LSM(Linux Security Modules)是得到Linus Torvalds本人支持的安全访问控制的底层架构,强制访问控制是操作系统安全增强技术中经常采用的方式。为了在基于Linux的集群系统上,实现节点间信息的安全流动,在简要介绍LSM和强制访问控制的原理的基础上,讨论了如何拓展LSM及其相应的安全政策来实现集群系统节点问的安全访问控制,并设计和实现了基于LSM的分布式强制访问控制。最后指出了这一实现在性能上的缺陷和进一步改进的方向。
The LSM(Linux security modules), which is supported by Linus Torvalds,is general access control framework for Linux kernel. The MAC(mandatory access control) is often used security enhancing technique of operating system. In order to implement secure information flow of nodes for Linux clusters,describes the principle of LSM and MAC concisely, and based on that, discusses how to expand LSM and security policies to guarantee secure aecess control of cluster nodes, At the same time, describes the design and implementation of distributed MAC based on LSM. Inthe end, point out performance limitation and improvement in the future.