tags/htdocs/about.html.en

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html lang="en-US">
<head>
<title>TOMOYO Linux About Page</title>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<meta http-equiv="content-style-type" content="text/css">
<link rel="stylesheet" href="/media/tomoyolinux.css" media="all" type="text/css">
</head>

<body>

<div id="titlebar">
<img src="/media/tomoyotitle.png" alt="tomoyotitle.png" width="320" height="40" border="0" align="left">
</div>

<div id="navbar" class="tomoyo-about">
<ul id="navbarlist">
<li id="tomoyo-home"><a href="/index.html.en" title="TOMOYO Linux Home Page">Home</a></li>
<li id="tomoyo-about"><a href="/about.html.en" title="About TOMOYO Linux">About</a></li>
<li id="tomoyo-download"><a href="/download.html.en" title="Get TOMOYO Linux">Download</a></li>
<li id="tomoyo-changelog"><a href="/changelog.html.en" title="TOMOYO Linux ChangeLog">ChangeLog</a></li>
<li id="tomoyo-documentation"><a href="/documentation.html.en" title="Official Documentation">Documentation</a></li>
<li id="tomoyo-links"><a href="/links.html.en" title="Useful links">Links</a></li>
<li id="tomoyo-support"><a href="/support.html.en" title="Support information">Support</a></li>
</ul>
</div>

<div id="content">

<div id="about">

<h3>About TOMOYO Linux</h3>

<p>TOMOYO Linux is a Mandatory Access Control (MAC) implementation for Linux that can be used to increase the security of a system, while also being useful purely as a system analysis tool. It was launched in March 2003 and is sponsored by <a href="http://www.nttdata.co.jp/en/">NTT DATA Corporation</a>, Japan.</p>

<p>TOMOYO Linux focuses on the behaviour of a system. Every process is created to achieve a purpose, and like an immigration officer, TOMOYO Linux allows each process to declare behaviours and resources needed to achieve their purpose. When protection is enabled, TOMOYO Linux acts like an operation watchdog, restricting each process to only the behaviours and resources allowed by the administrator.</p>

<p><strong>TOMOYO Linux 1.x</strong> is the original branch of development, which was first released on 11th November 2005 under the GNU GPL. It was implemented as a patch that can be applied to the Linux kernel and is still in active development.</p>

<p><strong>TOMOYO Linux 2.x</strong> is the Linux mainline kernel branch of development. In June 2009, a subset of TOMOYO functionality was merged into the Linux kernel 2.6.30 and makes use of standard Linux Security Module (LSM) hooks. However, the LSM hooks must be extended further in order to port the full MAC functionality of TOMOYO Linux 1.x into the Linux kernel. Thus, it does not yet provide equal functionality with the 1.x branch of development. <a href="/comparison.html.en">This chart</a> compares the differences between each branch.</p>

<h3>What can TOMOYO Linux be used for?</h3>

<p>In a normal operating system (OS), every application is unmonitored and it is difficult to determine what is happening in a system:</p>
<p><img src="/media/disabled.png" alt="disabled.png" width="500" height="350" style="border:2px solid #000000"></p>

<p>If TOMOYO Linux is introduced, each application can be monitored to determine exactly what it is doing and a policy configuration can be automatically generated.</p>

<p>Every action that an application performs is automatically appended to an Access Control List (ACL). Browsing this list can allow a precise understanding of what each application is doing:</p>
<p><img src="/media/permissive.png" alt="permissive.png" width="500" height="350" style="border:2px solid #000000"></p>

<p>TOMOYO Linux can therefore be used as a system analysis tool, which can aid in:</p>
<ul>
<li>debugging applications</li>
<li>understanding the behaviour of a Linux system</li>
<li>writing documentation</li>
</ul>

<p>If protection is enabled, TOMOYO Linux uses Mandatory Access Control to restrict each application to do only what the administrator has allowed it to do:</p>

<p><img src="/media/enforcing.png" alt="enforcing.png" width="500" height="350" style="border:2px solid #000000"></p>

<p>TOMOYO Linux can therefore be used as a system restriction tool, which can aid in:</p>
<ul>
<li>restricting services such as SSH and Apache</li>
<li>restricting system administrator operations</li>
<li>creating per-application networking firewalls</li>
<li>reducing damage caused by buffer overflows and other security exploits</li>
<li>deploying a honeypot system</li>
</ul>

</div><!-- about -->

</div><!-- content -->

<div id="footer">
<p class="timestamp">Last modified: $Date$</p>
<p class="trademark">Linux�� is a registered trademark of Linus Torvalds world-wide. TOMOYO�� is a registered trademark of <a href="http://www.nttdata.co.jp/en/">NTT DATA Corporation</a>.</p>
</div>

</body>
</html>