System and method for file system mandatory access control
First Claim
Patent Images
1. A method for controlling access to a file by a process, said method comprising:
- receiving a request from said process to access said file, said process being associated with a compartment implemented on an operating system;
determining an identifier of said compartment; and
searching for access rules defining whether processes associated with particular compartments are permitted to access certain file resources, said rules retained in a database in a hierarchical manner that parallels a subdirectory structure of a file system containing said file;
wherein said request includes a filename containing a path identifier, said path identifier specifying a plurality of subdirectories, and wherein said step of searching includes the sub-steps of;
(a) searching said database according to a lowest subdirectory of said plurality of subdirectories for an access rule applicable to said compartment;
(b) when an access rule is found in step (a), proceeding to step (e);
(c) searching said database according a next higher subdirectory of said plurality of subdirectories for an access rule applicable to said compartment; and
(d) repeating step (c) until the first event of the following events occurs;
(i) an access rule applicable to said compartment is located;
(ii) said database is searched according to a root directory;
(e) when an access rule applicable to said compartment is located, providing access to said file when said access rule applicable to said compartment allows access.
9 Assignments
0 Petitions
Accused Products
Abstract
In one embodiment, the present invention is related to a computer system including compartments implemented on an operating system. A database contains access rules with the access rules defining which compartments are authorized to access particular file resources. A kernel module receives a system call to access a file from a user space application belonging to a compartment. A security module determines whether the user space application is authorized to access the file utilizing access rules stored in the database.
-
Citations
6 Claims
-
1. A method for controlling access to a file by a process, said method comprising:
-
receiving a request from said process to access said file, said process being associated with a compartment implemented on an operating system; determining an identifier of said compartment; and searching for access rules defining whether processes associated with particular compartments are permitted to access certain file resources, said rules retained in a database in a hierarchical manner that parallels a subdirectory structure of a file system containing said file; wherein said request includes a filename containing a path identifier, said path identifier specifying a plurality of subdirectories, and wherein said step of searching includes the sub-steps of; (a) searching said database according to a lowest subdirectory of said plurality of subdirectories for an access rule applicable to said compartment; (b) when an access rule is found in step (a), proceeding to step (e); (c) searching said database according a next higher subdirectory of said plurality of subdirectories for an access rule applicable to said compartment; and (d) repeating step (c) until the first event of the following events occurs; (i) an access rule applicable to said compartment is located; (ii) said database is searched according to a root directory; (e) when an access rule applicable to said compartment is located, providing access to said file when said access rule applicable to said compartment allows access. - View Dependent Claims (2, 3)
-
-
4. A method for controlling access to a file by a process, said method comprising:
-
receiving a request from said process to access said file stored in a file system having a subdirectory structure, said process being associated with a compartment implemented on an operating system; determining an identifier of said compartment; searching for access rules defining whether processes associated with particular compartments are permitted to access certain file, said rules retained in a database structured in a hierarchical manner that parallels the subdirectory structure; and if said database does not include an access rule for a subdirectory containing said file, determining permission for said process to access said file according to an access rule for a parent directory of said subdirectory, and accessing said file if permitted. - View Dependent Claims (5, 6)
-
Specification