Using GConf as an Example of How to Create an Userspace Object Manager
James Carter (National Security Agency)
GConf is a configuration system for GNOME. It does not provide adequate security controls over the configuration data that it manages, which could allow the security goals of the system to be violated. There are various strategies that can be used to provide security controls over an application under SELinux. One strategy, which is a natural part of implementing the Flask architecture on Linux, is to turn the program into a userspace object manager. This paper discusses the general process of providing SELinux controls over a program and the specific steps taken to provide SELinux controls over GConf.
The paper appears in the Proceedings of the 2007 SELinux Symposium and is also available in PDF format.
The 2007 SELinux Symposium presentation slides are available here in PDF format.
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.