---------------------------------------
DEC(Dynamic Enhance Control) is a dynamic file access enhancement mechanism. It resolves DAC interception and sharefs security risks, precisely controlling file access via a kernel permission database, ioctl interfaces and LSM framework.
DEC will bind the token ID of the application and the paths it can access. The user-level sandboxmanager module and appspawn module will configure the relevant policies. When the application accesses the control paths under the sharefs file system, DEC checks the:
create,
read,
write,
remove,
rename,
move,
access
of files by the application.
Signed-off-by: staralien <chengxin@servicecenter-harmonytsc.com>
ligongshaospace