Trusted Computing Base. The programs (more technically, objects and processes) that are trusted to do what they are supposed to do (and only what they are supposed to do), and that would put the system at risk if compromised. On traditional Unix systems, any program run by root is part of the TCB (whether or not you should be trusting it). That's because traditional Unix is a DAC (Discretionary Access Control) system, but "root" is allowed to bypass all controls.
MAC (Mandatory Access Control) systems don't necessarily allow a user like root that can bypass anything. However, because it is difficult to administer a system without an overall administrator with great privilege, MAC systems tend to concentrate on specific areas where power is limited. For example, Windows systems have the concept of ownership where not even the administrator can necessarily access a file owned by someone else. The administrator can take ownership for itself, but that's a one way trap door: once taken, the administrator can't give it back.
In the Linux world, SELinux is a MAC system. It is imported to understand that a MAC system doesn't necessarily mean "trusted". From the SELinux FAQ:
The phrase "Trusted Operating System" generally refers to an operating system that provides sufficient support for multilevel security and evidence of correctness to meet a particular set of government requirements. Security-enhanced Linux incorporates useful ideas from these systems but focuses upon mandatory access controls. It is expected that this work would be combined with other efforts (e.g., auditing and documentation) to construct a "trusted" system. The initial focus of Security-enhanced Linux development has been to create useful functionality that delivers tangible protection benefits in a wide range of real-world environments in order to demonstrate the technology.
Got something to add? Send me email.
More Articles by Tony Lawrence © 2011-07-07 Tony Lawrence