I am exploring on SE Linux and while doing so i found it as an example of Trusted OS. Is it really an example of Trusted OS stack like TrouSerS ? SELinux as per my understanding modifies the Linux Kernel by using LSM. Can it be really used to identify hardware level information and labeling so as to facilitate on lines of Trusted Operating System ?


“Trusted OS” is a vague concept. It means an OS that you trust to be free of malware. The TPM people like to use “trusted” to mean “using a TPM”, but they don't have a monopoly on the word.

TrouSerS allow the operating system to make use of keys stored in a TPM. The point of a TPM is to store and use keys that cannot be copied outside of the TPM; this can be used for things like secure boot (be sure that the hardware boots the operating system that you expect) and device binding (be sure that a cryptographic operation was performed on a particular computer). Neither of these are intrinsic functionality of a “trusted OS”, though you do need to have some reason to trust your boot chain if you're going to trust the OS.

SELinux modifies Linux to enhance the isolation between processes. In terms of trust, it somewhat reduces the amount of software that you have to trust, though the benefits are mostly limited to servers — for typical desktop systems, you have to trust all the applications you're using (such as your web browser with all its plugins), and that is where the difficulty lies. SELinux is about logical process isolation and doesn't rely on cryptography, so it has no use for a TPM.

SELinux can be used to confine TPM access to certain applications, by setting the appropriate context on /dev/tpm and on TPM-using applications. The TrouSerS README.selinux may help.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.