Dynamic mandatory access control for multiple stakeholders

摘要: In this paper, we present a mandatory access control system that uses input from multiple stakeholders to compose policies based on runtime information. the emerging open cell phone environment, many devices run software whose permissions depends stakeholders, such as device owner, service provider, application etc., rather than single administrator. However, current administration remains either discretionary, allowing running and perhaps compromised process administer permissions, or mandatory, requiring administrator know all for possible legal runs. A key problem is users may download arbitrary programs their devices, contain while some reasonable functionality. need in combination with other conflicting lead an attack, voice-over-IP calls. our approach, use "soft" sand-boxing mechanism first processes, request stakeholder authorize operations outside sandbox are not prohibited by policy, maintain execution role identify its state stakeholders. We define proxy policy server caches combines make decisions. Our framework was implemented modifying SELinux module using remote server, although local also possible. incur 0.288 ts performance overhead only when be consulted, new cached.