JP4550558B2 - Access control setting system - Google Patents

Description

  The present invention relates to an access control setting system using an access control log of a secure OS.

  In the OS (Operating System) access control that is widely used at present, the resource owner sets the access (operation) authority to the resource. There is also a privilege with all the authority. On the other hand, the secure OS eliminates privileges with all rights, assigns a domain (resource access authority) to each process that executes the actual processing, and each process accesses resources within the assigned domain. It is an OS that can be used.

  This function of the secure OS ensures that all access from the process to the unauthorized resource and all access from the process to the resource other than authorized resource access are excluded (denied). Therefore, even if there is a security hole (defect) in the program and the attacker hijacks the process, access to resources without access privileges from this process is eliminated, so the damage can be minimized. .

  When assigning a domain to a process, a mechanism called “domain transition” is used. When the process P to which the domain A is assigned generates a child process Q, the domain of the generated child process Q remains the same domain A as the parent process P by default. However, the domain of the child process Q can be changed by performing domain transition.

  Here, the domain transition is a function for assigning a domain different from the domain assigned as a default when it is created to the created child process. The function is enabled. An example of domain transition is “if process P assigned domain A generates child process Q, domain B is assigned to the generated child process Q”. In this example, the domain B is assigned to the child process Q, and a domain different from the domain A of the parent process P is assigned.

  The secure OS can output the access result for the process resource to the access control log file as a log. Therefore, by analyzing the access control log file, it can be used for operation management of the secure OS.

  As an example of a technique used for system operation management using an access control log file, a technique for matching a log with a keyword and displaying a coping method for a failure in a text is known (for example, see Patent Document 1). ).

As another example, a technique has been proposed in which statistical information of a log can be taken and used for system operation (see, for example, Patent Document 2).
JP-A-8-314763 Japanese Patent Publication No. 10-31323

  From a secure OS, when a process to which a certain domain is assigned is denied when accessing a resource, the information consisting of the item "deny-domain-process-resource-operation" is stored as an access control log file. Is output. For example, if "process / sbin / httpd" to which "domain httpd_t" is assigned performs an operation "read" on the resource "file / var / www" and this is rejected, "reject-domain" The log “httpd_t—process / sbin / httpd—file / var / www—read” is output to the access control log file. Therefore, it can be seen from this log that it is necessary to add a setting “readable” to “file / var / www” in “domain httpd_t”.

  Even when access is permitted, a log is output. For example, the log “permission-domain httpd_t-process / sbin / httpd-file / var / www-read” indicates that “process / sbin / httpd” to which “domain httpd_t” is assigned is “file / var / www” Means that "reading is permitted".

  In fact, in secure OS, when setting access control (access control setting), that is, when setting domain (domain setting) and domain transition (domain transition setting), test the system, When access to a resource is denied, access control setting is performed by setting a domain that permits this access and a domain transition by looking at the log of the access result.

  When attempting to automate access control settings using an access control log file, the technique described in Patent Document 1 uses keyword matching to extract a log for which access is denied, and corresponds to the log. It merely presents access control settings. For this reason, with the technique described in Patent Document 1, it is not possible to set access control in consideration of domain settings or domain transition with high readability.

  Further, since the technique described in Patent Document 2 only displays log statistical information, access control cannot be set from the log.

  As described above, in the conventional technology, it is not possible to set access control in a secure OS in consideration of domain setting or domain transition with high readability from the access control log file.

  An object of the present invention is to solve the above problem and use an access control log file of a secure OS to set an access control in consideration of domain settings and domain transition with high readability. Is to provide.

In order to achieve the above object, the present invention provides an access control setting system that enables access control setting for a resource specified for each process, and assigns a domain to each process, and from the process within the allocated domain range. Based on the access control means that controls access to resources for each process by permitting access to each resource and the domain transition setting file that represents the hierarchical relationship between each domain, the hierarchical relationship is represented as a tree using the domain as a node. Domain transition diagram creation means for drawing and displaying a domain transition diagram represented by a structure, and drawing a process in which an operation to a specified resource is rejected in a node of the corresponding domain in the domain transition diagram in a selectable manner And select the process in the node of the domain And a setting generation means for reflecting the scan of the domain transition in the domain transition configuration file, for processes operation is rejected to the resource, the assigned domain in which shifts in different domains.

  Also, a log formation / output unit that creates an access result that indicates whether the operation for the resource for each process is permitted or denied, and outputs the log to the access control log file. For each rejected process, the importance with respect to the “resource-operation” pair in the log extracted from the access control log file is set in advance for each “resource-operation” pair. Based on the table, it has a domain generation recommendation degree calculation means that is obtained and adds the obtained importance to make a domain generation recommendation degree for the process, and the domain transition diagram creation means is drawn on the node in the domain transition diagram A process that draws the domain creation recommendation level to the corresponding process and draws the domain creation recommendation level The nodes including those that coloring.

  Further, by selecting one process P of the processes drawn in the node of the domain in the domain transition diagram, a new domain DN is selected for the process P based on the domain D of the node including the process P. Is created, and the domain DN is registered as a transition from the domain D in the domain transition configuration file, and the domain transition is set and registered in the domain configuration file to be set as an access controllable domain It is.

In addition, a log representing the group “domain D-process P” of the domain D and the process P is extracted from the access control log file, and the log is extracted in the macro definition file in which the combination of the resource and the operation is defined for each macro. When the number of sets that match the “resource-operation” pair in the log is exceeded, and the number of found matches exceeds a preset threshold, the domain for the new domain DN for the “resource-operation” pair in the log The descriptive sentence is a descriptive sentence that is described by a shared macro in the “resource-operation” pair in the log.

  According to the present invention, a process to which a domain is newly assigned can be recognized at a glance, and the entire domain transition including a domain newly assigned to the process can be clearly and easily grasped.

  Moreover, since the domain setting can be described using a macro, the readability of the domain setting can be improved.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a diagram schematically showing an overall configuration of an embodiment of an access control setting system according to the present invention. 1 is a server, 10 is a secure OS, 20 is a setting file, 30 is an access control log file, and 40 is A setting tool, 50 is a display, and A is an operator.

  In FIG. 1, the server 1 includes a secure OS 10, a setting file 20, an access control log file 30, a setting tool 40, and the like, and a display 50.

  The secure OS 10 refers to the configuration file 20 and controls access to the resource of the process. As a result of access (operation) to the resource, the secure OS 10 is also permitted even if the access is denied. However, a log including the access result for this process is created and output to the access control log file 30.

  When the operator A performs a predetermined screen operation on the display 50 using the setting tool 40 (editing operation), a predetermined log is read from the access control log file 30, and the domain setting and the domain transition setting in the secure OS 10 are performed. The access control setting by is performed. This setting result is registered in the setting file 20. As a result, the domain of the desired process and the domain transition are set, and a new domain is assigned to this process.

  FIG. 2 is a functional configuration diagram showing a specific example of the server 1 in FIG. 1, in which 11 is an access control function, 12 is a domain control function, 13 is a log output function, 21 is a domain setting file, and 22 is a domain transition setting. File, 23 a macro definition file, 24 a domain description file, 41 a domain transition diagram creation function, 42 a domain generation recommendation level calculation function, 43 a setting generation function, 60 an importance level table, 70 a recommendation level table, Reference numeral 80 denotes a macro-threshold value table, and 90 denotes a macro expansion function. Parts corresponding to those in FIG.

  In the figure, the secure OS 10 includes a domain access control function 11, a domain transition function 12, and a log creation / output function 13.

  The access control function 11 is a function for performing access control on a resource for each process by assigning a domain (access authority) for each process and allowing an operation (access) to the resource from the process within the range of the assigned domain. .

  A process is an individual program being executed. When a program is executing a plurality (n) of processes in parallel, n processes (processes P1 to Pn) are included in this program. Is said to be running. In addition, in order to identify the processes, the OS that generated the process adds a unique ID for each process. In general, the process is a multi-process method in which a plurality of processes are executed in parallel in the same program. However, in this embodiment, only one process is executed in the same program in order to simplify the description. A single process method is assumed. Under this assumption, the process is expressed by the name of the program.

  The domain transition function 12 is a function for assigning a domain to a process by domain transition.

  The log formation / output function 13 creates a log including an access result (operation to the resource is permitted or denied) by the access control function 11 of the program accessing the resource, and outputs this to the access control log file 30. It is a function.

The setting tool 40 includes a domain transition diagram creation function 41, a domain generation recommendation degree calculation function 42, and a setting generation function 43. These functions 41 to 43 are used to set the configuration file 20 based on the access control log file 30. Domain setting file 21 and domain transition setting file 22 are set.

  Here, the domain transition diagram creation function 41 is a function that creates a domain transition diagram that represents a hierarchical relationship of domains by domain transition in a tree structure or the like.

  The domain generation recommendation level calculation function 42 detects processes in which operations on resources are denied based on the access control log file 30 and calculates the recommendation level of these processes based on the importance level table 60. This function is registered in the table 70.

  The setting generation function 43 is a function for performing domain setting and domain transition setting for the domain selected in the domain transition diagram created by the domain transition diagram creation function 41.

  The setting file 20 includes a domain setting file 21, a domain transition setting file 22, a macro definition file 23, and a domain description sentence file 24.

  In the domain setting file 21, a domain of a process that is permitted to access a predetermined resource by the access control function 11 is registered. This will be described with reference to FIG.

  In the domain transition setting file 22, the transition source domain and the transition destination domain of the domain transition by the domain transition function 12 are registered. This will be described with reference to FIG.

  The macro definition file 23 is prepared for simplifying the domain setting, and will be described with reference to FIG.

  The domain description sentence file 24 is a file storing a domain description sentence describing the setting of the domain, and this will be described with reference to FIG.

  The importance level table 60 is used when a domain transition diagram is created by the domain transition diagram creation function 41. This will be described with reference to FIG.

  The recommendation level table 70 is used by the domain transition diagram creation function 41 and the domain generation recommendation level calculation function 42, which will be described with reference to FIG.

  The macro-threshold table 80 is used by the setting generation function 43 that outputs the domain setting file 21 and the domain transition setting file 22, and this will be described with reference to FIG.

  When the macro stored in the macro definition file 23 matches the macro in the domain description sentence, the macro expansion function 90 performs “resource operation” related to the macro defined in the macro definition file 23 using the domain description sentence. This is a function to set in the domain setting file 21 as the setting of the domain of the description.

  FIG. 3 is a diagram showing the configuration of the domain setting file 21 in FIG.

  In this figure, the domain setting file 21 is set with a domain of a process that is permitted to operate on the resource to be accessed. The domain 21a and the domain 21a (within the access authority) ) Resource 21b, an operation 21c permitted for this resource, and a character string expression 21d in which an “allow statement” that collectively represents the domain 21a, the resource 21b, and the operation 21c is described.

  For example, regarding the process in the first line of the domain configuration file 21, the “domain kernel_t” of this process is set to “readable” for “resource (in this case, file) / sbin / init”. Will be done.

  The character string representation 21d describes the domain to be set as auxiliary information. The domain 21a, the resource 21b, and the operation 21c permitted for the resource 21b are represented by a character string. An “allow statement” following the character string indicating permission is described. That is, “allow statement” is described as “allow <domain> <resource> <permitted operation>; In the character string representation 21d, as described with reference to FIG.

  It should be noted that in the domain setting file 21, a process in which the resource 21b and the operation 21c to the resource 21b are not described cannot perform any operation on the resource from this process.

  FIG. 4 is a diagram showing the configuration of the domain transition setting file 22 in FIG.

  As described above, the domain transition is “when the process P to which the domain A is allocated generates the child process Q, the domain B is allocated to the generated child process Q”. Such domain transition is set by designating a combination of a transition source domain, a transition destination program entry point, and a transition destination domain. This setting is performed in the domain transition setting file 22 shown in FIG.

  The entry point refers to the address of the instruction that is executed first among the instructions in the program when the program is executed. When the process Pa calls the entry point Eb of the program B, the OS generates a process Pb to which a unique ID for executing the program B is added. The generated process Pb starts execution from the entry point Eb of the program B. In this case, it is expressed that the process Pa generates (or generated) the process Pb, or the process Pb is generated (or generated) by the process Pa. In this case, the process Pa is the parent process of the process Pb. The process Pb is called a child process of the process Pa. In this embodiment, in order to simplify the description, the entry point Eb is expressed by a program name.

As shown in FIG. 4, the domain transition setting file 22 includes a transition source domain 22a, an entry point 22c, and a transition destination domain 22d .

  For example, in the domain transition setting described in the second line in the domain transition setting file 22, “parent process Pm (/ sbin / init)” to which “domain init_t” is assigned is “entry point / etc / init. When “d program” is executed and “child process Ps (/etc/init.d)” is generated, “domain initrc_t” is assigned to this “child process Ps”.

  By default, the domain of the generated child process Ps is the same as the domain of the parent process Pm and is “domain init_t”. However, when the domain transition is set in this way, the domain transition occurs, as described above. Then, the domain of the child process changes and “domain initrc_t” is assigned.

  FIG. 5 is a diagram showing the configuration of the macro definition file 23 in FIG.

  The macro simplifies the access permitted for a large number of resources, that is, the description of the domain setting, and enables domain setting with high readability (easy to recognize at a glance).

  In the macro setting, a domain is set using a domain name described in a domain description sentence for a “resource-operation” pair defined in advance as a macro. For example, if “can_network” is defined as a macro, and “can_network (a_domain)” is described, the “resource-operation” pair defined in the macro can_network is described in the “domain a_domain” ”To set the domain. By describing the domain with macro settings, the readability of the domain settings is enhanced.

  In this way, the access control log file 30 (FIGS. 1 and 2) and the macro setting of the secure OS can be used to set the domain and the domain transition with improved readability, thereby making it easy to set the access control. Can be done.

  As shown in FIG. 5, the macro definition file 23 includes a macro 23a, a resource 23b, and an operation 23c permitted by the resource 23b. Although the macro 23a is different in resource and its operation, the same domain is collectively shown. When the macro 23a is associated with the domain setting file 21 shown in FIG. 3, the same domain 21a set in the domain setting file 21 is one. It is generically named by the macro 23a.

  Therefore, in the macro definition file 23, 13 types of “resource 23b-operation 23c” combinations such as “TCP socket-creation”, “TCP socket-data transmission”,... This domain is collectively expressed as “macro can_network”. Three types of “resource 23b-operation 23c” combinations such as “UNIX (registered trademark) socket creation”, “UNIX (registered trademark) socket-data transmission”, and “UNIX (registered trademark) socket-data reception” are permitted. Domain is represented by "macro can_syslog".

  As described above, when the domain is macro-defined, the domain setting file 21 described above with reference to FIG. 3 uses the character string expression 21d for the macro-defined domain as shown in FIG. 6B. The description in is described with one defined macro instead of using an “allow statement” for each domain. Here, as shown in FIG. 6B, if “macro can_network” is defined for “domain httpd_t” from the first line to the thirteenth line, for these “domain httpd_t”, The character string representation 21d is common, and a character string (“macro (domain)”) defined by the macro and domain, that is, a macro “can_network (httpd_t)” is described in this example. Become.

  In FIG. 6B, the domains in the 14th to 24th lines are not defined as macros. For such domains, as described in FIG. 21d describes “allow statement”.

  FIG. 6A shows the structure of the domain description file 24 shown in FIG. FIG. 6 shows the relationship between the domain description file 24 and the domain setting file 21.

  In the domain description file 24, the character string representation 21d in the domain setting file 21 is described. Therefore, in the case of the domain configuration file 21 shown in FIG. 6B, the macro “can_network (httpd_t)” 24a is described for the macro-defined “domain httpd_t”, and the domain (for example, “Allow statement” 24b is described for “domain httpd_t” and “domain kernel_t” on and after the 14th line.

  The macro expansion function 90 is a function for expanding the description of the domain description sentence file 24 into the domain setting file 21. When the description in the domain description file 24 is a macro as shown in the description 24a, the “resource 21b-operation 21c” is used as shown in the expansion 24c using the macro definition file 23 (FIG. 5). The domain is expanded for each set of "and a macro defined in the character string expression 21d is described. Further, when the description in the domain description file 24 is “allow statement” which is a direct domain description regardless of the macro as shown as the description 24b, each “allow statement” is shown as shown in the expansion 24d. The domain is set to “allow statement” in the character string expression 21d.

  As is clear from the character string expression 21d, the description using the macro has a smaller number of description sentences than the individual description by the “allow statement”. For this reason, the domain setting is more effective when the macro is used. The readability of.

  FIG. 7 is a diagram showing the configuration of the access control log file 30 in FIG.

  In the figure, an access control log file 30 is a log file comprising a type 31, a domain 32, a process 33, a resource 34, and an operation 35.

  The type 31 is used to distinguish between a log for which access is denied and a log for which access has been permitted. Type 31 is set to “reject” for a log for which access has been denied, and type 31 for a log for which access has been permitted. Is “permitted”. Domain 32 is a domain that is a log output target from secure OS 10 (FIG. 2), process 33 is a process that is also a log output target, resource 34 is a resource accessed by this process, and operation 35 is a process that is a resource This is the operation performed on.

  For example, the log on the second line of the access control log file 30 indicates that “process / sbin / httpd” to which “domain initrc_t” is assigned tries to “create” (manipulate) “TCP socket” (resource). It means that it was rejected. The log on the ninth line indicates that “process / sbin / httpd” to which “domain initrc_t” is assigned is “permitted” in an attempt to “send” (manipulate) “packet” (resource). .

  As described above, the access control log file 30 registers the access results to the resources of the process controlled by the secure OS 10 (FIG. 2), and can recognize the access results from the access control log file 30. It is.

  FIG. 8 shows the structure of the importance table 60 in FIG.

  In this figure, this importance level table 60 is for setting the importance level indicating how important the operation for the resource is for each resource, and includes a resource 61 and an operation 62 permitted for this resource. , And the importance 63 of the operation. The importance is 1 to 10, and the importance of the group of “resource 61-operation 62” that does not exist in the importance table 60 is 1.

  In the importance table 60 shown in the figure, the “resource 61-operation 62” pair described in the first line is a “password storage file / etc / passwd” storing important information “passwd (password)”. The operation 62 for the resource 61 is “read”, and “10” having a high importance level is set. Also, the importance level 63 is set to “5” for the operation “read” for the resource “/www/index.html” described in the second line.

  FIG. 9 is a diagram showing the configuration of the recommendation degree table 70 in FIG.

  The recommendation degree table 70 registers the recommendation degree of the domain obtained based on the importance degree table 60 shown in FIG. 8, and this recommendation degree is used as a guideline when a child process is generated.

  This recommendation degree table 70 is composed of a domain 71, a process 72, and a domain generation recommendation degree 73. Here, the domain creation recommendation 73 is registered as “12” for the “domain initrc_t-process / sbin / httpd” group, and the “domain initrc_t-process / sbin / xinetd” group is registered. Is registered with the domain generation recommendation degree 73 as “10”.

  FIG. 10 is a diagram showing the configuration of the macro-threshold table 80 in FIG.

  This macro-threshold table 80 is set with thresholds for determining whether to define a domain using the macro defined in the macro definition file 23 shown in FIG. It consists of and. When the set threshold value 82 is exceeded, the macro is set as a domain. The threshold value of a macro that does not exist in the macro-threshold value table 80 is 100%.

  Next, a specific example of domain setting and domain transition processing according to this embodiment will be described. This is because when the setting tool 40 (FIG. 2) is executed under the operation of the operator A (FIG. 1), the operation to the resource stored in the access control log file 30 (FIG. 2) is “rejected”. ”Is performed on the process selected by the operator A (FIG. 1).

  Here, the domain setting file 21 is shown in FIG. 3, the domain transition setting file 22 is shown in FIG. 4, the access control log file 30 is shown in FIG. 7, and the importance table 60 is shown in FIG. As described above, the macro-threshold table 80 is configured as shown in FIG.

  FIG. 11 is a flowchart showing the overall flow of domain setting and domain transition processing by the setting tool 40 shown in FIG.

<< Step 90 >>
First, by executing the domain generation recommendation level calculation function 42 (FIG. 2), a process that should be assigned a new domain is extracted based on the access control log file 30, and recommended as shown in FIG. A degree table 70 is created.

<< Step 100 >>
Then, by executing the domain transition diagram creation function 41 (FIG. 2), based on the domain transition setting file 22 shown in FIG. 4, the relationship between the set domains, that is, the domain transition with the domain as a node is represented. A domain transition diagram is created and displayed on the display 50 (FIG. 1). In this domain transition diagram, nodes (domains) where there is a process where it is better to assign the new domain extracted in step 90 are colored and displayed, and operator A sets the domain and changes the domain. The operator selects one of the colored nodes because it allows the better domain to be easily recognized.

<< Step 110 >>
When the operator A selects one of the colored nodes in the domain transition diagram, a domain generation recommended process list screen representing a process that should be assigned a new domain in the selected node is displayed. 50, allowing operator A to select the process for which a new domain is to be assigned.

<Step 120>
When the operator A selects a desired process from the domain generation recommended process list screen, a new domain related to the selected process is automatically set in the domain setting file 21 by executing the setting generation function 43 (FIG. 2). In addition, the domain transition is automatically performed in the domain transition setting file 22.

  Next, details of each step in FIG. 11 will be described.

  FIG. 12 is a flowchart showing the flow of the process of step 90 in FIG. 11 by the domain generation recommendation degree calculation function 42 (FIG. 2).

  In this process, a set of a process that should be assigned a new domain and a domain assigned to this process is extracted from the access control log file 30, and a recommendation degree table 70 (FIG. 9) is created for each set. To do. For this purpose, a set of logs related to the setting tool 40 is read from the access control log file 30 shown in FIG.

<< Step 91 >>
A log of type 31 “rejected” is extracted (read) from the access control log file 30. The reason why such a log is extracted is that if the expected access is denied, it is necessary to make a setting for permitting the denied access, so it is necessary to pay attention to the log for which the access is denied. In the access control log file 30 shown in FIG. 7, the logs whose item “type” 31 is “rejected” are the logs in the second to eighth lines, the eleventh line, the thirteenth line, and the fourteenth line. It is.

<Step 92>
With respect to the log extracted in step 91, the following steps 92a to 92b are performed for each set of “domain 32-process 33” (FIG. 7).

<< Step 92a >>
That is, for all the extracted logs having the same “domain 32-process 33” pair (hereinafter referred to as “extraction log”), the “resource 34-operation 35” of the extraction log is searched in the importance table 60 shown in FIG. Then, all the importance levels 63 for “resource 61-operation 62” in this importance level table 60 that coincide with “resource 34-operation 35” in the extracted log are acquired. Then, the importance 63 values of all the extracted logs having the same “domain 32-process 33” combination acquired in this way are added, and this added value is added to the domain for the “domain 32-process 33” combination. The recommended generation level.

Now, as shown in FIG. 8, it is assumed that the importance 63 for two “resource 61 -operation 62” pairs is registered in the importance table 60, and the access control log file 30 shown in FIG. Assuming that the combination of “domain 32-process 33” extracted because “type” 31 is “reject” is the combination of “domain initrc_t-process / sbin / httpd”, in FIG. The log in the 11th row is the target of extraction, but the “resource 34-operation 35” pair in the 2nd to 8th rows does not exist in the importance table 60 shown in FIG. 63 is the default “1”. For the extracted log in the 11th row in which the set of “resource 34-operation 35” is “resource / www / index.html-read”, the importance level “5” is shown in the importance level table 60 shown in FIG. It is registered. From the above, the domain creation recommendation level of the group “domain initrc_t−process / sbin / httpd” is 1 × 7 + 5 × 1 = 12.

Further, in the access control log file 30 shown in FIG. 7, since the “type” 31 is “denied”, the “domain 32-process 33” pair is extracted as the “domain initrc_t-process / sbin / xinetd” pair. Then, in FIG. 7, the logs in the 13th and 14th lines are to be extracted, but the “resource 34-operation 35” pair in the 13th line exists in the importance table 60 shown in FIG. Therefore, the importance 63 of the set is the default “1”. The log on the 14th line, which is a set of “resource / etc / passwd-read”, is registered as importance “9” in the importance table 60 shown in FIG. From the above, the domain creation recommendation level of the group “domain initrc_t−process / sbin / xinetd” is 1 × 1 + 9 × 1 = 10.

<< Step 92b >>
The domain generation recommendation level of the group “domain 32-process 33” obtained in step 92a is registered as “domain 71-process 72-domain generation recommendation level 73” in the recommendation level table 70 shown in FIG. In the above example, the pair “domain initrc_t—process / sbin / httpd” is registered as the domain creation recommendation level “12”, and the pair “domain initrc_t—process / sbin / xinetd” is set as the domain creation recommendation level “10”. be registered.

<Step 93>
The above processing is performed for each pair of “domain 32-process 33” of the extracted log from the access control log file 30 shown in FIG. 7. When all the sets of processing are completed, the processing of the domain generation recommendation degree calculation function 42 ( Step 90) in FIG. 11 ends.

  FIG. 13 is a flowchart showing a specific example of the processing flow of step 100 in FIG. 11 by the domain transition diagram creation function 41 (FIG. 2).

<< Step 101 >>
The domain transition setting file 22 (FIG. 4) is read, and based on the transition source domain 22a, the entry point 22c, and the transition destination domain 22d , a tree structure showing the hierarchical relationship of the domains is drawn with the domain as a node.

  This will be described with reference to FIG. 14. In the domain transition described in the first line in FIG. 4, “domain kernel_t” is assigned to the parent process, and the child process generated from this parent process is an entry. The point is “/ sbin / init”, and “domain init_t” is assigned by domain transition. Therefore, as shown in FIG. 14, a square frame representing “domain init_t” assigned to the child process is drawn below the square frame representing “domain kernel_t” of the parent process to form a hierarchical relationship between these processes. At the same time, the “entry point / sbin / init” of the child process is drawn in the frame of “domain init_t” assigned to the child process. Here, the frame representing the drain and the frame representing the entry point have different shapes.

  In addition, from the description in the second and third lines in FIG. 4, the child process becomes a parent process from the child process to which “domain init_t” is assigned, and the entry point is “ Two child processes of “/etc/init.d” and “/ sbin / login” are generated, and “domain initrc_t” and “domain login_t” are respectively assigned by domain transition. As a result, as shown in FIG. 14, the frame of “domain initrc_t” and the frame of “domain login_t” are drawn below the frame representing “domain init_t” of this parent process, and “domain init_t” and “domain” A hierarchical relationship of processes is formed with “initrc_t” and “domain login_t”. In addition, “entry point /etc/init.d” is drawn in the “domain initrc_t” frame, and “entry point / sbin / login” is drawn in the “domain login_t” frame.

  Furthermore, from the description on the fourth line in FIG. 4, from the child process to which “domain initrc_t” is assigned, this child process becomes the parent process, and the child process of the entry point “/ sbin / sendmail” “Domain mail_server_t” is assigned by domain transition. As a result, as shown in FIG. 14, the frame of “domain mail_server_t” is drawn below the frame representing “domain initrc_t” of this parent process, and the hierarchical relationship of the processes of “domain initrc_t” and “domain mail_server_t” Is formed. In addition, “entry point / sbin / sendmail” is drawn in the frame of “domain mail_server_t”.

  In this way, first, the outline of the domain transition diagram 130 in which the domain transition set in the domain transition setting file 22 shown in FIG. 4 forms a tree structure with the domain as a node by the processing of step 101 in FIG. As drawn.

<< Step 102 >>
Next, the “domain 32—process 33” pair whose “type 31” is “reject” read from the access control log file 30 (FIG. 7) in the process of step 91 in FIG. 12 is drawn in the corresponding node.
In the above example, the group “domain initrc_t-process / sbin / httpd” in the second to eighth lines and the eleventh line of the access control log file 30 is extracted in step 91 in FIG. This group is drawn in the node 131 of “domain initrc_t” because the domain is “initrc_t”. In this case, this set of “process / sbin / httpd” is rendered in this node 131 as “entry point / sbin / httpd” 134. The “entry point / sbin / httpd” 134 is given “domain initrc_t” as a default, and the operation 35 for the resource 34 shown in FIG. 7 is denied.
Further, in step 91 in FIG. 12, the “domain initrc_t-process / sbin / xinetd” pair on the 13th and 14th lines of the access control log file 30 is also extracted. Initrc_t ”, it is drawn in the node 131 of“ domain initrc_t ”. In this case, this set of “process / sbin / xinetd” is rendered in this node 131 as “entry point / sbin / xinetd” 133. This “entry point / sbin / xinetd” 133 is also given “domain initrc_t” as a default, and the operation 35 for the resource 34 shown in FIG. 7 is rejected.
In this way, two entry points, ie, “entry point / sbin / httpd” 134 and “entry point / sbin / xinetd” 133, are drawn in the node 131. Is a child process of the process of “domain initrc_t”. To indicate this, in node 131, “entry point / sbin / httpd” 134 and “entry point / sbin / xinetd” 133 are “domain initrc_t”. It is drawn below “entry point / etc / init.d” and these “entry point / sbin / httpd” 134 and “entry point / sbin / xinetd” 133 from “entry point / etc / init.d” 132. An arrow is drawn towards and.
<Step 103>
Next, among the nodes (domains) of the tree structure obtained in step 102 of FIG. 13, the nodes in which the domains exist in the recommendation level table 70 shown in FIG. 9 are colored. For the processes existing in, the domain creation recommendation value is also displayed. In this recommendation degree table 70, since “domain initrc_t” is registered, as shown in FIG. 14, the node 131 of this “domain initrc_t” is colored (indicated here by hatching of points), and Based on the recommendation degree table 70, the domain entry recommendation degree “12” is set in the “entry point / sbin / httpd” 134 that is a child process with respect to the “entry point / etc / init.d” 132 in the node 131. Similarly, a domain generation recommendation degree “10” is added to “entry point / sbin / xinetd” 133 which is also a child process.

  As shown in FIG. 14, the above processing results are displayed on the display 50 (FIG. 1) as a domain transition diagram 130, and this processing 100 by the domain transition diagram creation function 41 is completed.

  In this way, in the domain transition diagram 130, the hierarchical relationship of the domains is displayed in a tree structure with the domain as a node. Therefore, this hierarchical relationship can be recognized at a glance and is easy to see. Is drawn in a hierarchical relationship with the entry point of this node in the corresponding node, and since the node containing such an entry point is colored, the process subject to such domain transition can be easily recognized The readability is improved for the user, and the operation for domain transition is facilitated.

  Next, in the domain transition diagram 130, when one of the nodes colored by the operator A, in this case, the node 131 of “domain initrc_t” is selected, a domain recommended process list screen 140 as shown in FIG. (FIG. 1).

  In the domain recommended process list screen 140, “entry point / sbin / httpd” 134 and “entry point / sbin / xinetd” 133 in the node 131 of the colored “domain initrc_t” in the domain transition diagram 130 shown in FIG. The domain generation recommendation degree of is registered.

  That is, on the domain recommended process list screen 140, the “domain name” 141 of the node selected in the domain transition diagram 130 shown in FIG. 14 is displayed, and is represented by the entry point name included in this node (in the frame). A list of “processes” 142 and “domain generation recommendation level” 143 are displayed.

  If the node 131 in FIG. 14 is selected, the domain recommended process list screen 140 displays “domain initrc_t” of this node 131 as “domain” 141, and “entry point / etc” of the selected node 131. “entry point / sbin / httpd” 134 and “entry point / sbin / xinetd” 133 that are lower-level (child processes) of “/init.d” 132 and registered in the recommendation degree table 70 shown in FIG. Are displayed as “process” 142, and “domain generation recommendation degree” registered in the recommendation degree table 70 (FIG. 9) of these “entry point / sbin / httpd” 134 and “entry point / sbin / xinetd” 133. "Is displayed as" Domain generation recommendation degree "143. Here, the node 131 in FIG. 14 is selected, and the entry points 134 and 133 in this node 131 are registered with the domain generation recommendation degrees “12” and “10” in the recommendation degree table 70 shown in FIG. Therefore, on the domain recommended process list screen 140, for “entry point / sbin / httpd” 134, “process” 142 is “/ sbin / httpd” and “domain generation recommendation level” 143 is “12”. For “entry point / sbin / xinetd” 133, “process” 142 is displayed as “/ sbin / xinetd”, and “domain generation recommendation degree” 143 is displayed as “10”.

  A new domain is generated from the domain generation recommended process list screen 140 shown in FIG. 15, and the operator A can select a process to which the domain is to be assigned (step 110 in FIG. 11).

  For example, in FIG. 15, when the operator A selects “process / sbin / httpd” on the first line on the domain generation recommended process list screen 140, the setting generation function 43 (FIG. 2) is activated, which is shown in FIG. 16. The process is performed to generate a new domain, and this “process / sbin / httpd” is generated in the process of “entry point / sbin / httpd” 134 selected in the domain transition diagram 130 of FIG. The domain transition setting for assigning the new domain is performed. Further, in FIG. 14, by directly selecting “entry point / sbin / httpd” 134 or “entry point / sbin / xinetd” 133, the processing shown in FIG. 16 is performed to generate a new domain. It is also possible to assign to the selected entry point (process).

  FIG. 16 is a flowchart showing a specific example of the processing flow of step 120 in FIG. 11 by the setting generation function 43 (FIG. 2).

<Step 121>
When the operator A selects, for example, “process / sbin / httpd” shown in the first line on the domain generation recommendation list screen 140 of FIG. 15, the “process / sbin” is displayed in the setting tool 40 (FIGS. 1 and 2). “initrc_t” as the domain 141 on the domain generation recommendation list screen 140 for “/ httpd” is input as the domain D, and “/ sbin / httpd” 142 is input as the process P.

<< Step 122 >>
Based on the name “/ sbin / httpd” of the process P, a new domain DN name is automatically generated, and the domain transition from the domain D to the domain DN is transferred to the domain transition setting file 22 as shown in FIG. Set as shown in FIG. Here, the name of the new domain DN is obtained by adding the character string “_t” to the name of the process P. When the process P is “/ sbin / httpd”, the new domain DN is “httpd_t”. Accordingly, as shown in FIG. 4, “transition source domain initrc_t—entry point / sbin / httpd—transition destination domain httpd_t” is newly set in the domain transition setting file 22.

  Due to this domain transition, the domain transition diagram 130 shown in FIG. 14 is changed to the domain transition diagram 130 ′ shown in FIG. 17. In this domain transition diagram 130 ′, the child process of “entry point / sbin / httpd” 134 whose domain in FIG. 14 is the default “domain initrc_t” performs domain transition, and the process of “domain httpd_t” 135 is changed to “domain”. It is drawn with the same coloring at the bottom of initrc_t. The entry point of this “domain httpd_t” 135 is the original “entry point / sbin / httpd”.

  In this way, it is possible to easily and surely recognize domain transitions as well as the fact that there has been a domain transition and that the domain that has undergone a new domain transition is clearly displayed, improving readability.

<< Step 123 >>
Next, in order to set this new domain DN in the domain configuration file 21 (FIGS. 2 and 3), the set of “DOMAIN 32-PROCESS 33” from the access control log file 30 (FIG. 7) A log that matches “process P” is extracted. Here, from the above example, since the domain D is “domain initrc_t” and the process (entry point) is “entry point / sbin / httpd”, “domain D-process P” is “domain initrc_t-process / sbin /”. “httpd”, and the log of the group “domain 32-process 33” in the access control log file 30 in FIG. 7 corresponding to this is the log of the second line to the eleventh line. Will be extracted. Thus, the log extracted from the access control log file 30 is shown in FIG. A new domain DN “domain httpd_t” is set in the extraction log process.

<< Step 124 >>
Next, the macro definition file 23 (FIG. 5) is read in order to determine whether or not the domain setting is performed with a macro.

<Step 125>
Then, for each “macro” 23a defined in the macro definition file 23, the processing of the following steps 125a to 125b is performed. In the case of the macro definition file 23 shown in FIG. 5, first, processing is performed for “macro can_network”, and then processing is performed for “macro can_syslog”. In this process, as shown in FIG. 18, when a new “domain httpd_t” is set in the process indicated by the extracted log, the domain is set by “macro can_network”, the domain is set by “macro can_syslog”, or individual processes are performed. Whether to set a domain for each “resource-operation” group.

<< Step 125a >>
The “resource 23b-operation 23c” pair in the macro definition file 23 is compared with the “resource 34-operation 35” of the extraction log shown in FIG. 18, and the number of matching extraction logs is counted. When there is the same “resource 34-operation 35” pair in the extracted log, the above-mentioned count may be performed for each extracted log, or the count may be performed only for one extracted log. Either one may be adopted for convenience. For “macro can_network”, the extracted logs in the first to ninth lines in FIG. 18 match, so the count value (that is, the number of matches) is “9”. For “macro can_syslog”, since there is no matching extraction log, the count value (number of matches) is “0”.

<< Step 125b >>
Next, regarding each macro, n is the number of matches, and m is the definition number of the “resource-operation” of the macro defined in the macro definition file 23.
Number of matches per “resource-operation” N = number of matches n ÷ number of definitions m
Based on the macro-threshold table 80 shown in FIG. 10, the number N of matches per “resource-operation” is compared with the threshold 82, and the domain DN in which the number N per “resource-operation” exceeds this threshold 82 For, use a macro to set the domain.

In the above case, for "macro can_network"
“Number of matches” ÷ “Number of defined pairs” = 9 ÷ 13 = 69%
Since the threshold value is larger than 60% for the “macro can_network” in the macro-threshold value table 80, the macro is used for the domain setting of these “resource-operation”. In this case, as shown in FIG. 6, a description 24a “can_network (httpd_t)” is registered in the domain description file 24 shown in FIG. With respect to “macro can_syslog”, since the number of matches n = 0, domain setting using this “macro can_syslog” is not performed.

<< Step 126 >>
When the above processing is performed for all the macros defined in the macro definition file 23 (FIG. 5), the processing proceeds to the next processing.

<Step 127>
For the process that could not be described by the macro in the process of step 125b, a description by “allow statement” that is a direct domain description is registered in the domain description statement file 24. In the extracted log shown in FIG. 18, since the macro is not defined in the macro definition file 23 for the pair “/www/index.html-read” on the 10th line, the description by the “allow” statement “Allow httpd_t / www / index / html read”, which is 24b, is registered in the domain description file 24.

According to the processing of steps 125a and 127 described above, the contents registered in the domain description file 24 are as follows.
can_network (httpd_t)
allow httpd_t / var / www read;
It becomes two lines. Here, it is clear from the description of “(httpd_t)” that the domain description sentence “can_network (httpd_t)” is a description sentence of “domain httpd_t”. As described above, by using the macro, even if there are many “resource-operation” pairs for the generated domain, the newly set domain description sentence becomes simple, and the domain description file 24 is displayed on the display 50 ( When displaying the process in FIG. 1), the process is very concise and easy to see, and the readability is improved.
<Step 128>
Next, the macro expansion function 90 (FIG. 2) uses the macro definition file 23 (FIG. 5) to convert the description 24a of the domain description sentence file (FIG. 6) 24 as an expansion 24c in FIG. The domain setting file 21 (FIGS. 3 and 6B) is expanded and set in a plurality of domains, and the same character string expression 21d as the description 24a is set. Further, the “allow statement” of the description 24b of the domain description file 24 is set in the domain setting file 21 as shown as expansion 24d in FIG.

  As described above, domain setting is performed on the domain description file (FIG. 6) 24 and the domain setting file 21, and the process shown in FIG. 16 (the process of step 120 in FIG. 11) is completed.

  Thus, the domain transition of this “domain httpd_t” is set by registering the “domain httpd_t” newly generated from the default domain in the domain transition setting file 22 (FIGS. 2 and 4). By registering in the domain setting file 21 (FIGS. 2 and 3) via the domain description file 24, this “domain httpd_t” is set so that the access can be controlled by the secure OS 10 (FIGS. 1 and 2). It will be.

  In this way, the domain transition in which the child process domain is generated from the default domain as the parent process domain is performed, so that the access control authority of the parent process is divided into child processes. As a result, the problem of security caused by giving a lot of authority to one domain can be solved.

1 is a diagram schematically showing an overall configuration of an embodiment of an access control setting system according to the present invention. FIG. It is a functional block diagram which shows one specific example of the server in FIG. It is the figure which showed the structure of the domain setting file in FIG. It is the figure which showed the structure of the domain transition setting file in FIG. It is a figure which shows the structure of the macro definition file in FIG. FIG. 3 is a diagram illustrating a configuration of a domain description sentence file in FIG. 2 and a relationship between the domain description sentence file and the domain setting file in FIG. 2. It is a figure which shows the structure of the access control log file in FIG. It is a figure which shows the structure of the importance table in FIG. It is a figure which shows the structure of the recommendation degree table in FIG. It is a figure which shows the structure of the macro-threshold table in FIG. It is a flowchart which shows the whole flow of the process of the domain setting by the setting tool shown in FIG. 2, and a domain transition. It is a flowchart which shows the flow of a process of step 90 in FIG. 11 by the domain generation recommendation degree calculation function in FIG. 12 is a flowchart showing a specific example of the processing flow of step 100 in FIG. 11 by the domain transition diagram creation function in FIG. 2. It is a figure which shows one specific example of the domain transition diagram created by the process shown in FIG. FIG. 15 is a diagram showing a list of processes selected from the domain transition diagram shown in FIG. 14. 12 is a flowchart showing a specific example of a process flow of step 120 in FIG. 11 by the setting generation function in FIG. 2. It is a figure which shows one specific example of the domain transition diagram by the domain transition in step 122 in FIG. It is a figure which shows the list of the logs extracted from the access control log file shown in FIG. 7 by the process of step 123 in FIG.

Explanation of symbols

A Operator 1 Server 10 Secure OS
20 Setting File 30 Access Control Log File 40 Setting Tool 50 Display 11 Access Control Function 12 Domain Control Function 13 Log Output Function 21 Domain Setting File 22 Domain Transition Setting File 23 Macro Definition File 24 Domain Description File 41 Domain Transition Diagram Creation Function 42 Domain generation recommendation degree calculation function 43 Setting generation function 60 Importance table 70 Recommendation degree table 80 Macro-threshold table 90 Macro expansion function 130, 130 'Domain transition diagram 131 Node (domain)
132-134 Entry point 135 Domain 136 Entry point 140 Domain creation recommended process list screen

Claims (4)

An access control setting system that enables access control settings for resources specified for each process,
An access control means for performing access control on resources for each process by assigning a domain for each process and permitting access to the resource from the process within the allocated domain;
Based on the domain transition setting file representing the hierarchical relationship between domains, the domain transition diagram representing the hierarchical relationship in a tree structure is drawn and displayed using the domain as a node, and operations on specified resources are denied. A domain transition diagram creating means for drawing the selected process in the node of the corresponding domain in the domain transition diagram in a selectable manner;
Setting generation means for reflecting the domain transition of the process in the domain transition setting file by selecting the process in the node of the domain;
With
An access control setting system characterized in that a transition to a domain different from the assigned domain is made to the process for which an operation on the resource is denied . In claim 1,
Log forming / outputting means for creating a log including an access result indicating whether an operation on the resource for each process is permitted or denied, and outputting the log to an access control log file;
In the access control log file, for each process for which an operation on the resource is rejected, the importance of the “resource-operation” pair in the log extracted from the access control log file is set in advance for each “resource-operation”. A domain generation recommendation degree calculation means that is obtained on the basis of the importance table in which importance is set for the set of "
With
The node including the process in which the domain transition diagram creation means renders the domain generation recommendation degree in the corresponding process drawn in the node in the domain transition diagram, and the domain generation recommendation degree is rendered An access control setting system characterized by coloring . In claim 1 or 2 ,
By selecting one process P of the processes drawn in the node of the domain in the domain transition diagram, the process P is determined based on the domain D of the node including the process P. Access control by creating a new domain DN, registering the domain DN in the domain transition configuration file as having been transitioned from the domain D, and setting the domain transition and registering it in the domain configuration file An access control setting system characterized by setting as a possible domain . In claim 3 ,
A log representing the set of domain D and process P “domain D-process P” is extracted from the access control log file;
The number of sets that match the “resource-operation” set in the log extracted in the macro definition file that defines the set of resources and operations for each macro is obtained, and the number of found sets of matches is a preset threshold value. The domain description sentence for the new domain DN for the “resource-operation” pair in the log is a description sentence described in the “resource-operation” pair in the log with a shared macro. A featured access control setting system.

Images