Analyzing integrity protection in the SELinux example policy

Trent Jaeger, Reiner Sailer, Xiaolan Zhang

Research output: Contribution to conferencePaperpeer-review

103 Scopus citations


In this paper, we present an approach for analyzing the integrity protection in the SELinux example policy. The SELinux example policy is intended as an example from which administrators customize to create a policy for their site's security goals, but the complexity of the model and size of the policy make this quite complex. Our aim is to provide an access control model to express site security goals and resolve them against the SELinux policy. Ultimately, we aim to define a minimal trusted computing base (TCB) that satisfies Clark-Wilson integrity, by first testing for the more restrictive Biba integrity policy and resolving conflicts using Clark-Wilson semantics. Our policy analysis tool, Gokyo, implements the following approach: (1) it represents the SELinux example policy and our integrity goals; (2) it identifies conflicts between them; (3) it estimates the resolutions to these conflicts; and (4) provides information for deciding upon a resolution. Using Gokyo, we derive a proposal for a minimal TCB for SELinux includes 30 subject types, and we identify the work remaining to ensure that TCB is integrity-protected. Our analysis is performed on the SELinux example policy for Linux 2.4.19.

Original languageEnglish (US)
Number of pages16
StatePublished - Jan 1 2003
Event12th USENIX Security Symposium - Washington, United States
Duration: Aug 4 2003Aug 8 2003


Conference12th USENIX Security Symposium
Country/TerritoryUnited States

All Science Journal Classification (ASJC) codes

  • Computer Networks and Communications
  • Information Systems
  • Safety, Risk, Reliability and Quality


Dive into the research topics of 'Analyzing integrity protection in the SELinux example policy'. Together they form a unique fingerprint.

Cite this