Abstract: Mandatory access control (MAC) for operating system (OS) brings strong security guarantee for the system because it runs at high privilege level. However, the classical OS MAC only supports static security policies. When the security requirements change, the security policies must be reconfigured and reloaded. Therefore, it is difficult to meet the requirements of dynamic regulation of access permissions in scenarios such as high-sensitivity application state transition, cloud native dynamic scheduling, and BYOD. Attributes-based access control has strong extensibility, flexibility and expression ability, which provides a solution to improve the dynamic and flexibility of the security policy of MAC in OS. In this paper, the theoretical model and system architecture model of attributes-based dynamic mandatory access control for operating systems are proposed. Then, the prototype system is designed and implemented by combining with the classic MAC mechanism of Linux, and the feasibility of the model is verified. Finally, in view of the possible performance impact of the introduction of attribute factors, the optimization research of access control is carried out from two aspects of time and space.

Key words: attribute, operating system, dynamic mandatory access control ,