LinSec Configuration Data

LinSec Configuration Data is the data representing LinSec mandatory security policy for a system. It can be roughly divided into two groups:

1. data closely related to a particular executable file, eg. File Capabilities, File Access Domains etc., and
2. other, more general, data eg. Capability Groups, IP Labeling Groups etc.

To avoid penalties of frequent access to configuration files or occupying large chunks of kernel memory, data of the group 1 is kept in the disk blocks used by a particular executable file. The configuration data is stored in a way that enables it to be read together with the other file's data, avoiding the penalties of additional reads. Functionality that provides this is not in the original implementation of Linux kernel but is part of Extended Ext2 & Ext3 Attributes [15] kernel patch (add-on) used for the purpose.

The group 2 consists of (Chapter 4):

• Capability Groups configuration data
• Access Domain Groups configuration data
• Per User configuration data
• IP Labeling Groups configuration data

This data is kept in configuration files that are read during the system boot and stored in, LinSec implemented, kernel buffers. The data structure used for the LinSec kernel buffers is a chained hash table as it provides an average O(1) access time for locating an element. For each of the buffers (storing one of the above configuration data types) a set of functions for manipulation (retrieve, update, create and delete) of the data is provided. An important detail to emphasize is that any function that retrieves an element from one of the buffers returns a copy of the actual element and not the reference to it. This prevents various race conditions from occurring due to data sharing.