A realization method of linux kernel parallel lsm framework

Abstract

The invention discloses a method for realizing a parallel LSM (Linux Security Module) framework of a Linux kernel. The method comprises the steps of 1) adding a linked list structure in a hook function pointer structure body of the LSM framework; creating a security domain field array in the LSM framework, wherein each pointer in the security domain field array corresponds to a security domain of a security module; 2) obtaining starting parameters of a plurality of security modules according to configuration and executing corresponding initialization functions; when the security module is loaded in the kernel, allocating the hook function pointer structure body to the security module, connecting a hook function in the security module with a pointer in the structure body, and linking the security module with the hook function pointer structure body of other security module through the linked list structure; and 3) running a hook function, inserted in a system call function, of the LSM framework, and executing specific hook functions corresponding to the linked security modules in sequence. According to the method, the security modules are mutually independent and equal in status.

Description

technical field [0001] The invention relates to the field of computer operating system information security, in particular to a method for realizing a Linux kernel parallel LSM framework. Background technique [0002] LSM (Linux Security Module) is a lightweight general-purpose access framework for the kernel. It enables various security access framework models to be implemented in the form of Linux loadable kernel modules. Users can choose the appropriate security module to load into the Linux kernel according to their needs, thus greatly improving the flexibility and ease of use of the Linux security access control mechanism. In the Linux2.6 version of the kernel, LSM has officially become the standard of the Linux kernel security mechanism, and is provided to users in various Linux distributions. [0003] The most important mechanism provided by LSM for the security module is to insert calls to hook functions at some key points inside the kernel-related system call func...

AI Technical Summary

Problems solved by technology

The main security module provides security domains and hook function pointers to the secondary security modules. The main disadvantage of this is that when the secondary security modules play a role in security, how to play a role, and how to deal with the returned security judgment results, all are determined by the primary security module. strategy to make decisions

Images