Enforcement
Last updated
Secure Execution Environments
Last updated
It works on the kernel, as a Linux Security Module.
Linux kernel framework (since 2.6).
Provides “hooks” for arbitrary module inspection of system calls that are about to provide access to relevant system objects.
Module – control over module loading and unloading.
Network – control over sockets, transport layer, network layer etc.
Task – control over the lifecycle of a task.
Virtual File system – control over superblock, inode, and actual file operations.
IPC – control over IPC mechanisms like message queues, shared memory, and semaphores.
