Graph-Powered Mining and Analysis of SELinux Security Policies

In this paper, we propose a graph-powered policy analysis tool to query and envision security policies to precisely pinpoint discrepancies, especially focused on SELinux. The complexity of writing policies and checking security goals in this language has often led security administrators to disable SELinux in these systems. Various studies have been carried out on proposing different tools and techniques for SELinux policy writers for analyzing and refining SELinux policies; however, the solutions they propose often have limitations of their own, and can even add further complexity to the task of defining security policies. This paper proposes a graph-powered approach to analyzing and refining SELinux policies that is simple and straightforward to use. Our approach exploits Neo4j to model the Type Enforcement specifications of SELinux security policies. We focus on the relationships that exist in SELinux policies. We have developed a graph-based access-control model for capturing the complexities of the SELinux Type Enforcement mechanism.