【作者】 韩桂华；

【导师】 蒲云；

【作者基本信息】 西南交通大学 ， 计算机应用技术， 2004， 硕士

【摘要】 随着计算机和网络技术的高速发展，信息技术在给人们工作、生活带来方便的同时，也带来了信息安全方面的威胁。目前的多种信息安全技术中，都是以操作系统作为基础。由于Linux的源代码开放性，本文以Linux为基础研究了操作系统的核心部分的实现机制，并提出了其在访问控制方面的安全增强方法。 论文首先详细分析了Linux操作系统中内核部分源代码的实现机制，研究了它们的实现方法，以及现有的安全机制。之后对Linux操作系统采用的安全机制进行了分析，总结出现有系统在访问控制方面的安全缺陷。 Linux操作系统在访问控制方面存在的缺陷如下：超级用户权限太大，可以做一切事情；文件系统访问控制力度不够，系统上的重要文件可以很容易被修改；进程也不能得到很好的保护，关键服务容易被非法终止或删除；基于保护位的自主型访问控制，很难实现基于单个用户制定全局安全策略。 本文重点研究了在Linux操作系统中实现多种安全策略，并在Linux内核中根据访问控制通用框架(GFAC)方法，将访问控制决策和访问控制实施分离，实现细粒度的自主访问控制和基于Bell-LaPadula模型的多级安全规则的强制访问控制机制以及基于Biba模型的强制访问控制多种安全策略，从而提高了操作系统中信息的保密性和完整性。更多还原

【Abstract】 With the development of computer science and network technology, information technology makes people’s work and life more and more convenient, and at the same time threatens the security of information. Up to now, many information security technologies have been developed to protect the information from destroying, leaking, or unavailability; secure operating system is the basis of all of them. The thesis designs and implements a secure OS based on Linux that is free and open with the goal of improving the security in access control.The codes of Linux kernel are analyzed firstly. The method of implementation and the way of security is studied. Then security mechanism of Linux is elaborated and some insecure factors in Linux are pointed out.Linux has limitations in access control as follow: firstly, root has too many privileges and has full access to everything; Secondly, the protection of file system isn’t strong enough, the important files can be easily changed; Thirdly, the key services can be illegally stopped or deleted because of lacking process protection mechanism; Finally, discrete access control based on protection bits can’t provide global secure policy based on individual user.The paper mainly discusses diverse security policies in operating systems. The GFAC framework separates access control between enforcement and decision, implement grain discretionary access control, multi-level security policy based Bell-LaPadule model mandatory access control and Biba model integrity access control, so as to strengthen security and integrate of operation system.更多还原