Operating System Controls

In this chapter, we explore software-oriented technologies for protecting processes, files, devices, and other system resources from undesirable behaviours. Firstly, we discuss the Linux permissions system, before describing various methods for isolating and sandboxing untrusted processes, e.g. chroot jails and cgroups. After this, we introduce two of the most popular access control systems, SELinux and AppArmor, which implement mandatory access control on Linux systems. We then describe containerisation technologies, covering LXC as a case study. The chapter ends with discussing the challenges of relying solely on operating system-level controls and looks at secure boot as a more sophisticated mechanism. Specifically, it introduces the notion of a trusted hardware component to ensure the authenticity of the operating system image and preceding boot-time components.