Improving Mandatory Access Control for HPC clusters - Archive ouverte HAL Access content directly
Journal Articles Future Generation Computer Systems Year : 2013

Improving Mandatory Access Control for HPC clusters


HPC clusters are costly resources, hence nowadays these structures tend to be co-financed by several partners. A cluster administrator has to be designated, whose duties include, amongst others, the prevention of accidental data leakage or theft. Linux has been chosen as an operating system for the CEA's computing platforms. However, strong system security solutions such as SELinux are usually difficult to set up in large environments. This article presents how we have adapted a MAC mechanism in order to enforce confidentiality and integrity between a large number of users. First we define our security objectives, and show how they direct our technical choices. Then we present how confinement was achieved using the SELinux security mechanism, and how various attack scenarios were addressed. We then focus on the use of Mandatory Categories, access control on high bandwidth network filesystems and the integration of new users and applications. We discuss some residual technical challenges. Finally, we present benchmark results and validate the acceptable performance impact of our deployment on a modern cluster.

Dates and versions

hal-00691844 , version 1 (27-04-2012)



Mathieu Blanc, Jean-François Lalande. Improving Mandatory Access Control for HPC clusters. Future Generation Computer Systems, 2013, 29 (3), pp.876-885. ⟨10.1016/j.future.2012.03.020⟩. ⟨hal-00691844⟩
77 View
0 Download



Gmail Mastodon Facebook X LinkedIn More