Implementing SELinux as a Linux Security Module

Stephen Smalley, Chris Vance, and Wayne Salamon (NAI Labs)

Initial version: December 2001, Last revised: May 2002

Abstract

This technical report describes the implementation of the LSM-based SELinux security module. The report begins by providing an overview of LSM and a review of the SELinux basic concepts. It then provides a summary of how the LSM-based SELinux security module differs from the original SELinux kernel patch. Several aspects of the SELinux security module are then described, including its internal architecture, its initialization and exit code, its support for stacking with other security modules, and its approach for implementing the new SELinux system calls. The remainder of the report is then spent documenting the SELinux hook function implementations, organized into sections for each grouping of LSM hooks.

• Portable Document Format (PDF)
• Postscript
• HTML