Main Content

Enforcing Flexible Access Control Policies in a Rust-based Linux Security Module

Author: Lukas Andres Fischer

Supervisors: Prof. Dr. Boris Koldehofe, Dr.-Ing. Peter Amthor

Format: Master's thesis, TU Ilmenau

Access control policies enforced in operating systems are pivotal to support security requirements of applications. For a wide range of applications, attribute-based access control (ABAC) has become a popular class of policies due to its flexibility, expressiveness and scalability. Mainstream operating systems (OSs), however, predominantly use more restrictive policies, which are tightly coupled to their abstractions. Not only does this limit the applicability to more dynamic use cases, it also impedes formal policy analysis to enable correctness guarantees. In order to provide these benefits to a mainstream OS and to explore the challenges this integration poses, we present a first version of the Rust DABAC LSM, a Linux Security Module (LSM) that supports flexible, formula-based ABAC policies with state-changing post-conditions. We base this on a reference monitor architecture pattern and choose to implement it in Rust for its correctness guarantees. In addition to the implementation and its comprehensive evaluation, we contribute an analysis of the state of the art in ABAC implementations in Linux, and an extensive requirements specification and design of the Rust DABAC LSM. The design focuses on applicability of the reference monitor architecture to the Linux kernel and on performance-enhancements through caching. Our evaluation results show the degree of practical viability of using the Rust DABAC LSM. Individual subsequent requests are handled efficiently, although strict locking requirements of the enforced dynamic ABAC policies imply a performance penalty under lock contention. For the chosen architecture and such policies, we also show that the caching solutions could not effectively improve over the performance of the no-caching variant. A qualitative analysis reaffirms the fact that Linux’s monolithic architecture impedes fulfilling the verifiability reference monitor criterion. We also conclude that Rust support in the kernel is still in its early stages, but mostly suffices for the implementation and keeps improving.

Completed: 23.05.2025

References: https://bibliographie.tu-ilmenau.de/servlets/DozBibEntryServlet?mode=show&id=ilm_mods_00065688