操作系统访问控制错误修复方法研究

Configuring correct security policies is critical to assure the security of operating systems (OS), and hence has direct impact to the security of all Information Technology systems. However, OS users often experience difficulties in configuring large-scale while correctness-assured OS security policies. Existing techniques can assist OS users in detecting misconfiguration of OS security policies, but their effectiveness is commonly affected by issues like inadequate usability, confusing detection results, and having no support for fixing such misconfiguration. To address the above issues, we propose to investigate and develop a holistic and formal-method-based solution for detecting and localizing errors in OS security policy configurations, with which OS users can find and fix OS security policy misconfiguration more quickly and with less effort. To be more specific, this research will investigate a solution that comprises the following measures: modeling measure that formalizes OS security policy mechanisms in a unified manner; measure that automatically detects violation instances to OS security polices; measure that localizes configuration errors causing such violation instances (by calculating the minimum edge cut sets of directed graphs); measure that labels OS security policies to establish a direct mapping between configuration errors and their corresponding violation instances; and measure that propagates the labelling information. The correctness and effectiveness of the solution to be investigated will be evaluated against mainstream OS security policy mechanisms.

操作系统的安全性是所有信息系统安全的基础。而作为操作系统安全机制重要内容的安全策略配置却受到配置困难、正确性难以保障等问题的困扰，从而极大地影响了操作系统的安全性。现有的研究成果在检测安全策略配置错误方面，普遍的存在着适用性不够、检测结果不直观等缺陷，无法帮助操作系统用户有效的理解和修正安全策略配置上的错误。为解决现有方法的缺陷，本课题将研究和建立一套统一、有效的安全策略配置错误检测和定位框架，从而帮助操作用户及时准确地发现安全策略配置中的错误，减少操作系统的安全隐患。该框架包含面向多操作系统的安全策略建模机制以及基于自动推理的违反安全策略实例查找机制并借助于图论中有向图最小割集求解技术，对导致违反安全策略实例的安全策略配置错误实现精确定位。为用户更好的理解和修正安全策略配置中错误，该框架还将引入安全策略规则标记和标记信息传播机制，从而建立从安全策略配置规则到违反安全策略的实例映射关系。

为帮助用户及时准确地发现安全策略配置中的错误，减少操作系统的安全隐患，本项目提出了能力依赖图的概念，以此为基础，设计并实现了一套统一、有效的安全策略配置错误检测框架。该框架可以对Windows系列、Linux系列，以及Android系列操作系统的安全机制和策略进行建模，构建能力依赖图，然后基于一阶逻辑自动推理寻找攻击路径、发现违反安全策略的实例，从而发现安全配置漏洞。对于包含了潜在攻击路径的系统配置，项目提出了正常能力损失（Normal Capability Loss）的概念，将策略配置的修复转化为MaxSAT问题，给出策略强化方案，最大限度地降低系统的能力损失。我们将框架应用于多种主流商业操作系统，成功地1）发现了Ubuntu 10.04中SELinux安全策略的错误配置，并对其进行了修复；2）发现了三星Android 7.0中的多条攻击路径，其中包括了一条被黑客实际采用的攻击路径。项目实施期间，课题组共计发表论文15篇（包括1篇CCF A类会议论文和1篇B类会议论文），申请软件著作权1项，实现原型系统1套，培养研究生5名，并为6名研究生提供研究方向。总体而言，本课题实现了预期目标，项目所实现的框架可以极大地简化系统管理员在评估系统面临的潜在安全风险和选择安全加固方案时花费的精力。