Skip to content
Log in
Sponsored Design Multi-Agent AI Systems Using MCP and A2A: Engineer your own Pyt Design Multi-Agent AI Systems Using MCP and A2A: Engineer your own Pyt
Conference

Evaluating Runtime Security in DevSecOps Pipelines with SELinux Mandatory Access Control

Harsh Dhruv
Jul 2026 · Annual International Computer Software and Applications Conference · pp. 3276-3277 · 0 citations · 8 references
Computer Science

Abstract

Runtime security in DevSecOps pipelines remains a significant challenge because widely used tools such as Bandit, Hadolint, and Trivy detect vulnerabilities during development but do not enforce security at execution time. This paper evaluates a three-layer defense-in-depth model combining DevSecOps tools, Linux Discretionary Access Control (DAC), and SELinux Mandatory Access Control (MAC). Experiments were conducted on Flask and Django applications running on Red Hat Enterprise Linux 9.6 with SELinux in enforcing mode. Results show that DevSecOps tools reported warnings but provided no runtime protection, DAC failed under permissive configurations such as chmod 777, and SELinux MAC consistently blocked unauthorized file-write attempts, generating 10,324 AVC denials for Flask and 2,065 for Django. SELinux introduced approximately 50% throughput overhead in Flask, representing a measurable but acceptable trade-off for strong runtime enforcement.

DOI Semantic Scholar
View source

Similar papers

Jul 2026

CHARGE: Leveraging CWE Hierarchies for Hardware Security SystemVerilog Assertion Generation

CHARGE is an automated framework for generating security properties for unverified RTL modules using CWEs and large language models using CWEs and large language models that leverages the hierarchical nature of CWE entries to improve accuracy when identifying security-critical assets in unverified RTL modules.

Xiao Tan, C. Sturton · 0 citations
Jul 2026

Stack integrity for practical code-reuse attack defense

StackPatroller is proposed, a stack-integrity-based runtime supervision framework that enforces program integrity through configurable policies that monitors runtime stack contexts to detect early deviations from normal execution, enabling the identification of whole-function reuse and certain forward-edge attacks earlier—within user mode before any unintended system calls occur.

Yuanheng Xu, Si-Yu Zhang, Juan Wang et al. · 0 citations
Open access Jul 2026

Can Language Models Generate Secure Terraform Code? A Security-Focused Benchmark Using Static Analysis

An empirical benchmark evaluating whether LLMs and SLMs can generate security-compliant AWS Terraform configurations suggests that prompt design is a critical factor, highlighting the need for a proper pipeline for developing and validating LLM-assisted secure IaC generation.

Francis Luis Santos Vargas, R. Mansilha, Diego Kreutz · 0 citations
Open access Aug 2026

DT-GenShield: A Digital Twin-Driven Runtime Security Architecture for Protecting Large Language Models Against Indirect Prompt Injection

DT-GenShield, a Digital Twin-driven runtime security architecture that integrates semantic threat detection, operational state representation, policy-guided mediation, and runtime logging to protect LLM-based systems before model inference, is proposed.

Alaa Alnemari, Mashael M. Alsulami · 0 citations

We use cookies to run the site and, with your consent, for analytics and to show ads. See our Cookie Policy.