该行为。
在一种实现方式中，该MAC方法例如还可以包括：在第二主体访问第二客体以执行第二操作时，如果安全模块基于安全策略确定第二主体没有访问第二客体以执行第二操作的权限，且第二客体未配置为permissive模式，则，拒绝第二主体访问第二客体以执行第二操作。例如，安全模块的安全策略中，可以将操作系统中的一些非关键客体配置为 permissive模式，实现对非关键客体的宽松访问；为了保证该操作系统的安全性，可以不配置关键客体或经过充分验证的客体为permissive模式，从而实现对这些客体的强制保护。
在一种实现方式中，当安全模块根据第二客体未配置为permissive模式，拒绝第二主体访问第二客体以执行第二操作，那么，在拒绝第二主体访问第二客体以执行第二操作之后，安全模块还可以生成第二日志，该第二日志用于记录所述第二主体访问所述第二客体以执行所述第二操作相关联的信息。其中，该第二日志可以是系统日志，记录的内容可以包括：第二主体的安全标签、第二客体的安全标签、第二主体访问第二客体执行第二操作被拒绝以及permissive＝0，其中，permissive＝0用于指示第二客体未配置为permissive模式且该行为被拒绝执行。如此，使得安全模块能够基于所记录的日志，对操作系统的安全性以及安全策略的完备性和准确性进行分析和了解。
第二方面，本申请实施例还提供了另一种MAC方法，该方法应用于操作系统中的安全模块，在安全模块工作在permissive模式时，该MAC方法例如可以包括：在第一主体访问第一客体以执行第一操作时，如果安全模块基于安全策略确定第一主体没有访问第一客体以执行第一操作的权限，但第一客体或第一主体被配置为enforcing模式，则，可以拒绝第一主体访问第一客体以执行第一操作。这样，安全模块在“总开关”的状态为permissive模式时，根据主体或客体是否配置了enforcing模式灵活的确定该主体访问客体以执行操作的行为应该被允许还是被拒绝，提高了MAC机制的灵活性和安全性。而且，该MAC方法中，安全模块在梳理security policy时，可以基于客体或主体进行梳理，将需要强制拒绝执行的主体或客体设置为enforcing模式，保证安全模块对操作系统的安全增强作用，无需全面的将所有的主体访问客体以执行操作的权限均梳理到security policy中，降低了梳理security policy的工作量。
需要说明的是，安全模块可以支持安全策略中主体的enforcing模式，或者，支持安全策略中客体的enforcing模式，但为了安全模块能够基于安全策略对权限进行有效的控制，安全模块通常不同时支持主体和客体的enforcing模式。
在一种实现方式中，安全策略可以包括第一规则，所述第一规则指示所述第一主体工作在所述enforcing模式。那么，当安全策略支持主体的enforcing模式，则，可以在确定第一主体没有访问第一客体以执行第一操作的权限后，根据第一主体被配置为enforcing模式确定拒绝第一主体访问第一客体以执行第一操作。或者，安全策略也可以包括第二规则，所述第二规则指示所述第一客体工作在所述enforcing模式。那么，当安全策略支持客体的enforcing模式，则，可以在确定第一主体没有访问第一客体以执行第一操作的权限后，根据第一客体被配置为enforcing模式确定拒绝第一主体访问第一客体以执行第一操作。
在一种实现方式中，为了记录该次拒绝执行安全策略中没有权限的行为，该方法还可以包括：生成第三日志，该第三日志用于记录第一主体访问第一客体以执行所述第一操作相关联的信息。例如，第三日志可以为系统日志，记录的内容可以包括：第一主体的安全标签、第一客体的安全标签、第一主体访问第一客体执行第一操作被拒绝以及enforcing＝1，其中，enforcing＝1用于指示第一主体配置为enforcing模式后该行为被拒绝执行。或者，该方法也可以包括：生成第五日志，该第五日志用于记录第一主体访问第一客体以执行所述 第一操作相关联的信息。例如，第五日志可以为系统日志，记录的内容可以包括：第一主体的安全标签、第一客体的安全标签、第一主体访问第一客体执行第一操作被拒绝以及enforcing＝1，其中，enforcing＝1用于指示第一客体配置为enforcing模式后该行为被拒绝执行。
在一种实现方式中，还可以通过验证或测试进一步完善安全策略。作为一个示例，如果通过验证或测试，确定该第一主体访问第一客体以执行第一操作的行为属于安全的访问行为，由于梳理安全策略时的遗漏导致从安全策略中确定第一主体没有访问第一客体以执行第一操作的权限，那么，安全模块可以更新所述安全策略，使得更新后的安全策略包括第三规则，该第三规则指示允许第一主体访问第一客体以执行第一操作。这样，通过完善安全策略，使得后续再有第一主体访问第一客体以执行第一操作的行为发生时，能够按照完善后的安全策略准确的处理该行为。
在一种实现方式中，如果安全模块支持客体的enforcing模式，那么，该MAC方法例如还可以包括：在第二主体访问第二客体以执行第二操作时，如果安全模块基于安全策略确定第二主体没有访问第二客体以执行第二操作的权限，且第二客体未配置为enforcing模式，则，允许第二主体访问第二客体并执行第二操作。或者，如果安全模块支持主体的enforcing模式，那么，该MAC方法例如还可以包括：在第二主体访问第二客体以执行第二操作时，如果安全模块基于安全策略确定第二主体没有访问第二客体以执行第二操作的权限，且第二主体未配置为enforcing模式，则，允许第二主体访问第二客体并执行第二操作。例如，安全模块的安全策略中，可以将操作系统中的一些非关键主体或客体配置为enforcing模式，实现对非关键主体或客体的宽松访问；为了保证该操作系统的安全性，可以不配置关键主体和客体(或经过充分验证的主体和客体)为enforcing模式，从而实现对这些主体和客体的强制保护。
在一种实现方式中，当安全模块根据第二客体或第二主体未配置为enforcing模式，允许第二主体访问第二客体并执行第二操作，那么，在允许第二主体访问第二客体并执行第二操作之后，安全模块还可以生成系统日志，用于记录所述第二主体访问所述第二客体以执行所述第二操作相关联的信息。
第三方面，本申请提供了一种通信装置，该通信装置应用于操作系统中的安全模块，所述通信装置工作在强制enforcing模式。该通信装置例如可以包括：第一处理单元和第二处理单元。其中：第一处理单元，用于在第一主体访问第一客体以执行第一操作时，基于安全策略确定所述第一主体没有访问所述第一客体以执行所述第一操作的权限，所述第一客体配置为许可permissive模式；第二处理单元，用于允许所述第一主体访问所述第一客体并执行所述第一操作。
在一种实现方式中，所述安全策略包括第一规则，所述第一规则指示所述第一客体工作在所述permissive模式。
在一种实现方式中，所述通信装置还包括：第三处理单元。该第三处理单元，用于在允许所述第一主体访问所述第一客体并执行所述第一操作之后，生成第一日志，所述第一日志用于记录所述第一主体访问所述第一客体以执行所述第一操作相关联的信息。
在一种实现方式中，所述通信装置还包括：第四处理单元。其中，该第四处理单元，用于更新所述安全策略，所述更新后的安全策略包括第二规则，所述第二规则指示允许所述第一主体访问所述第一客体以执行所述第一操作。
在一种实现方式中，所述通信装置还包括：第五处理单元。其中，该第五处理单元，用于从所述安全策略中删除所述第一规则。
在一种实现方式中，所述第一处理单元，还用于在第二主体访问第二客体以执行第二操作时，基于所述安全策略确定所述第二主体没有访问所述第二客体以执行所述第二操作的权限，其中，所述第二客体未配置为permissive模式；所述第二处理单元，还用于拒绝所述第二主体访问所述第二客体以执行所述第二操作。
需要说明的是，本申请实施例第三方面提供的通信装置，具体实现方式以及达到的效果可以参见上述第一方面所示实施例中的相关说明，此处不再赘述。
第四方面，本申请实施例还提供了另一种通信装置，所述通信装置应用于操作系统中的安全模块，所述通信装置工作在许可permissive模式。所述通信装置例如可以包括：第一处理单元和第二处理单元。其中：第一处理单元，用于在第一主体访问第一客体以执行第一操作时，基于安全策略确定所述第一主体没有访问所述第一客体以执行所述第一操作的权限，所述第一主体或所述第一客体配置为强制enforcing模式；第二处理单元，用于拒绝所述第一主体访问所述第一客体以执行所述第一操作。
在一种实现方式中，所述安全策略包括第一规则，所述第一规则指示所述第一主体工作在所述enforcing模式；或者，所述安全策略包括第二规则，所述第二规则指示所述第一客体工作在所述enforcing模式。
在一种实现方式中，所述通信装置还包括：第三处理单元。其中，该第三处理单元，用于更新所述安全策略，所述更新后的安全策略包括第三规则，所述第三规则指示允许所述第一主体访问所述第一客体以执行所述第一操作。
在一种实现方式中，所述第一处理单元，还用于在第二主体访问第二客体以执行第二操作时，基于所述安全策略确定所述第二主体没有访问所述第二客体以执行所述第二操作的权限，其中，所述第二客体未配置为enforcing模式；所述第二处理单元，用于允许所述第二主体访问所述第二客体和所述第二主体并执行所述第二操作。
需要说明的是，本申请实施例第四方面提供的通信装置，具体实现方式以及达到的效果可以参见上述第二方面所示实施例中的相关说明，此处不再赘述。
第五方面，本申请提供了一种通信装置，所述通信装置包括存储器和处理器；所述存储器，用于存储程序代码；所述处理器，用于运行所述程序代码中的指令，使得所述通信装置执行以上第一方面以及第一方面任意一项所述的方法，或者，使得所述通信装置执行以上第二方面以及第二方面任意一项所述的方法。
第六方面，本申请提供了一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得所述计算机执行以上第一方面以及第一方面任意一项所述的方法，或者，使得所述计算机执行以上第二方面以及第二方面任意一项所述的方法。
第七方面，本申请提供了一种计算机程序产品，包括程序，当所述程序在处理器上运行时，实现以上第一方面以及第一方面任意一项所述的方法，或者，实现以上第二方面以及第二方面任意一项所述的方法。
第八方面，本申请提供了一种服务器，所述服务器中存储程序代码，所述程序代码被处理器运行时，实现以上第一方面以及第一方面任意一项所述的方法，或者，实现以上第二方面以及第二方面任意一项所述的方法。
附图说明
图1为本申请实施例中一种Linux操作系统10的结构示意图；
图2为本申请实施例中一种MAC方法在一示例下的流程示意图；
图3为本申请实施例中一种MAC方法100的流程示意图；
图4为本申请实施例中另一种MAC方法200的流程示意图；
图5为本申请实施例中又一种MAC方法300的流程示意图；
图6为本申请实施例提供的一种通信装置的结构示意图；
图7为本申请实施例提供的一种通信装置的结构示意图。
具体实施方式
下面将结合附图，对本申请实施例中的技术方案进行描述。本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
本申请中的“1”、“2”、“3”、“第一”、“第二”以及“第三”等序数词用于对多个对象进行区分，不用于限定多个对象的顺序。
本申请中提及的“A和/或B”，应该理解为包括以下情形：仅包括A，仅包括B，或者同时包括A和B。
本申请实施例提供了一种由安全模块执行的MAC方法，提高了操作系统中MAC机制的灵活性和安全性。其中，安全模块集成在可以基于安全标签(英文：security label)进行MAC的操作系统中，例如可以是操作系统内核中的安全模块。
为了方便理解，下面对于本申请涉及的一些技术术语作简单解释说明。
安全模块，是指能够基于MAC机制对该安全模块所在的操作系统进行安全增强的模块，用于提高该操作系统的安全防护能力。例如，Linux操作系统中的安全模块，可以是SELinux；又例如，Android操作系统中的安全模块，可以是SEAndroid。安全模块对于操作系统中主体访问客体以执行操作的权限进行管理和控制，这种权限的限制能够有效克服攻击源伪装为操作系统管理者对操作系统进行攻击的问题，降低风险发生的可能性。
主体，在本申请实施例中可以指进程。“主体”和“进程”在MAC机制中可能经常交替使用，应理解，二者指代相同的含义。
客体，在本申请实施例中也可以称为资源，指主体访问的对象。客体例如可以包括但不限于：文件(英文：file)、目录(英文：dir)、文件系统(英文：filesystem)、网络端口和设备。
主体访问客体以执行的操作，在本申请实施例中可以包括但不限于：读、写、创建、查询、卸载、挂载等。例如，客体为文件时，主体访问客体以执行的操作可以包括但不限于：进程访问文件以执行读、写和创建操作中的至少一种；又例如，客体为文件系统时，体访问客体以执行的操作可以包括但不限于：进程访问文件系统以执行挂载和卸载操作中的至少一种。具体实现时，主体访问客体以执行操作可以通过命令行体现，运行命令行启动该“主体访问客体以执行操作”的进程，生成对应的可执行文件，从而安全模块对该“主体访问客体以执行操作”进行MAC。
安全策略(英文：security policy)，是安全模块对主体访问客体以执行操作的权限进行管理和控制的依据。安全策略中包括不同的规则，规则的类型包括但不限于：各个主体的安全标签、各个客体的安全标签、以及主体访问客体以执行操作的权限(如允许(英文：allow)规则)。
安全标签(英文：security label)也可以称为安全上下文(英文：security context)，通常可以是包括多个字段的语句，一条语句与一个主体或一个客体对应，用于描述该语句对应的主体或客体，该语句中的每个字段指定所描述的主体或客体的一个属性。其中，主体的安全标签包括但不限于该主体的下述属性：用户、角色和主体类型，客体的安全标签包括但不限于该客体的下述属性：用户、角色和客体类型。例如，/usr/bin/ftpput文件执行后的主体1(即进程ftpput)的安全标签可以为system_u:system_r:os_ftp_t，其中，system_u为主体1对应的用户名称，system_r为主体1对应的角色名称，os_ftp_t为主体1对应的主体类型，可选地，在主体类型之后，还可以增加主体1对应的安全级别的属性字段，如s0:c0；客体1的安全标签可以为：system_u:object_r:os_dev_t，其中，system_u为客体1对应的用户名称，object_r为客体1对应的角色名称，os_dev_t为客体1对应的客体类型，可选地，在客体类型之后，还可以增加客体1对应的安全级别的属性字段，如s0:c0。需要说明的是，对于操作系统中可能出现的主体和客体，均可以在security policy中定义各主体和客体对应的安全标签，以描述各主体和各客体的属性。主体类型可以视作该security policy中对一个或多个主体的统一名称，每个主体类型可以对应一个主体，也可以对应多个主体；同理，客体类型可以视作该security policy中对一个或多个客体的统一名称，每个客体类型可以对应一个客体也可以对应多个客体。一个或多个主体类型可以对应一个角色，一个或多个客体类型可以对应一个角色。
主体访问客体以执行操作的权限，用于指示主体能够访问的客体类型、客体分类(英文：Object class，也可以理解为允许访问的客体的具体格式)以及允许执行的操作，可以通过包括多个字段的一条语句表示，一条语句与主体访问客体以执行操作的一个权限对应，用于描述该主体访问客体以执行操作的权限，以allow规则为例，allow规则的格式可以为：allow主体类型客体类型：客体分类{允许执行的操作}。例如，security policy中包括主体1访问客体1以执行操作对应的allow规则1可以是：allow os_ftp_t os_dev_t:file{read write}，其中，allow指示该规则1的类型为允许访问，os_ftp_t为主体1对应的主体类型os_dev_t为客体1对应的客体类型，file指示允许访问格式为普通文件的客体，{read write}指示允许执行读和写的操作。其中，一条allow规则中，客体分类以及允许执行的操作均 可以包括至少一个，当客体分类或允许执行的操作为多个时，可以将多个客体分类或允许执行的操作写入一个大括号(即，{})中。需要说明的是，当多个主体类型的权限相同(即，将多个主体类型对应到不同的allow规则中，仅主体类型不同，其他内容均相同)时，为了节约security policy中的资源，可以在security policy中以一条allow规则体现，该allow规则可以表示为：allow主体标签{主体类型1主体类型2…}客体类型：客体分类{允许执行的操作}；同理，当多个客体类型的权限相同时，可以在security policy中以一条allow规则体现，该allow规则可以表示为：allow主体类型客体标签{客体类型1客体类型2…}：客体分类{允许执行的操作}；或者，当多个客体类型和多个客体对应的权限均相同时，可以在security policy中以一条allow规则体现，该allow规则可以表示为：allow主体标签{主体类型1主体类型2…}客体标签{客体类型1客体类型2…}：客体分类{允许执行的操作}。上述主体标签可以是安全模块中为该多个权限相同的主体类型定义的标签，该多个主体类型和该主体标签对应；客体标签可以是安全模块中为该多个权限相同的客体类型定义的标签，该多个客体类型和该客体标签对应。例如，主体类型os_ftp_t1和主体类型os_ftp_t2在安全模块中有相关的权限，定义两者对应的主体标签为A，客体类型os_dev_t1、客体类型os_dev_t2和客体类型os_dev_t3在安全模块中有相关的权限，定义三者对应的客体标签为B，那么，且安全模块中包括一条允许主体标签A访问主体标签B中file格式的资源以执行读和写操作的allow规则，那么，该allow规则例如可以表示为：allow A{os_ftp_t1os_ftp_t2}B{os_dev_t1os_dev_t2os_dev_t3}:file{read write}。
安全模块的工作模式包括强制(英文：enforcing)模式和允许(英文：permissive)模式。目前，当安全模块工作在enforcing模式时，该安全模块对于security policy中没有主体访问客体以执行操作的权限的情况，一律拒绝该主体访问该客体以执行该操作。例如，在enforcing模式下，安全模块在主体1访问客体1以执行操作1时，获得主体1对应的主体类型和客体1对应的客体类型，在security policy中根据所获得的主体类型和客体类型未匹配到allow规则，则，确定主体1没有访问客体1以执行操作1的权限，所以，安全模块拒绝主体1访问客体1以执行操作1。当安全模块工作在permissive模式时，该安全模块对于security policy中没有主体访问客体以执行操作的权限的情况，一律允许该主体访问该客体并执行该操作。例如，在permissive模式下，安全模块在主体2访问客体2以执行操作2时，获得主体2对应的主体类型和客体2对应的客体类型，在security policy中根据所获得的主体类型和客体类型未匹配到allow规则，则，确定主体2没有访问客体2以执行操作2的权限，但安全模块允许主体2访问客体2并执行操作2。需要说明的是，无论是enforcing模式还是permissive模式，安全模块在确定主体没有访问客体以执行操作的权限时，均会生成对应的日志，记录主体访问客体以执行操作相关联的信息，例如，生成的日志记录的内容可以包括但不限于：主体的安全标签、客体的安全标签、本次MAC任务的情况(哪个主体访问哪个客体，执行的是哪个操作)、以MAC任务的执行结果(是允许执行还是拒绝执行)等。其中，生成的日志可以是系统日志，如访问向量缓存(英文：access vector cache，简称：avc)日志，可以存放在系统审计(英文：audit)日志文件中。
目前的MAC机制中，安全模块的工作模式可以视作操作系统级的“总开关”，该“总开 关”的状态影响所有没有在security policy中匹配到主体访问客体以执行操作权限的情况的决策，这就要求前期梳理的security policy是绝对全面和准确的，否则，这样操作系统级的“总开关”控制粒度较粗，对操作系统的安全性和业务的正常运行均有影响。基于此，本申请实施例提供了一种更加灵活和安全的MAC方法，能够在操作系统级的“总开关”下针对性的细化控制方式。
随着操作系统所在通信装置越来越复杂，梳理出的security policy很难包括所有应该具有主体访问客体以执行操作的权限对应的规则，所以，目前对于安全模块处于enforcing模式时，“一律拒绝访问”的MAC机制在很多情况下，很可能不仅无法提高该操作系统的安全性，还会使得正常运行的业务出现中断的风险。
在本申请实施例的第一种可能的实现方式中，为了解决目前MAC机制中针对安全模块工作在enforcing模式下存在的问题，提供了一种灵活且安全的MAC方式。该MAC方式中，针对工作在enforcing模式的安全模块，能够根据实际需求在security policy中为部分客体配置permissive模式，这样，当主体访问客体以执行操作时，该安全模块基于security policy确定该主体没有访问该客体以执行该操作的权限，如果该客体被配置为permissive模式，则，允许该主体访问该客体并执行该操作。这样，安全模块在“总开关”的状态为enforcing模式时，根据客体是否配置了permissive模式灵活的确定该主体访问客体以执行操作的行为应该被允许还是被拒绝，提高了MAC机制的灵活性和安全性。即使在操作系统所在的通信装置较为复杂，梳理的security policy中遗漏了该主体访问该客体以执行该操作的权限，也可以通过配置该客体为permissive模式保证该主体能够访问该客体并执行该操作，从而保证包括该主体访问该客体以执行该操作的业务正常运行，不会被中断。而且，该MAC方法中，安全模块在梳理security policy时，可以基于客体进行梳理，将需要开放权限的客体设置为permissive模式，无需全面的将所有的主体访问客体以执行操作的权限均梳理到security policy中，降低了梳理security policy的工作量。需要说明的是，该实现方式提供的MAC方法的具体实现方式以及达到的技术效果的相关描述可以参见下述图3所示的方法100。
此外，目前对于安全模块处于permissive模式时，“一律允许访问”的MAC机制，与安全模块通过对主体访问客体以执行操作的权限进行管理和控制的方式，实现对操作系统安全增强的效果背离，无法保证操作系统的安全性。
在本申请实施例的第二种可能的实现方式中，为了解决目前MAC机制中针对安全模块工作在permissive模式下存在的问题，提供了一种灵活且安全的MAC方式。该MAC方式中，针对工作在permissive模式的安全模块，能够根据实际需求在security policy中为部分主体或客体配置enforcing模式，当主体访问客体以执行操作时，该安全模块基于security policy确定该主体没有访问该客体以执行该操作的权限，如果该主体或客体被配置为enforcing模式，则，拒绝该主体访问该客体并执行该操作。这样，安全模块在“总开关”的状态为permissive模式时，根据主体或客体是否配置了enforcing模式灵活的确定该主体访问客体以执行操作的行为应该被允许还是被拒绝，提高了MAC机制的灵活性和安全性。而且，该MAC方法中，安全模块在梳理security policy时，可以基于客体或主体进行梳理， 将需要强制拒绝执行的主体或客体设置为enforcing模式，保证安全模块对操作系统的安全增强作用，无需全面的将所有的主体访问客体以执行操作的权限均梳理到security policy中，降低了梳理security policy的工作量。需要说明的是，该实现方式提供的MAC方法的具体实现方式以及达到的技术效果的相关描述可以参见下述图4所示的方法200和图5所示的方法300。
需要说明的是，本申请实施例提供的安全模块，可以集成在操作系统中，操作系统例如可以安装在网络装置的单板上，一个网络通信装置可以包括至少一个单板。其中，网络装置例如可以是路由器、交换机、防火墙或物联网(英文：Internet of Things，简称：IoT)终端。或者，本申请实施例提供的安全模块，也可以是待集成的程序产品或计算机可读存储介质，供用户在有对操作系统进行安全增强的需求时集成在该操作系统中。又或者，本申请实施例提供的安全模块，也可以是服务器上存储的程序代码，供用户在有对操作系统进行安全增强的需求时，从该服务器上下载并在该操作系统中集成，以实现对该操作系统的安全增强。
本申请实施例中提及的通信装置，可以是交换机、路由器防火墙或IoT终端等网络设备，也可以是网络设备上的一部分组件，例如是网络设备上的单板，线卡，可以是网络设备上的一个功能模块，还可以是用于实现本申请方法的芯片，本申请实施例不做具体限定。
以安全模式为SELinux为例，图1为本申请实施例中一种Linux操作系统10的架构示意图。参见图1，该Linux操作系统10可以包括用户空间(英文：user space)100和内核空间(英文：kernel space)200，其中，用户空间100可以包括：应用程序(英文：application，简称：App)110和SELinux策略管理单元120，内核空间200可以包括自主访问控制检测(英文：discretionary access control check，简称：DAC Check)210、Linux安全模块(英文：Linux security module，简称：LSM)220、SELinux 230和Linux审计(英文：Audit)240。内核空间200和用户空间100包括系统调用(英文：Syscall)模块12。其中，LSM 220允许安全模块以插件形式进入内核，在内核调用逻辑中提供一套钩子，钩子可以指权限检查的函数接口。DAC Check 210用于执行DAC机制，DAC机制可以理解为由主体的身份和该主体所属的组限制对客体的访问，拥有访问权限的主体将访问权限赋予其他主体，对权限的管理和控制的限制较为宽松。
Linux操作系统10中的安全模块不仅包括SELinux策略管理单元120，还包括SELinux 230，其中，该SELinux 230中可以包括：SELinux钩子(英文：Hooks)231、SELinux文件系统(英文：filesystem)232、访问向量缓存(英文：access vector cache，简称：avc)233、安全服务器(英文：security server)234和策略数据库(英文：policy database)235。具体实现时，可以通过在SELinux策略管理单元120中定义security policy，并通过SELinux filesystem 232和security server 234加载到policy database 235中。
作为一个示例，如果发生了主体1访问客体1以执行操作1的行为，那么，Linux操作系统10的MAC过程参见图2，例如可以包括：S11，DAC Check 210对该行为进行检测，如果通过，则执行S12，否则，执行S18；S12，SELinux 230根据主体1对应的主体类型、客体1对应的客体类型和操作1，从policy database 235中查询security policy中是否有匹配 的规则，如果有，则，执行S16，否则，执行S13；S13，判断SELinux 230工作在permissive模式还是enforcing模式，如果工作在enforcing模式，则执行S14，如果工作在permissive模式，则执行S24。当SELinux 230工作在enforcing模式，S14，判断客体1对应的客体类型是否被配置为permissive模式，如果是，则执行S15～S16，否则执行S17～S18；S15，生成日志1，该日志1记录的内容例如可以包括：主体1的安全标签、客体1的安全标签、主体1访问客体1执行操作1被允许以及permissive＝1(指示客体1配置为permissive模式后被允许执行)；S16，允许主体1访问客体1并执行操作1；S17，生成日志2，该日志2记录的内容例如可以包括：主体1的安全标签、客体1的安全标签、主体1访问客体1执行操作1被拒绝以及permissive＝0(指示客体1未配置为permissive模式被拒绝执行)；S18，拒绝主体1访问客体1以执行操作1。当SELinux 230工作在permissive模式，S24，判断支持主体的enforcing模式还是客体的enforcing模式，如果支持主体的enforcing模式，则执行S25，如果支持客体的enforcing模式，则执行S35。对于支持主体的enforcing模式，S25，判断主体1对应的主体类型是否被配置为enforcing模式，如果是，则执行S26和S18，否则执行S27和S16；S26，生成日志3，该日志3记录的内容例如可以包括：主体1的安全标签、客体1的安全标签、主体1访问客体1执行操作1被拒绝以及enforcing＝1(指示主体1配置为enforcing模式后被拒绝执行)；S27，生成日志4，该日志4记录的内容例如可以包括：主体1的安全标签、客体1的安全标签、主体1访问客体1执行操作1被允许以及enforcing＝0(指示主体1未配置为enforcing模式被允许执行)。对于支持客体的enforcing模式，S35，判断客体1对应的客体类型是否被配置为enforcing模式，如果是，则执行S36和S18，否则执行S37和S16；S36，生成日志5，该日志5记录的内容例如可以包括：主体1的安全标签、客体1的安全标签、主体1访问客体1执行操作1被拒绝以及enforcing＝1(指示客体1配置为enforcing模式后被拒绝执行)；S37，生成日志6，该日志6记录的内容例如可以包括：主体1的安全标签、客体1的安全标签、主体1访问客体1执行操作1被允许以及enforcing＝0(指示客体1未配置为enforcing模式被允许执行)。
本申请实施例中的图1以及上述MAC过程，只是为了方便理解本申请实施例提及的相关内容而作为可能的示例而示出，其并不构成对本申请实施例的限定。
以下结合附图介绍本申请实施例提供的MAC方法。下述方法可以由操作系统的安全模块执行，其中，操作系统可以是基于安全标签进行MAC的操作系统。例如，操作系统为基于Linux的操作系统，该操作系统中集成的安全模块可以为SELinux；又例如，操作系统为基于Android的操作系统，该操作系统中集成的安全模块可以为SEAndroid；再例如，操作系统为基于苹果(简称：iOS)的操作系统，该操作系统中集成的安全模块可以为SEiOS。
与上述第一种可能的实现方式对应，本申请实施例提供了一种MAC方法100。图3为本申请实施例提供的一种MAC方法100的流程示意图。执行该方法100的安全模块工作在enforcing模式，且支持客体的permissive模式。该MAC方法100，例如可以由图1中的Linux操作系统10中的SELinux 230执行。参见图3，该方法100例如可以包括S101～S102：
S101，在第一主体访问第一客体以执行第一操作时，基于安全策略确定第一主体没有 访问第一客体以执行第一操作的权限，第一客体配置为permissive模式。
S102，允许所述第一主体访问所述第一客体并执行所述第一操作。
安全策略中，还可以包括用于配置客体对应的客体类型为permissive模式的规则。假设第一客体对应的客体类型为os_dev_t，安全策略中可以包括第一规则，第一规则例如可以为：permissive os_dev_t，用于指示os_dev_t对应的所有客体均工作在permissive模式，例如，可以用于指示第一客体工作在permissive模式。
具体实现时，在第一主体访问第一客体以执行第一操作时，可以先获得第一主体对应的主体类型以及第一客体对应的客体类型，接着，从安全策略包括的主体访问客体以执行操作的权限中，查看是否有与第一主体访问第一客体以执行第一操作的行为匹配的权限。如果有，则，允许第一主体访问第一客体并执行第一操作；如果没有，则，可以确定第一主体没有访问第一客体以执行第一操作的权限，则，在安全策略中查看是否包括第一规则，如果包括第一规则，则可以确定第一客体配置为permissive模式，从而执行S102；如果不包括第一规则，则可以确定第一客体未配置为permissive模式，从而按照安全模块的“总开关”对该行为进行MAC，即，拒绝第一主体访问第一客体以执行第一操作。
其中，与第一主体访问第一客体以执行第一操作的行为匹配的权限，可以指安全策略中某条主体访问客体以执行操作的权限中，主体类型为第一主体对应的主体类型，客体类型为第一客体对应的客体类型，客体分类包括该第一客体的格式，且允许执行的操作中包括该第一操作。
第一客体配置为permissive模式，可以指第一客体对应的客体类型被配置为permissive模式，在具体实现时，可以查看安全策略中是否包括所获得的第一客体的客体类型对应的第一规则，如果包括，则，认为该第一客体被配置为permissive模式。
例如，安全模块的安全策略中，可以将操作系统中的一些非关键客体配置为permissive模式，实现对非关键客体的宽松访问；为了保证该操作系统的安全性，可以不配置关键客体或经过充分验证的客体为permissive模式，从而实现对这些客体的强制保护。
需要说明的是，可以在安全策略中将部分客体对应的客体类型配置为permissive模式，从而当主体访问这些客体时，不会对由于安全模块工作在enforcing模式而拒绝对这些客体的访问，能够避免由于安全策略中梳理的主体访问客体以执行操作的权限不全面导致本来安全运行的业务被迫中断的问题。
虽然可以对部分配置为permissive模式的客体执行S102，但是，为了记录该次允许执行安全策略中没有权限的行为，在S102之后，该方法100还可以包括：生成第一日志，该第一日志用于记录第一主体访问第一客体以执行所述第一操作相关联的信息。例如，第一日志可以为系统日志，记录的内容可以包括：第一主体的安全标签、第一客体的安全标签、第一主体访问第一客体执行第一操作被允许以及permissive＝1，其中，permissive＝1用于指示第一客体配置为permissive模式后该行为被允许执行。
对于第一主体访问第一客体以执行第一操作的行为，在S102之后，为了处理该异常，可以通过验证或测试进一步完善安全策略，使得后续再有第一主体访问第一客体以执行第一操作的行为发生时，能够按照完善后的安全策略准确的处理该行为。
作为一个示例，如果通过验证或测试，确定该第一主体访问第一客体以执行第一操作的行为属于安全的访问行为，由于梳理安全策略时的遗漏导致从安全策略中确定第一主体没有访问第一客体以执行第一操作的权限，那么，安全模块可以更新所述安全策略，使得更新后的安全策略包括第二规则，该第二规则指示允许第一主体访问第一客体以执行第一操作。例如，更新前的安全策略中不包括第二规则，更新后的安全策略中增加了第二规则，该第二规则可以是：allow第一主体的主体类型第一客体的客体类型：第一客体的客体分类第一操作。又例如，更新前的安全策略中包括关于第一主体访问第一客体的权限对应的规则，但是允许执行的操作类型不包括第一操作，那么，更新后的安全策略中可以对已有的关于第一主体访问第一客体的权限对应的规则进行更新，更新后记作第二规则，该第二规则可以是：allow第一主体的主体类型第一客体的客体类型：第一客体的客体分类{更新前允许执行的操作第一操作}。
作为另一个示例，如果通过验证或测试，确定该第一主体访问第一客体以执行第一操作的行为属于不安全的攻击行为，那么，为了安全起见，可以从安全策略中删除第一规则，这样，再有第一主体访问第一客体以执行第一操作的行为发生时，不仅基于安全策略确定第一主体没有访问第一客体以执行第一操作的权限，而且还可以确定第一客体未配置为permissive模式，从而，拒绝第一主体访问第一客体以执行第一操作，确保了操作系统的安全性。
可选地，该方法100例如还可以包括S103～S104：
S103，在第二主体访问第二客体以执行第二操作时，基于安全策略确定第二主体没有访问第二客体以执行第二操作的权限，其中，第二客体未配置为permissive模式。
S104，拒绝第二主体访问第二客体以执行第二操作。
为了记录该次允许执行安全策略中没有权限的行为，在S104之后，该方法100还可以包括：生成第二日志，该第二日志用于记录第二主体访问第二客体以执行所述第二操作相关联的信息。例如，第二日志可以为系统日志，记录的内容可以包括：第二主体的安全标签、第二客体的安全标签、第二主体访问第二客体执行第二操作被允许以及permissive＝0，其中，permissive＝0用于指示第二客体未配置为permissive模式且该行为被拒绝执行。
可见，该方法100中，安全模块在“总开关”的状态为enforcing模式时，根据客体是否配置了permissive模式灵活的确定该主体访问客体以执行操作的行为应该被允许还是被拒绝，提高了MAC机制的灵活性和安全性。即使在操作系统所在的通信装置较为复杂，梳理的security policy中遗漏了该主体访问该客体以执行该操作的权限，也可以通过配置该客体为permissive模式保证该主体能够访问该客体并执行该操作，从而保证包括该主体访问该客体以执行该操作的业务正常运行，不会被中断。而且，该MAC方法中，安全模块在梳理security policy时，可以基于客体进行梳理，将需要开放权限的客体设置为permissive模式，无需全面的将所有的主体访问客体以执行操作的权限均梳理到security policy中，降低了梳理security policy的工作量。
相比于目前安全模块工作在enforcing模式下为部分主体配置permissive模式的MAC机制，方法100提供的MAC方法100能够适用于主体访问客体以执行操作情况较为复杂 的情况，且对于操作系统量级较大的情况也能够灵活和安全的实现MAC。而且，在本申请实施例中，对于安全模块工作在enforcing模式的情况下，可以根据实际需要支持主体的permissive模式或客体的permissive模式，MAC方法更加灵活，对于用户而言该安全模块的使用更加友好。
需要说明的是，为了避免一个访问行为的主体和客体配置的模式发生冲突，导致无法对该访问行为实现MAC，只能支持主体的permissive模式或客体的permissive模式，而不能同时支持主体的permissive模式和客体的permissive模式。
与上述第二种可能的实现方式对应，本申请实施例提供了一种MAC方法200和MAC方法300。其中，MAC方法200的安全模块工作在permissive模式，且执行该方法200的安全模块支持主体的enforcing模式。MAC方法300的安全模块工作在permissive模式，且执行该方法300的安全模块支持客体的enforcing模式。需要说明的是，为了避免一个访问行为的主体和客体配置的模式发生冲突，导致无法对该访问行为实现MAC，只能支持主体的enforcing模式或客体的enforcing模式，而不能同时支持主体的enforcing模式和客体的enforcing模式。
图4为本申请实施例提供的一种MAC方法200的流程示意图。方法200中的安全模块工作在permissive模式，且支持主体的enforcing模式。该MAC方法200，例如可以由图1中的Linux操作系统10中的SELinux 230执行。参见图4，该方法200例如可以包括S201～S202：
S201，在第一主体访问第一客体以执行第一操作时，基于安全策略确定第一主体没有访问第一客体以执行第一操作的权限，第一主体配置为强制enforcing模式。
S202，拒绝第一主体访问第一客体以执行第一操作。
其中，安全策略可以包括第一规则，第一规则指示第一主体工作在enforcing模式。假设第一主体对应的主体类型为os_ftp_t，安全策略中可以包括第一规则，第一规则例如可以为：enforcing os_ftp_t，用于指示os_ftp_t对应的所有主体均工作在enforcing模式。
具体实现时，在第一主体访问第一客体以执行第一操作时，可以先获得第一主体对应的主体类型以及第一客体对应的客体类型，接着，从安全策略包括的主体访问客体以执行操作的权限中，查看是否有与第一主体访问第一客体以执行第一操作的行为匹配的权限。如果有，则，允许第一主体访问第一客体并执行第一操作；如果没有，则，可以确定第一主体没有访问第一客体以执行第一操作的权限，则，在安全策略中查看是否包括第一规则，如果包括第一规则，则可以确定第一主体配置为enforcing模式，从而执行S202；如果不包括第一规则，则可以确定第一主体未配置为enforcing模式，从而按照安全模块的“总开关”对该行为进行MAC，即，允许第一主体访问第一客体并执行第一操作。
第一主体配置为enforcing模式，可以指第一主体对应的主体类型被配置为enforcing模式，在具体实现时，可以查看安全策略中是否包括所获得的第一主体的主体类型对应的第一规则，如果包括，则，认为该第一主体被配置为enforcing模式。
例如，安全模块的安全策略中，可以将操作系统中的一些关键主体或经过充分验证的 主体配置为enforcing模式，实现对这些主体的强制保护；可以对非关键主体不配置为enforcing模式，从而实现对这些主体的宽松访问。
需要说明的是，可以在安全策略中将部分主体对应的主体类型配置为enforcing模式，从而当这些主体访问客体时，不会对由于安全模块工作在permissive模式而允许这些主体的访问，能够有效的提高该操作系统的安全性。
虽然可以对部分配置为enforcing模式的主体执行S202，但是，为了记录该次拒绝执行安全策略中没有权限的行为，在S202之后，该方法200还可以包括：生成第三日志，该第三日志用于记录第一主体访问第一客体以执行所述第一操作相关联的信息。例如，第三日志可以为系统日志，记录的内容可以包括：第一主体的安全标签、第一客体的安全标签、第一主体访问第一客体执行第一操作被拒绝以及enforcing＝1，其中，enforcing＝1用于指示第一主体配置为enforcing模式后该行为被拒绝执行。
对于第一主体访问第一客体以执行第一操作的行为，在S202之后，为了处理该异常，可以通过验证或测试进一步完善安全策略，使得后续再有第一主体访问第一客体以执行第一操作的行为发生时，能够按照完善后的安全策略准确的处理该行为。作为一个示例，如果通过验证或测试，确定该第一主体访问第一客体以执行第一操作的行为属于安全的访问行为，由于梳理安全策略时的遗漏导致从安全策略中确定第一主体没有访问第一客体以执行第一操作的权限，那么，安全模块可以更新所述安全策略，使得更新后的安全策略包括第三规则，该第三规则指示允许第一主体访问第一客体以执行第一操作。
可选地，该方法200例如还可以包括S203～S204：
S203，在第二主体访问第二客体以执行第二操作时，基于安全策略确定第二主体没有访问第二客体以执行第二操作的权限，其中，第二主体未配置为enforcing模式。
S204，允许第二主体访问第二客体并执行第二操作。
为了记录该次允许执行安全策略中没有权限的行为，在S204之后，该方法200还可以包括：生成第四日志，该第四日志用于记录第二主体访问第二客体以执行所述第二操作相关联的信息。例如，第四日志可以为系统日志，记录的内容可以包括：第二主体的安全标签、第二客体的安全标签、第二主体访问第二客体执行第二操作被允许以及enforcing＝0，其中，enforcing＝0用于指示第二主体未配置为enforcing模式且该行为被允许执行。
可见，该方法200中，安全模块在“总开关”的状态为permissive模式时，根据主体是否配置了enforcing模式灵活的确定该主体访问客体以执行操作的行为应该被允许还是被拒绝，提高了MAC机制的灵活性和安全性。而且，该MAC方法中，安全模块在梳理security policy时，可以基于主体进行梳理，将需要强制拒绝执行的主体设置为enforcing模式，保证安全模块对操作系统的安全增强作用，无需全面的将所有的主体访问客体以执行操作的权限均梳理到security policy中，降低了梳理security policy的工作量。
图5为本申请实施例提供的一种MAC方法300的流程示意图。方法300中的安全模块工作在permissive模式，且支持客体的enforcing模式。该MAC方法300，例如可以由图1中的Linux操作系统10中的SELinux 230执行。参见图5，该方法300例如可以包括 S301～S302：
S301，在第一主体访问第一客体以执行第一操作时，基于安全策略确定第一主体没有访问第一客体以执行第一操作的权限，第一客体配置为强制enforcing模式。
S302，拒绝第一主体访问第一客体以执行第一操作。
或者，安全策略包括第二规则，第二规则指示第一客体工作在enforcing模式。
其中，安全策略可以包括第二规则，第二规则指示第一客体工作在enforcing模式。假设第一客体对应的客体类型为os_dev_t，安全策略中可以包括第二规则，第二规则例如可以为：enforcing os_dev_t，用于指示os_dev_t对应的所有客体均工作在enforcing模式。
具体实现时，在第一主体访问第一客体以执行第一操作时，可以先获得第一主体对应的主体类型以及第一客体对应的客体类型，接着，从安全策略包括的主体访问客体以执行操作的权限中，查看是否有与第一主体访问第一客体以执行第一操作的行为匹配的权限。如果有，则，允许第一主体访问第一客体并执行第一操作；如果没有，则，可以确定第一主体没有访问第一客体以执行第一操作的权限，则，在安全策略中查看是否包括第二规则，如果包括第二规则，则可以确定第一客体配置为enforcing模式，从而执行S302；如果不包括第二规则，则可以确定第一客体未配置为enforcing模式，从而按照安全模块的“总开关”对该行为进行MAC，即，拒绝第一主体访问第一客体以执行第一操作。
第一客体配置为enforcing模式，可以指第一客体对应的客体类型被配置为enforcing模式，在具体实现时，可以查看安全策略中是否包括所获得的第一客体的客体类型对应的第二规则，如果包括，则，认为该第一客体被配置为enforcing模式。
例如，安全模块的安全策略中，可以将操作系统中的一些关键客体或经过充分验证的客体配置为enforcing模式，实现对这些客体的强制保护；可以对非关键客体不配置为enforcing模式，从而实现对这些客体的宽松访问。
需要说明的是，可以在安全策略中将部分客体对应的客体类型配置为enforcing模式，从而当主体访问这些客体时，不会对由于安全模块工作在permissive模式而允许对这些客体的访问，能够有效的提高该操作系统的安全性。
虽然可以对部分配置为enforcing模式的客体执行S302，但是，为了记录该次拒绝执行安全策略中没有权限的行为，在S302之后，该方法300还可以包括：生成第五日志，该第五日志用于记录第一主体访问第一客体以执行所述第一操作相关联的信息。例如，第五日志可以为系统日志，记录的内容可以包括：第一主体的安全标签、第一客体的安全标签、第一主体访问第一客体执行第一操作被拒绝以及enforcing＝1，其中，enforcing＝1用于指示第一客体配置为enforcing模式后该行为被拒绝执行。
对于第一主体访问第一客体以执行第一操作的行为，在S302之后，为了处理该异常，可以通过验证或测试进一步完善安全策略，使得后续再有第一主体访问第一客体以执行第一操作的行为发生时，能够按照完善后的安全策略准确的处理该行为。作为一个示例，如果通过验证或测试，确定该第一主体访问第一客体以执行第一操作的行为属于安全的访问行为，由于梳理安全策略时的遗漏导致从安全策略中确定第一主体没有访问第一客体以执行第一操作的权限，那么，安全模块可以更新所述安全策略，使得更新后的安全策略包括 第三规则，该第三规则指示允许第一主体访问第一客体以执行第一操作。
可选地，该方法300例如还可以包括S303～S304：
S303，在第二主体访问第二客体以执行第二操作时，基于安全策略确定第二主体没有访问第二客体以执行第二操作的权限，其中，第二客体未配置为enforcing模式。
S304，允许第二主体访问第二客体并执行第二操作。
为了记录该次允许执行安全策略中没有权限的行为，在S304之后，该方法300还可以包括：生成第六日志，该第六日志用于记录第二主体访问第二客体以执行所述第二操作相关联的信息。例如，第六日志可以为系统日志，记录的内容可以包括：第二主体的安全标签、第二客体的安全标签、第二主体访问第二客体执行第二操作被允许以及enforcing＝0，其中，enforcing＝0用于指示第二客体未配置为enforcing模式且该行为被允许执行。
可见，该方法300中，安全模块在“总开关”的状态为permissive模式时，根据客体是否配置了enforcing模式灵活的确定该主体访问客体以执行操作的行为应该被允许还是被拒绝，提高了MAC机制的灵活性和安全性。而且，该MAC方法中，安全模块在梳理security policy时，可以基于客体进行梳理，将需要强制拒绝执行的客体设置为enforcing模式，保证安全模块对操作系统的安全增强作用，无需全面的将所有的主体访问客体以执行操作的权限均梳理到security policy中，降低了梳理security policy的工作量。
在本申请实施例中，对于安全模块工作在permissive模式的情况下，可以根据实际需要支持主体的enforcing模式或客体的enforcing模式，MAC方法更加灵活，对于用户而言该安全模块的使用更加友好。
为了更加清楚和直观的介绍本申请实施例，下面以SELinux场景中的具体示例进行说明。
作为一个示例，安全模块工作在enforcing模式，且支持客体的permissive模式。安全策略中包括：
system_u:system_r:os_ftp_a；//主体类型a的安全上下文，主体类型a至少对应主体1
system_u:object_r:os_dev_A；//客体类型A的安全上下文，客体类型A至少对应客体1
system_u:object_r:os_dev_B；//客体类型B的安全上下文，客体类型B至少对应客体2
system_u:object_r:os_dev_C；//客体类型C的安全上下文，客体类型C至少对应客体3
allow os_ftp_a os_dev_C：filesystem{mount umount}//允许os_ftp_a访问os_dev_B中filesystem格式的客体以执行读和写的操作
allow os_ftp_a os_dev_B：file{read write}//允许os_ftp_a访问os_dev_C中file格式的客体以执行挂载和卸载的操作
permissive os_dev_A；//将客体类型os_dev_A配置为permissive模式
permissive os_dev_C；//将客体类型os_dev_C配置为permissive模式
那么，在该示例中，针对主体1访问客体1以执行读操作时所进行MAC的过程可以包括：安全模块可以先确定主体1对应的主体类型为os_ftp_a，确定客体1对应的客体类型为os_dev_A；基于安全策略中，确认没有与os_ftp_a和os_dev_A匹配的规则，从而确定 主体1没有访问客体1以执行读操作的权限；基于安全策略匹配规则permissive os_dev_A，该规则中，将客体1对应的客体类型配置为permissive模式；基于匹配的规则，允许主体1访问客体1并执行读操作。
作为另一个示例，安全模块工作在permissive模式，且支持主体的enforcing模式。安全策略包括：
system_u:system_r:os_ftp_a；//主体类型a的安全上下文，主体类型a至少对应主体1
system_u:system_r:os_ftp_b；//主体类型b的安全上下文，主体类型b至少对应主体2
system_u:object_r:os_dev_A；//客体类型A的安全上下文，客体类型A至少对应客体1
system_u:object_r:os_dev_B；//客体类型B的安全上下文，客体类型B至少对应客体2
system_u:object_r:os_dev_C；//客体类型C的安全上下文，客体类型C至少对应客体3
allow os_ftp_a os_dev_C：filesystem{mount umount}//允许os_ftp_a访问os_dev_B中filesystem格式的客体以执行读和写的操作
allow os_ftp_a os_dev_B：file{read write}//允许os_ftp_a访问os_dev_C中file格式的客体以执行挂载和卸载的操作
enforcing os_ftp_a；//将主体类型os_ftp_a配置为enforcing模式
那么，该示例中，针对主体1访问客体2以执行查询操作所进行的MAC过程可以包括：安全模块可以先确定主体1对应的主体类型为os_ftp_a，确定客体2对应的客体类型为os_dev_B；由于所述安全策略中匹配os_ftp_a和os_dev_B的规则为allow os_ftp_a os_dev_B：file{read write}，即允许执行主体1对客体2所执行的操作不包括查询操作，因而可以确定主体1没有访问客体2以执行查询操作的权限；进一步地，确认安全策略中包括与主体1匹配的规则enforcing os_ftp_a，该规则中，将主体1对应的主体类型配置为enforcing模式；根据该规则，拒绝主体1访问客体2以执行查询操作。
作为又一个示例，如果安全模块工作在permissive模式，且支持客体的enforcing模式。安全策略包括：
system_u:system_r:os_ftp_a；//主体类型a的安全上下文，主体类型a至少对应主体1
system_u:system_r:os_ftp_b；//主体类型b的安全上下文，主体类型b至少对应主体2
system_u:object_r:os_dev_A；//客体类型A的安全上下文，客体类型A至少对应客体1
system_u:object_r:os_dev_B；//客体类型B的安全上下文，客体类型B至少对应客体2
system_u:object_r:os_dev_C；//客体类型C的安全上下文，客体类型C至少对应客体3
allow os_ftp_a os_dev_C：filesystem{mount umount}//允许os_ftp_a访问os_dev_B中filesystem格式的客体以执行读和写的操作
allow os_ftp_a os_dev_B：file{read write}//允许os_ftp_a访问os_dev_C中file格式的客体以执行挂载和卸载的操作
enforcing os_dev_B；//将客体类型os_dev_B配置为enforcing模式
那么，该示例中，针对主体2访问客体2以执行读操作所进行的MAC过程可以包括：安全模块确定主体2对应的主体类型为os_ftp_b，确定客体2对应的客体类型为os_dev_B； 基于所述安全策略中，确定没有同时匹配os_ftp_b和os_dev_B匹配的规则，从而确定主体2没有访问客体2以执行读操作的权限；然后，确认安全策略中包括规则enforcing os_dev_B，该规则中，将客体2对应的客体类型配置为enforcing模式；根据该规则，拒绝主体2访问客体2以执行读操作。
可见，基于本申请实施例提供的MAC方法，在有待执行主体访问客体以执行操作的情况下，安全模块能够在确保安全的前提下灵活的确定该主体访问客体以执行操作的行为应该被允许还是被拒绝，提高了MAC机制的灵活性和安全性。
此外，本申请实施例还提供了一种通信装置600，参见图6所示。图6为本申请实施例提供的一种通信装置600的结构示意图。该通信装置600包括第一处理单元601和第二处理单元602。该通信装置600可以用于执行以上实施例中的方法100、方法200或方法300。
当通信装置600执行上述方法100时：
第一处理单元601，用于在第一主体访问第一客体以执行第一操作时，基于安全策略确定所述第一主体没有访问所述第一客体以执行所述第一操作的权限，所述第一客体配置为许可permissive模式；第二处理单元602，用于允许所述第一主体访问所述第一客体并执行所述第一操作。
其中，第一处理单元601执行操作的具体实现方式以及达到的效果，可以参见方法100中的S101的相关描述。第二处理单元602执行操作的具体实现方式以及达到的效果，可以参见方法100中的S102的相关描述。
在一种实现方式中，所述安全策略包括第一规则，所述第一规则指示所述第一客体工作在所述permissive模式。
在一种实现方式中，所述通信装置600还包括：第三处理单元。该第三处理单元，用于在允许所述第一主体访问所述第一客体并执行所述第一操作之后，生成第一日志，所述第一日志用于记录所述第一主体访问所述第一客体以执行所述第一操作相关联的信息。
在一种实现方式中，所述通信装置600还包括：第四处理单元。其中，该第四处理单元，用于更新所述安全策略，所述更新后的安全策略包括第二规则，所述第二规则指示允许所述第一主体访问所述第一客体以执行所述第一操作。
在一种实现方式中，所述通信装置600还包括：第五处理单元。其中，该第五处理单元，用于从所述安全策略中删除所述第一规则。
在一种实现方式中，所述第一处理单元601，还用于在第二主体访问第二客体以执行第二操作时，基于所述安全策略确定所述第二主体没有访问所述第二客体以执行所述第二操作的权限，其中，所述第二客体未配置为permissive模式；所述第二处理单元602，还用于拒绝所述第二主体访问所述第二客体以执行所述第二操作。该实现方式中，第一处理单元601执行操作的具体实现方式以及达到的效果，可以参见方法100中的S103的相关描述。第二处理单元602执行操作的具体实现方式以及达到的效果，可以参见方法100中的S104的相关描述。
当通信装置600执行上述方法200时：
第一处理单元601，用于在第一主体访问第一客体以执行第一操作时，基于安全策略确定所述第一主体没有访问所述第一客体以执行所述第一操作的权限，所述第一主体配置为强制enforcing模式；第二处理单元602，用于拒绝所述第一主体访问所述第一客体以执行所述第一操作。
其中，第一处理单元601执行操作的具体实现方式以及达到的效果，可以参见方法200中的S201的相关描述。第二处理单元602执行操作的具体实现方式以及达到的效果，可以参见方法200中的S202的相关描述。
在一种实现方式中，所述安全策略包括第一规则，所述第一规则指示所述第一主体工作在所述enforcing模式。
在一种实现方式中，所述通信装置600还包括：第三处理单元。其中，该第三处理单元，用于更新所述安全策略，所述更新后的安全策略包括第三规则，所述第三规则指示允许所述第一主体访问所述第一客体以执行所述第一操作。
在一种实现方式中，所述第一处理单元601，还用于在第二主体访问第二客体以执行第二操作时，基于所述安全策略确定所述第二主体没有访问所述第二客体以执行所述第二操作的权限，其中，所述第二主体未配置为enforcing模式；所述第二处理单元602，用于允许所述第二主体访问所述第二客体和所述第二主体并执行所述第二操作。该实现方式中，第一处理单元601执行操作的具体实现方式以及达到的效果，可以参见方法200中的S203的相关描述。第二处理单元602执行操作的具体实现方式以及达到的效果，可以参见方法200中的S204的相关描述。
当通信装置600执行上述方法300时：
第一处理单元601，用于在第一主体访问第一客体以执行第一操作时，基于安全策略确定所述第一主体没有访问所述第一客体以执行所述第一操作的权限，所述第一客体配置为强制enforcing模式；第二处理单元602，用于拒绝所述第一主体访问所述第一客体以执行所述第一操作。
其中，第一处理单元601执行操作的具体实现方式以及达到的效果，可以参见方法300中的S301的相关描述。第二处理单元602执行操作的具体实现方式以及达到的效果，可以参见方法300中的S302的相关描述。
在一种实现方式中，所述安全策略包括第二规则，所述第二规则指示所述第一客体工作在所述enforcing模式。
在一种实现方式中，所述通信装置600还包括：第三处理单元。其中，该第三处理单元，用于更新所述安全策略，所述更新后的安全策略包括第三规则，所述第三规则指示允许所述第一主体访问所述第一客体以执行所述第一操作。
在一种实现方式中，所述第一处理单元601，还用于在第二主体访问第二客体以执行第二操作时，基于所述安全策略确定所述第二主体没有访问所述第二客体以执行所述第二操作的权限，其中，所述第二客体未配置为enforcing模式；所述第二处理单元602，用于允许所述第二主体访问所述第二客体和所述第二主体并执行所述第二操作。该实现方式中， 第一处理单元601执行操作的具体实现方式以及达到的效果，可以参见方法300中的S303的相关描述。第二处理单元602执行操作的具体实现方式以及达到的效果，可以参见方法300中的S304的相关描述。
此外，本申请实施例还提供了一种通信装置700，参见图7所示，图7为本申请实施例提供的一种通信装置700的结构示意图。该通信装置700可以用于执行以上实施例中的方法100、方法200或方法300。
如图7所示，通信装置700可以包括处理器710，与所述处理器710耦合连接的存储器720。处理器710可以是中央处理器(英文：central processing unit，缩写：CPU)，网络处理器(英文：network processor，缩写：NP)或者CPU和NP的组合。处理器还可以是专用集成电路(英文：application-specific integrated circuit，缩写：ASIC)，可编程逻辑器件(英文：programmable logic device，缩写：PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(英文：complex programmable logic device，缩写：CPLD)，现场可编程逻辑门阵列(英文：field-programmable gate array，缩写：FPGA)，通用阵列逻辑(英文：generic array logic,缩写：GAL)或其任意组合。处理器710可以是指一个处理器，也可以包括多个处理器。存储器720可以包括易失性存储器(英文：volatile memory)，例如随机存取存储器(英文：random-access memory，缩写：RAM)；存储器也可以包括非易失性存储器(英文：non-volatile memory)，例如只读存储器(英文：read-only memory，缩写：ROM)，快闪存储器(英文：flash memory)，硬盘(英文：hard disk drive，缩写：HDD)或固态硬盘(英文：solid-state drive，缩写：SSD)；存储器720还可以包括上述种类的存储器的组合。存储器720可以是指一个存储器，也可以包括多个存储器。在一个实施方式中，存储器720中存储有计算机可读指令，所述计算机可读指令包括多个软件模块，例如第一处理模块721和第二处理模块722，此外，还可以包括第三处理模块、第四处理模块和第五处理模块中的至少一个，可以分别对应于上述通信装置600中的第一处理单元601、第二处理单元602、第三处理单元、第四处理单元和第五处理单元。处理器710执行各个软件模块后可以按照各个软件模块的指示进行相应的操作。在本实施例中，一个软件模块所执行的操作实际上是指处理器710根据所述软件模块的指示而执行的操作。例如，第一处理模块721执行的“在第一主体访问第一客体以执行第一操作时，基于安全策略确定所述第一主体没有访问所述第一客体以执行所述第一操作的权限”，实际上可以指处理器710根据该第一处理模块721的指示而执行的“在第一主体访问第一客体以执行第一操作时，基于安全策略确定所述第一主体没有访问所述第一客体以执行所述第一操作的权限”，此时，该第一处理模块721可以对应于通信装置600中的第一处理单元601。
在一个示例中，所述通信装置700可以执行以上实施例中的方法100，当通信装置700用于执行以上实施例中的方法100时：处理器710用于执行方法100中所有处理相关的操作。例如，所述处理器710用于在第一主体访问第一客体以执行第一操作时，基于安全策略确定所述第一主体没有访问所述第一客体以执行所述第一操作的权限，所述第一客体配置为许可permissive模式，允许所述第一主体访问所述第一客体并执行所述第一操作。
在一个示例中，所述通信装置700可以执行以上实施例中的方法200，当通信装置700 用于执行以上实施例中的方法200时：处理器710用于执行方法200中所有处理相关的操作。例如，所述处理器710用于在第一主体访问第一客体以执行第一操作时，基于安全策略确定所述第一主体没有访问所述第一客体以执行所述第一操作的权限，所述第一主体配置为强制enforcing模式，拒绝所述第一主体访问所述第一客体以执行所述第一操作。
在一个示例中，所述通信装置700可以执行以上实施例中的方法300，当通信装置700用于执行以上实施例中的方法300时：处理器710用于执行方法300中所有处理相关的操作。例如，所述处理器710用于在第一主体访问第一客体以执行第一操作时，基于安全策略确定所述第一主体没有访问所述第一客体以执行所述第一操作的权限，所述第一客体配置为强制enforcing模式，拒绝所述第一主体访问所述第一客体以执行所述第一操作。
本申请还提供了一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得所述计算机执行前述实施例中任一实施例所述的方法(例如，方法100、方法200和方法300)中任意一个或多个操作。
本申请还提供了一种计算机程序产品，包括计算机程序，当其在计算机上运行时，使得所述计算机执行前述实施例中任一实施例所述的方法(例如，方法100、方法200和方法300)中任意一个或多个操作。
本申请提供了一种服务器，所述服务器中存储程序代码，所述程序代码被处理器运行时，实现前述实施例中任一实施例所述的方法(例如，方法100、方法200和方法300)中任意一个或多个操作。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”、“第四”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，单元的划分，仅仅为一种逻辑业务划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各业务单元可以集成在一个处理单元中，也可以是各 个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件业务单元的形式实现。
集成的单元如果以软件业务单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本发明所描述的业务可以用硬件、软件、固件或它们的任意组合来实现。当使用软件实现时，可以将这些业务存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是通用或专用计算机能够存取的任何可用介质。
以上的具体实施方式，对本发明的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上仅为本发明的具体实施方式而已。
以上，以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的范围。

Claims (30)

  1. 一种强制访问控制MAC方法，其特征在于，应用于操作系统中的安全模块，所述安全模块工作在强制enforcing模式，所述方法包括：
    在第一主体访问第一客体以执行第一操作时，基于安全策略确定所述第一主体没有访问所述第一客体以执行所述第一操作的权限，所述第一客体配置为许可permissive模式；
    允许所述第一主体访问所述第一客体并执行所述第一操作。
  2. 根据权利要求1所述的方法，其特征在于，所述安全策略包括第一规则，所述第一规则指示所述第一客体工作在所述permissive模式。
  3. 根据权利要求1或2所述的方法，其特征在于，在允许所述第一主体访问所述第一客体并执行所述第一操作之后，所述方法还包括：
    生成第一日志，所述第一日志用于记录所述第一主体访问所述第一客体以执行所述第一操作相关联的信息。
  4. 根据权利要求1-3任一项所述的方法，其特征在于，所述方法还包括：
    更新所述安全策略，所述更新后的安全策略包括第二规则，所述第二规则指示允许所述第一主体访问所述第一客体以执行所述第一操作。
  5. 根据权利要求2所述的方法，其特征在于，所述方法还包括：
    从所述安全策略中删除所述第一规则。
  6. 根据权利要求1-5任一项所述的方法，其特征在于，所述方法还包括：
    在第二主体访问第二客体以执行第二操作时，基于所述安全策略确定所述第二主体没有访问所述第二客体以执行所述第二操作的权限，其中，所述第二客体未配置为permissive模式；
    拒绝所述第二主体访问所述第二客体以执行所述第二操作。
  7. 一种强制访问控制MAC方法，其特征在于，应用于操作系统中的安全模块，所述安全模块工作在许可permissive模式，所述方法包括：
    在第一主体访问第一客体以执行第一操作时，基于安全策略确定所述第一主体没有访问所述第一客体以执行所述第一操作的权限，所述第一主体或所述第一客体配置为强制enforcing模式；
    拒绝所述第一主体访问所述第一客体以执行所述第一操作。
  8. 根据权利要求7所述的方法，其特征在于，
    所述安全策略包括第一规则，所述第一规则指示所述第一主体工作在所述enforcing模式；
    或者，所述安全策略包括第二规则，所述第二规则指示所述第一客体工作在所述enforcing模式。
  9. 根据权利要求7或8所述的方法，其特征在于，所述方法还包括：
    更新所述安全策略，所述更新后的安全策略包括第三规则，所述第三规则指示允许所述第一主体访问所述第一客体以执行所述第一操作。
  10. 根据权利要求7-9任一项所述的方法，其特征在于，所述方法还包括：
    在第二主体访问第二客体以执行第二操作时，基于所述安全策略确定所述第二主体没有访问所述第二客体以执行所述第二操作的权限，其中，所述第二客体和所述第二主体未配置为enforcing模式；
    允许所述第二主体访问所述第二客体并执行所述第二操作。
  11. 根据权利要求1-10任一项所述的方法，其特征在于，所述操作系统为基于安全标签进行MAC的操作系统。
  12. 根据权利要求11所述的方法，其特征在于，所述操作系统为基于Linux的操作系统、基于安卓Android的操作系统或苹果操作系统。
  13. 根据权利要求1-11任一项所述的方法，所述安全模块为安全增强SELinux，或安全增强安卓SEAndroid。
  14. 一种通信装置，其特征在于，所述通信装置应用于操作系统中的安全模块，所述通信装置工作在强制enforcing模式，所述通信装置包括：
    第一处理单元，用于在第一主体访问第一客体以执行第一操作时，基于安全策略确定所述第一主体没有访问所述第一客体以执行所述第一操作的权限，所述第一客体配置为许可permissive模式；
    第二处理单元，用于允许所述第一主体访问所述第一客体并执行所述第一操作。
  15. 根据权利要求14所述的通信装置，其特征在于，所述安全策略包括第一规则，所述第一规则指示所述第一客体工作在所述permissive模式。
  16. 根据权利要求14或15所述的通信装置，其特征在于，所述通信装置还包括：
    第三处理单元，用于在允许所述第一主体访问所述第一客体并执行所述第一操作之后，生成第一日志，所述第一日志用于记录所述第一主体访问所述第一客体以执行所述第一操作相关联的信息。
  17. 根据权利要求14-16任一项所述的通信装置，其特征在于，所述通信装置还包括：
    第四处理单元，用于更新所述安全策略，所述更新后的安全策略包括第二规则，所述第二规则指示允许所述第一主体访问所述第一客体以执行所述第一操作。
  18. 根据权利要求15所述的通信装置，其特征在于，所述通信装置还包括：
    第五处理单元，用于从所述安全策略中删除所述第一规则。
  19. 根据权利要求14-18任一项所述的通信装置，其特征在于，
    所述第一处理单元，还用于在第二主体访问第二客体以执行第二操作时，基于所述安全策略确定所述第二主体没有访问所述第二客体以执行所述第二操作的权限，其中，所述第二客体未配置为permissive模式；
    所述第二处理单元，还用于拒绝所述第二主体访问所述第二客体以执行所述第二操作。
  20. 一种通信装置，其特征在于，所述通信装置应用于操作系统中的安全模块，所述通信装置工作在许可permissive模式，所述通信装置包括：
    第一处理单元，用于在第一主体访问第一客体以执行第一操作时，基于安全策略确定所述第一主体没有访问所述第一客体以执行所述第一操作的权限，所述第一主体或所述第一客体配置为强制enforcing模式；
    第二处理单元，用于拒绝所述第一主体访问所述第一客体以执行所述第一操作。
  21. 根据权利要求20所述的通信装置，其特征在于，
    所述安全策略包括第一规则，所述第一规则指示所述第一主体工作在所述enforcing模式；
    或者，所述安全策略包括第二规则，所述第二规则指示所述第一客体工作在所述enforcing模式。
  22. 根据权利要求20或21所述的通信装置，其特征在于，所述通信装置还包括：
    第三处理单元，用于更新所述安全策略，所述更新后的安全策略包括第三规则，所述第三规则指示允许所述第一主体访问所述第一客体以执行所述第一操作。
  23. 根据权利要求20-22任一项所述的通信装置，其特征在于，
    所述第一处理单元，还用于在第二主体访问第二客体以执行第二操作时，基于所述安全策略确定所述第二主体没有访问所述第二客体以执行所述第二操作的权限，其中，所述第二客体未配置为enforcing模式；
    所述第二处理单元，用于允许所述第二主体访问所述第二客体和所述第二主体并执行所述第二操作。
  24. 根据权利要求14-23任一项所述的通信装置，其特征在于，所述操作系统为基于安全标签进行MAC的操作系统。
  25. 根据权利要求24所述的通信装置，其特征在于，所述操作系统为基于Linux的操作系统、基于安卓Android的操作系统或苹果操作系统。
  26. 根据权利要求14-24任一项所述的通信装置，所述安全模块为安全增强SELinux，或安全增强安卓SEAndroid。
  27. 一种通信装置，其特征在于，所述通信装置包括存储器和处理器；
    所述存储器，用于存储程序代码；
    所述处理器，用于运行所述程序代码中的指令，使得所述通信装置执行以上权利要求1-13任意一项所述的方法。
  28. 一种计算机程序产品，其特征在于，包括程序，当所述程序在处理器上运行时，实现权利要求1-13任意一项所述的方法。
  29. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质包括指令，当其在处理器上运行时，实现以上权利要求1-13任一项所述的方法。
  30. 一种服务器，其特征在于，所述服务器中存储程序代码，所述程序代码被处理器运行时，实现以上权利要求1-13任一项所述的方法。
PCT/CN2022/076569 2021-03-05 2022-02-17 一种强制访问控制mac方法及相关设备 WO2022183912A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP22762378.2A EP4293552A1 (en) 2021-03-05 2022-02-17 Mandatory access control mac method and related device
US18/459,593 US20230409729A1 (en) 2021-03-05 2023-09-01 Mandatory access control (mac) method and related device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110245052.5 2021-03-05
CN202110245052.5A CN115017508A (zh) 2021-03-05 2021-03-05 一种强制访问控制mac方法及相关设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/459,593 Continuation US20230409729A1 (en) 2021-03-05 2023-09-01 Mandatory access control (mac) method and related device

Publications (1)

Publication Number Publication Date
WO2022183912A1 true WO2022183912A1 (zh) 2022-09-09

Family

ID=83064517

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/076569 WO2022183912A1 (zh) 2021-03-05 2022-02-17 一种强制访问控制mac方法及相关设备

Country Status (4)

Country Link
US (1) US20230409729A1 (zh)
EP (1) EP4293552A1 (zh)
CN (1) CN115017508A (zh)
WO (1) WO2022183912A1 (zh)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190306719A1 (en) * 2018-03-28 2019-10-03 International Business Machines Corporation Advanced Persistent Threat (APT) detection in a mobile device
CN110381068A (zh) * 2019-07-23 2019-10-25 迈普通信技术股份有限公司 强制访问控制方法、装置、网络设备及存储介质
CN111818059A (zh) * 2020-07-09 2020-10-23 公安部第三研究所 一种高等级信息系统访问控制策略自动化构建系统及方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190306719A1 (en) * 2018-03-28 2019-10-03 International Business Machines Corporation Advanced Persistent Threat (APT) detection in a mobile device
CN110381068A (zh) * 2019-07-23 2019-10-25 迈普通信技术股份有限公司 强制访问控制方法、装置、网络设备及存储介质
CN111818059A (zh) * 2020-07-09 2020-10-23 公安部第三研究所 一种高等级信息系统访问控制策略自动化构建系统及方法

Also Published As

Publication number Publication date
EP4293552A1 (en) 2023-12-20
CN115017508A (zh) 2022-09-06
US20230409729A1 (en) 2023-12-21

Similar Documents

Publication Publication Date Title
US11611586B2 (en) Systems and methods for detecting a suspicious process in an operating system environment using a file honeypots
US11675918B2 (en) Policy-based user device security checks
US9558343B2 (en) Methods and systems for controlling access to resources and privileges per process
US7350204B2 (en) Policies for secure software execution
US8347085B2 (en) Integrating security protection tools with computer device integrity and privacy policy
US8281410B1 (en) Methods and systems for providing resource-access information
KR100997802B1 (ko) 정보 단말기의 보안 관리 장치 및 방법
KR20060051383A (ko) 바이러스 방지 소프트웨어 어플리케이션들의 지식 베이스를모으는 시스템 및 방법
US10659389B2 (en) Efficient cascading of flow tables in software defined networks (SDN)
Bleikertz et al. Secure cloud maintenance: protecting workloads against insider attacks
US20180026986A1 (en) Data loss prevention system and data loss prevention method
US11074323B2 (en) Method and system for persisting files
US9792444B2 (en) Inoculator and antibody for computer security
KR100919643B1 (ko) 이원화된 독립적 환경을 통한 내외부망 분리 장치 및 그제어 방법
US11003786B2 (en) System and method to manage file access rights in an information handling system
US10885193B2 (en) Method and system for persisting untrusted files
US11941264B2 (en) Data storage apparatus with variable computer file system
WO2022183912A1 (zh) 一种强制访问控制mac方法及相关设备
WO2022256128A1 (en) Firmware policy enforcement via a security processor
KR20140036714A (ko) 단위 파일별 행위 분석 시스템
EP2645293A2 (en) Method and apparatus for controlling operations performed by a mobile computing device
US11520748B2 (en) Applying append-only policies for files
WO2017070209A1 (en) Techniques for defining and enforcing security policies upon computer processes and related systems and methods
US20230198997A1 (en) Access control systems and methods
US20220374255A1 (en) Configuration techniques for managed virtual machines

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22762378

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2022762378

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2022762378

Country of ref document: EP

Effective date: 20230914

NENP Non-entry into the national phase

Ref country code: DE