Security-Enhanced Darwin: Porting SELinux to Mac OS X
Christopher Vance, Todd C. Miller, Robert Dekelbaum, Andrew Reisse · 2007
Security-Enhanced Darwin (SEDarwin) is a port of access control elements derived from the National Security Agency’s Security Enhanced Linux (SELinux) to Darwin, the Open Source core of Apple’s Mac OS X operating system. Mac OS X combines both Open Source and proprietary technologies into a widely-used, production-quality UNIX-based workstation. Because Darwin is available under an Open Source license, it is possible to add mandatory access controls while still maintaining compatibility with the large base of user space applications, proprietary graphical components, and programming frameworks. While it was straightforward to port many of the SELinux components, Darwin’s unique architecture meant significant new engineering was necessary in order to provide SELinux-style access controls consistently across the entire system. This paper describes the component technologies in Darwin, the areas of significant new development, and provides comparisons to SELinux.