Reducing resource consumption of SELinux for embedded systems with contributions to open-source ecosystems

Yuichi Nakamura, Yoshiki Sameshima, Toshihiro Yamauchi

Research output: Contribution to journalArticle

Abstract

Security-Enhanced Linux (SELinux) is a useful countermeasure for resisting security threats to embedded systems, because of its effectiveness against zero-day attacks. Furthermore, it can generally mitigate attacks without the application of security patches. However, the combined resource requirements of the SELinux kernel, userland, and the security policy reduce the performance of resource-constrained embedded systems. SELinux requires tuning, and modified code should be provided to the open-source software (OSS) community to receive value from its ecosystem. In this paper, we propose an embedded SELinux with reduced resource requirements, using code modifications that are acceptable to the OSS community. Resource usage is reduced by employing three techniques. First, the Linux kernel is tuned to reduce CPU overhead and memory usage. Second, unnecessary code is removed from userland libraries and commands. Third, security policy size is reduced with a policy-writing tool. To facilitate acceptance by the OSS community, build flags can be used to bypass modified code, such that it will not affect existing features; moreover, side effects of the modified code are carefully measured. Embedded SELinux is evaluated using an evaluation board targeted for M2M gateway, and benchmark results show that its read/write overhead is almost negligible. SELinux's file space requirements are approximately 200 Kbytes, and memory usage is approximately 500 Kbytes; these account for approximately 1% of the evaluation board's respective flash ROM and RAM capacity . Moreover, the modifications did not result in any adverse side effects. The modified code was submitted to the OSS community along with the evaluation results, and was successfully merged into the community code.

Original languageEnglish
Pages (from-to)664-672
Number of pages9
JournalJournal of Information Processing
Volume23
Issue number5
DOIs
Publication statusPublished - Sep 15 2015

Keywords

  • Embedded system
  • Open-source software (OSS)
  • SELinux

ASJC Scopus subject areas

  • Computer Science(all)

Fingerprint Dive into the research topics of 'Reducing resource consumption of SELinux for embedded systems with contributions to open-source ecosystems'. Together they form a unique fingerprint.

  • Cite this