<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html lang="en-US">
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<meta http-equiv="content-style-type" content="text/css">
<link rel="stylesheet" href="media/tomoyolinux.css" media="all" type="text/css">
<title>AKARI About Page</title>
</head>

<body>

<div id="titlebar">
<a href="index.html.en"><img src="media/akarititle.png" alt="akarititle.png" width="174" height="40" border="0" align="left" title="AKARI"></a>
</div>

<div id="navbar" class="tomoyo-about">
<ul id="navbarlist">
<li id="tomoyo-home"><a href="index.html.en" title="AKARI Home Page">Home</a></li>
<li id="tomoyo-about"><a href="about.html.en" title="About AKARI">About</a></li>
<li id="tomoyo-documentation"><a href="documentation.html.en" title="Official Documentation">Documentation</a></li>
<li id="tomoyo-support"><a href="support.html.en" title="Support information">Support</a></li>
<li id="tomoyo-links"><a href="links.html.en" title="Links">Links</a></li>
</ul>
<ul id="switch-language">
<li id="tomoyo-switch-language"><a href="about.html.ja" title="Go to Japanese page">Japanese page</a></li>
</ul>
</div>

<div id="content">

<div id="regular-content">

<h3><a name="about">About AKARI</a></h3>

<p>AKARI is a Mandatory Access Control (MAC) implementation for Linux that can be used to increase the security of a system, while also being useful purely as a system analysis tool. It is a Linux kernel module based on <a href="http://tomoyo.sourceforge.jp/">TOMOYO Linux</a>, which was launched in 2003.</p>

<p>AKARI focuses on the behaviour of a system. Every process is created to achieve a purpose, and like an immigration officer, AKARI allows each process to declare behaviours and resources needed to achieve their purpose. When protection is enabled, AKARI acts like an operation watchdog, restricting each process to only the behaviours and resources allowed by the administrator.</p>

<h3><a name="what">What can AKARI be used for?</a></h3>

<p>In a normal operating system (OS), every application is unmonitored and it is difficult to determine what is happening in a system:</p>
<p><img src="media/disabled.png" alt="disabled.png" width="500" height="350"></p>

<p>If AKARI is introduced, each application can be monitored to determine exactly what it is doing and a policy configuration can be automatically generated. Every action that an application performs is automatically appended to an Access Control List (ACL). Browsing this list can allow a precise understanding of what each application is doing:</p>
<p><img src="media/permissive.png" alt="permissive.png" width="500" height="350"></p>

<p>AKARI can therefore be used as a system analysis tool, which can aid in:</p>
<ul>
<li>debugging applications</li>
<li>understanding the behaviour of a Linux system</li>
<li>writing documentation</li>
</ul>

<p>If protection is enabled, AKARI uses Mandatory Access Control to restrict each application to do only what the administrator has allowed it to do:</p>

<p><img src="media/enforcing.png" alt="enforcing.png" width="500" height="350"></p>

<p>AKARI can therefore be used as a system restriction tool, which can aid in:</p>
<ul>
<li>restricting services such as SSH and Apache</li>
<li>restricting system administrator operations</li>
<li>creating per-application networking firewalls</li>
<li>reducing damage caused by buffer overflows and other security exploits</li>
<li>deploying a honeypot system</li>
</ul>

</div><!-- regular-content -->

</div><!-- content -->

<div id="footer">
<p class="language">Go to <a href="about.html.ja">Japanese page</a>.</p>
<p class="timestamp">Last modified: $Date: 2011-07-01 13:58:48 +0900 (Fri, 01 Jul 2011) $</p>
<p class="trademark">Linux&reg; is a registered trademark of Linus Torvalds world-wide. TOMOYO&reg; is a registered trademark of <a href="http://www.nttdata.co.jp/en/">NTT DATA Corporation</a>.</p>
<p><a href="http://sourceforge.jp/"><img src="http://sourceforge.jp/sflogo.php?group_id=5310" width="96" height="31" alt="sflogo.php" title="SourceForge.jp"></a></p>
</div>

</body>
</html>
