The Linux Under Capabilities Analysis And Improvement Of The Security Mechanisms

Capabilities Secure Model is an access control mechanism over privileged operations described in POSIX.le. Capability means a partitioning of all the powerful root privilege into a set of distinct privileges. It was brought forward for enabling more specific control over what privileged operations a process can do.Capabilities Secure Model had been implemented in Linux kernel from the version v2.1. But Linux does not support the executable file's Capabilities for the limit of the file systems. So we still can not use the Capabilities mechanism to enhance the security of Linux Operating System.This paper mainly described the improvements we have done on the implement of the Capabilities mechanism in Linux. We improved it mainly in two aspects. For the first one, we supported the executable files' capabilities, enabling users to control what capabilities a process can have via configuring the executable files' capabilities. For another one, we changed the rules which the system gives processes capabilities, so that different user's process can have different capabilities when execute the same program with the same setting of capabilities. And we also implemented the files' access control mechanism of Access Control List based on process identifying in Linux. So we can give better protection on the capabilities settings of the executable files' and other resources in the system.This paper also proposed some methods of how to gather the minimum capabilities info which a process or a program need to fulfill its services. And this paper finally discussed how to use the improved Capabilities mechanism to enhance the security of Linux Operating System.