The document discusses security mechanisms in Linux operating systems. It covers access control modules, including audit, access control, and role-based access control modules. It also discusses security models like DAC, MAC, RBAC and how they integrate with the operating system's security tag library and audit log. The principles of least privilege, separation of duties and simplicity are important to the design.

2.  Types of security in system.
 Theory of design for security Os.
 Security hidden troubles in Linux Os.
 Security policy
1.Audit module
2.Access control module
3.Role based access control module.
 Architecture

3.  Least privilege
 Efficiency
 Open System
 Complete coordination
 Privilege separation
 Simplicity

4.  Access control mode is simple:
Access control lists and mandatory access control lists are not
supported.
 Security audit mechanism is insecurity
Security audit mechanism of the present Linux is insecurity
 Super user right is great
If the password is purloined, the system will be not safe at all.

5.  Enforced by organizational polices or security
mechanism.
 Security mechanism and access control policy
for os security design.
1.Audit module
2.Acess control module
3.Role based access control module.

6.  Invasive technology can attack the Kernel of
Linux.
 Linux security audit module should be
designed and applied independently.
 Security audit module for kernel.

7. Event Collect Parser Alerting
Record
Audit log library

8.  Ability to permit or deny the use of particular
resource.
 It manages physical ,logical or digital resources.
 To advance security it adds security access control
and Integrated access control sub module.

10.  Subject: Entity that perform action in system.
 Object: Entities representing resources to which
access may need to controlled .
 Subject access an object must pass through
Security, Integrated and Discretionary access
control modules.
 Subject access corresponding security tag
library when it through each access control
subsystems.

11.  It base on Bell-La padula(BLP) model.
 It can operate MAC i.e Mandatory access
control and DAC i.e Discretionary access
control.
 MAC : os provide ability to subject to access or
perform some operations on subject.
 When subject sends a request to an object ,
extract security tag of subject and object from
security tag library.

12.  Security Labels assigned to all objects,contain two
pieces of information - a classification and a
category.
 When a user access a resource Os checks the user's
classification and categories and compares them to
the properties of the object's security label. If the
user's credentials match the MAC security label
properties of the object access is allowed.
 Examples: SE Linux, by NSA, trusted Solaris

13.  The control of access is based on the discretion
(wish) of the owner.
 Access to system resources is controlled by the
operating system.
 Each resource object on a DAC based system has
an Access Control List (ACL).,contains a list of
users and groups to which the user has permitted
access.
 For example, User A may provide read-only access
on one of her files to User B, read and write access
on the same file to User C and full control to any
user belonging to Group 1.
 Examples: Unix, Linux, Windows access control.

14.  It based on Biba Integrity model, that describes
a set of access control rules designed to
ensure data integrity.
 It used to add security tag for subjects and
objects.
 When subject sends a request to object the Biba
integrity model extract integrated attributes of
subject and object from security tag library to
match.

15. Model Access Control Owner Security Control Policy
DAC Data Owner ACL.
MAC Operating System Security Labels.
RBAC Administrator Role/Function Positions.

16. Subject
System call
Access control
model
Security tag
library
Audit model
Object
Audit log
library

17.  RBAC is access policy determined by system.
 Used in applications where multilevel security
requirement may exists.
 Roles are created for various job function and
user are assigned roles based on their
qualifications.

18.  Role assignment : A subject can execute a
transaction only if the subject has selected or
been assigned a role.
 Role authorization : A subject's active role must
be authorized for the subject.
 Transaction authorization : A subject can
execute a transaction only if the transaction is
authorized through the subject's role
memberships

19.  It uses the role-based access control mechanism
to control unauthorised access to patient
medical information in KDIS.
 permissions are not assigned to users but to the
roles, thus providing great flexibility in
administration and cost reduction

22.  Principle of least privilege
 System administrator
 Security administrator
 Security audit administrator

23.  Principle of least privilege
 System administrator
 Security administrator
 Security audit administrator

24.  Hence the access control module, audit module
and role based access control module improve
the operating system security.
 The group of this three module can prevent the
lost and misses of data to improve stability,
processing speed of Os.