Tomoyo Linux

Linux kernel security module

This article needs additional citations for verification. Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed.
Find sources: "Tomoyo Linux" – news · newspapers · books · scholar · JSTOR (September 2010) (Learn how and when to remove this template message)

|

Tomoyo Linux

Tomoyo Linux 2.x Domain Policy Editor

Original author(s)| NTT Data Corporation
Repository|

* svn.osdn.net/svnroot/tomoyo/

Operating system| Linux
Type| Mandatory access control
License| GPLv2
Website| tomoyo.osdn.jp

Tomoyo Linux (stylised as TOMOYO Linux) is a Linux kernel security module which implements mandatory access control (MAC).

## Overview[edit]

Tomoyo Linux is a MAC implementation for Linux that can be used to increase the security of a system, while also being useful purely as a systems analysis tool. It was launched in March 2003 and was sponsored by NTT Data Corporation until March 2012.[1]

Tomoyo Linux focuses on system behaviour. Tomoyo Linux allows each process to declare behaviours and resources needed to achieve their purpose. When protection is enabled, Tomoyo Linux restricts each process to the behaviours and resources allowed by the administrator.

## Features[edit]

The main features of Tomoyo Linux include:

* System analysis
* Increased security through Mandatory Access Control
* Automatic policy generation
* Simple syntax
* Ease of use

## History and versions[edit]

Tomoyo was merged in Linux Kernel mainline version 2.6.30 (2009, June 10)/[2] It is currently one of four standard Linux Security Modules (LSM), along with SELinux, AppArmor and SMACK.

The Tomoyo Linux project started as a patch for the Linux kernel to provide MAC. Porting Tomoyo Linux to the mainline Linux kernel required the introduction of hooks[3] into the LSM that had been designed and developed specifically to support SELinux and its label-based approach.

However, more hooks are needed to integrate the remaining MAC functionality of Tomoyo Linux. Consequently, the project is following two parallel development lines:

Tomoyo Linux 1.x, original version

* uses purposely created non-standard hooks
* fully featured MAC
* released as a patch for Linux kernel – Since this version 1.x does not depend on LSM, it can be used with Linux kernel 2.6 (starting from version 2.6.11) as well as 2.4.
* latest version: 1.7.1

Tomoyo Linux 2.x, mainline version

* uses standard LSM hooks
* fewer features
* integral part of Linux kernel version 2.6.30
* latest version: 2.5.0 included in Linux kernel 3.2

Akari (stylised as AKARI), Tomoyo 1.x fork

* uses standard LSM hooks
* fewer features than Tomoyo 1.x, but more than Tomoyo 2.x
* released as LKM (Loadable Kernel Module), so no recompilation of the kernel is necessary

## Naming[edit]

The name 'TOMOYO' is, officially speaking, a backronym for "Task Oriented Management Obviates Your Onus". According to one of the developers Tetsuo Handa, it's also a reference to the character Tomoyo Daidouji from Cardcaptor Sakura.[4]

## References[edit]

1. ^ "Tomoyo Linux Home Page". Tomoyo.osdn.jp. Retrieved 2013-05-23.
2. ^ "Tomoyo Linux, an alternative Mandatory Access Control". Linux 2 6 30. Linux Kernel Newbies.
3. ^ "Tomoyo #14 patch submission to LKML". LWN.net.
4. ^ "QandA - TOMOYO Linux Wiki". Archived from the original on 2015-12-25.

## External links[edit]

* Comparison chart of 1.x and 2.x
* Comparison chart of Tomoyo 1.x, 2.x, and Akari
* Tomoyo Linux project
* Tomoyo Linux at Embedded Linux Wiki
* LWN : Tomoyo Linux and pathname-based security
* Tomoyo – Debian Wiki
* Tomoyo Linux – ArchWiki

* v
* t
* e

Linux kernel

Organization|

| Kernel|

* Linux Foundation
* Linux Mark Institute
* Linus's law
* Tanenbaum–Torvalds debate
* Tux
* SCO disputes
* Linaro
* GNU GPL v2
* menuconfig
* Supported computer architectures
* Kernel names
* Criticism

|

Support|

* Developers
* The Linux Programming Interface
* kernel.org
* LKML
* Linux conferences
* Users
* Linux User Group (LUG)

Technical|

| Debugging|

* CRIU
* ftrace
* kdump
* Linux kernel oops
* SystemTap
* BPF

|

Startup|

* vmlinux
* System.map
* dracut
* initrd
* initramfs

ABIs|

* Linux Standard Base
* x32 ABI

APIs|

| Kernel|

| System Call
Interface|

* POSIX
* ioctl
* select
* open
* read
* close
* sync
* …
* Linux-only
* futex
* epoll
* splice
* dnotify
* inotify
* readahead
* …

|

In-kernel|

* ALSA
* Crypto API
* io uring
* DRM
* kernfs
* Memory barrier
* New API
* RCU
* Video4Linux
* IIO

Userspace|

| Daemons,
File systems|

* devfs
* devpts
* debugfs
* FUSE
* procfs
* sysfs
* systemd
* udev
* Kmscon

|

Wrapper
libraries|

* C standard library
* glibc
* uClibc
* Bionic
* libhybris
* dietlibc
* EGLIBC
* klibc
* musl
* Newlib
* libcgroup
* libdrm
* libalsa
* libevdev
* libusb
* liburing

Components|

* Kernel modules
* BlueZ
* cgroups
* Console
* bcache
* Device mapper
* dm-cache
* dm-crypt
* DRM
* EDAC
* evdev
* Kernel same-page merging (KSM)
* LIO
* Framebuffer
* LVM
* KMS driver
* Netfilter
* Netlink
* nftables
* Network scheduler
* perf
* SLUB
* zram
* zswap

* Process and I/O schedulers:
* Brain Fuck Scheduler
* Completely Fair Scheduler (CFS)
* Earliest eligible virtual deadline first (EEVDF)
* Noop scheduler
* O(n) scheduler
* O(1) scheduler
* SCHED_DEADLINE
* SCHED_FIFO
* SCHED_RR

* Security Modules: AppArmor
* Exec Shield
* seccomp
* SELinux
* Smack
* Tomoyo Linux
* Linux PAM

* Device drivers
* 802.11
* graphics
* Raw device

* initramfs
* KernelCare
* kexec
* kGraft
* kpatch
* Ksplice

Variants|

* Mainline
* Linux kernel
* Linux-libre
* High-performance computing
* INK
* Compute Node Linux
* SLURM
* Real-time computing
* RTLinux
* RTAI
* Xenomai
* PREEMPT_RT
* MMU-less
* μClinux
* PSXLinux

| Virtualization|

* Hypervisor
* KVM
* Xen
* OS-level virtualization
* Linux-VServer
* Lguest
* LXC
* OpenVZ
* Other
* L4Linux
* ELinOS
* User-mode Linux
* MkLinux
* coLinux

|

Adoption|

| Range
of use|

* Desktop
* Embedded
* Gaming
* Thin client:
* LTSP
* Server:
* LAMP
* LYME-LYCE
* Devices

|

Adopters|

* List of Linux adopters

* Linux portal
* Free and open-source software portal
* Category

*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template