SELinux

SELinux History

SELinux, though only recently released to the public as a software product, has a substantial heritage. SELinux descends from work that began several decades ago. In 1973, computer scientists David Bell and Leonard LaPadula defined the concept of a secure system state and published a formal model describing a multilevel security system.

Later, in the 1980s, the work of Bell and LaPadula strongly influenced the U.S. government’s development of the Trusted Computer System Evaluation Criteria (TCSEC, popularly known as the Orange Book). The TCSEC defined six evaluation classes with progressively more stringent security requirements: C1, C2, B1, B2, B3, and A1. Class C1 and C2 systems, like Linux, depended upon discretionary access controls. Class B1 systems and systems of higher classes had to, like SELinux, implement mandatory access controls.

During the 1990s, researchers at the U.S. National Security Agency (NSA) worked with Secure Computing Corporation (SCC) to develop a strong and flexible mandatory access control architecture. Initially, their work focused on theoretical proofs of the properties and characteristics of the architecture. Eventually, working with a research team at the University of Utah, they developed a working prototype of the architecture called Flask within Fluke, a research operating system.

Later, NSA researchers worked with Network Associates and the R&D firm MITRE to implement the architecture within the open source Linux operating system. ...