Safety auditing method and device for full-quantity codes of operating system

Abstract

The invention discloses a safety auditing method and device for full-amount codes of an operating system. The method comprises the steps of obtaining a scanning instruction of a test platform and analyzing the scanning instruction to obtain information of the operating system to be audited; obtaining a corresponding packet list from a version construction platform; initializing and monitoring a shared memory area in real time; loading a preset scanning rule or accessing a scanning engine; a plurality of threads are started to traverse the package list in parallel, each thread obtains a corresponding source code file from the code platform according to software package information of the package list and then selects a corresponding scanning rule or a scanning engine to scan the source code file according to the file type to obtain an audit result, and the audit result is stored in a shared memory area; dynamically and persistently storing the data in the shared memory area; and summarizing all audit results, generating a corresponding test report, and sending the test report to a test platform. The method can effectively solve the problems that the efficiency is low, the false alarm rate is high and linkage with an existing test platform cannot be achieved when full codes of an operating system are scanned.

Description

Technical Field

[0001] The present invention relates to code auditing technology, and in particular to a method and device for security auditing the entire code of an operating system. Background Art

[0002] Code security audit mainly discovers vulnerabilities or security risks in the software from the perspective of source code audit, such as injection attack vulnerabilities, cross-site scripting attack vulnerabilities, dangerous functions, unsafe encryption algorithms, etc. Each risk has certain code characteristics. Judging whether there is a security risk in the code based on the code characteristics is the current mainstream practice. The specific implementation method is to use code security audit tools to scan the code.

[0003] The operating system code is divided into kernel layer code and application layer code. The main functions of the kernel layer code are process management, storage management, file management, and device management. The development language is mainly C / C++. Buffer overflow, repeated memory release, process deadlock and other issues are the main security risks of the kernel layer code. Above the kernel is the application layer software. Its main function is to realize the user business needs in a specific application field. The development language is very wide, such as java, php, python, etc. Many high-level language compilers have realized automatic memory management. Risks such as buffer overflow and repeated memory release are no longer the main security risks. The main security risks of the application layer code are privacy leakage risks such as insecure encryption algorithms, insecure communication protocols, and plain text storage of passwords. Therefore, if the audit rules can be customized according to the different main risks of the kernel layer code and the application layer code in the audit activities, it will help reduce the false positive rate of code audits.

[0004] In addition, according to statistics, the number of lines of code in the Linux kernel layer is close to 30 million. Together with the application layer code, the code volume of the entire operating system far exceeds that of general business systems. When using mainstream audit tools to scan the entire code of the operating system with a data volume of tens of millions, there are four prominent problems:

[0005] 1. Low scanning efficiency and long time consumption. Some audit tools take more than 24 hours to perform a full scan of the operating system code;

[0006] 2. Some tools are not capable of scanning tens of millions of lines of code. During the scanning process, problems such as system memory exhaustion and high CPU usage may occur, which ultimately causes the scanning tool to fail to operate normally.

[0007] 3. Inaccurate detection results and high false positive rate. The operating system contains various types of source code files, including low-level C / C++ languages ​​and high-level applications such as python, java, php, etc. If the same scanning rules are applied to all files, a large number of false positives will occur.

[0008] 4. The code audit tool is an independent product and cannot be linked with the existing testing platform or access control system during the product development process. Summary of the invention

[0009] The technical problem to be solved by the present invention is as follows: In view of the above-mentioned problems in the prior art, a security audit method and device for the full code of an operating system are provided, which can effectively solve the problems of low efficiency, high false alarm rate and inability to link with the existing test platform when scanning the full code of the operating system.

[0010] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0011] A security audit method for the entire code of an operating system includes the following steps:

[0012] Obtain the scanning instructions of the test platform and parse them to obtain the information of the operating system to be audited;

[0013] Obtain the package list corresponding to the information of the operating system to be audited from the version building platform;

[0014] Initialize and monitor the shared memory area in real time;

[0015] Load preset scanning rules or access the scanning engine;

[0016] Start multiple threads to traverse the package list in parallel. Each thread obtains the corresponding source code file from the code platform according to the software package information in the package list, and then selects the corresponding scanning rule or scanning engine according to the file type of the source code file to scan the source code file to obtain the audit result corresponding to each source code file, and finally stores the audit result in the shared memory area;

[0017] Dynamically and persistently store data in the shared memory area;

[0018] Summarize all audit results and generate corresponding test reports, and send the test reports to the test platform.

[0019] Furthermore, when multiple threads are started to traverse the package list in parallel, the following steps are specifically included:

[0020] Start a specified number of threads according to the preset configuration file;

[0021] If the package list is not empty, each idle thread selects an untraversed software package from the package list. If the package list is empty, the idle thread is terminated.

[0022] Furthermore, when the data in the shared memory area is dynamically and persistently stored, it specifically includes:

[0023] Determine whether the data in the shared memory area reaches the time threshold or the space threshold. If so, store the data in the shared memory area persistently and clear the shared memory area. Otherwise, wait for the data in the shared memory area to reach the time threshold or the space threshold. During the waiting process, if all threads end, store the data in the shared memory area persistently.

[0024] Furthermore, when judging whether the data in the shared memory area reaches the time threshold or the space threshold, it includes:

[0025] Check the data volume in the shared memory area. If the data volume is greater than the specified value, the data in the shared memory area reaches the space threshold.

[0026] If the time difference between the time when the data volume of the shared memory area is checked this time and the time when the data of the shared memory area is last persistently stored exceeds the specified time, the data of the shared memory area reaches the time threshold.

[0027] Furthermore, each thread obtains the corresponding source code file from the code platform according to the software package information in the package list, specifically including:

[0028] Obtain the corresponding source code package from the code platform according to the package name and version number in the software package information;

[0029] The source code package is decompressed to obtain the source code file, and a corresponding rpmbuild directory structure is created. The SPEC file is found in the SRPMS subdirectory, and the corresponding Patch file is merged into the source code file according to the SPEC file information to generate the latest source code file.

[0030] Furthermore, when selecting a corresponding scanning rule or scanning engine according to the file type of the source code file to scan the source code file to obtain the audit result corresponding to each source code file, specifically selecting a corresponding scanning rule or scanning engine according to the suffix of the source code file to scan the source code file.

[0031] Furthermore, the scanning rules include custom C / C++ scanning rules, and the custom C / C++ scanning rules specifically include:

[0032] Matches the character sequence of letters, numbers, or underscores preceding sprintf;

[0033] Matches the blank character and left bracket before the sprintf function, as well as the newline character;

[0034] Matches any parameter in the sprintf function;

[0035] Matches the blank characters, right brackets, and newline characters after the parameters in the sprintf function;

[0036] Matches lines starting with sprintf;

[0037] If there are one or more matching results, a rule description is generated to remind you to avoid using sprintf.

[0038] Furthermore, the scanning rules include custom python scanning rules, and the custom python scanning rules specifically include:

[0039] Matches a URL starting with http, https, ftp or file;

[0040] Matches a sequence of characters in a URL;

[0041] Matches the last character of the URL;

[0042] If there are one or more matching results, a rule description is generated to remind you not to hardcode the URL address in the source code.

[0043] The present invention also provides a security audit device for the full code of an operating system, wherein the security audit device is connected to a test platform, a version building platform, and a code platform respectively, and the security audit device comprises:

[0044] The instruction parsing unit is used to obtain and parse the scanning instructions of the test platform to obtain the information of the operating system to be audited;

[0045] A package list acquisition unit, used to acquire a package list corresponding to the information of the operating system to be audited from the version building platform;

[0046] The memory management unit is used to initialize and monitor the shared memory area in real time, and dynamically and persistently store the data in the shared memory area;

[0047] The code scanning unit is used to load the preset scanning rules or scanning engine, start multiple threads to traverse the package list in parallel, each thread obtains the corresponding source code file from the code platform according to the software package information in the package list, and then selects the corresponding scanning rule or scanning engine according to the file type of the source code file to scan the source code file to obtain the audit result corresponding to each source code file, and finally stores the audit result in the shared memory area;

[0048] The report generation unit is used to summarize all audit results and generate corresponding test reports, and send the test reports to the test platform.

[0049] The present invention also proposes a security audit system for the full code of an operating system, comprising a microprocessor and a computer-readable storage medium connected to each other, wherein the microprocessor is programmed or configured to execute any one of the security audit methods for the full code of an operating system.

[0050] Compared with the prior art, the advantages of the present invention are:

[0051] The present invention links the version building platform with the test platform to realize the automatic processing of the scanning process. After receiving the instruction of the test platform to start scanning, the operating system package list information is obtained from the version building platform, and the source code file is automatically obtained from the code platform. The source code file is automatically classified and matched with different scanning rules to realize accurate scanning of source codes in different coding languages. In the process of auditing source code, parallel scanning and dynamic processing memory are adopted to realize the rapid processing of tens of millions of lines of code and reduce the consumption of memory resources by scanning activities. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 The figure is a flow chart of a method according to an embodiment of the present invention.

[0053] Figure 2 Schematic diagram of a packet list according to an embodiment of the present invention.

[0054] Figure 3 A device block diagram of an embodiment of the present invention. DETAILED DESCRIPTION

[0055] The present invention is further described below in conjunction with the accompanying drawings and specific preferred embodiments, but the protection scope of the present invention is not limited thereby.

[0056] Before introducing the specific embodiments of the present invention, related concepts or terms are first explained.

[0057] Test platform: also called test bench, is a virtual environment used to verify the correctness and reliability of software design;

[0058] Version building platform: a platform for automatically building operating system images;

[0059] Code platform: a platform for storing source code;

[0060] Patch: A patch used to repair or improve software.

[0061] SPEC: The SPEC file contains all the instructions and metadata needed to build the RPM package, including information about source code and patch files.

[0062] Embodiment 1

[0063] This embodiment proposes a security audit method for the entire code of an operating system, which is applied to a system including a test platform, a version building platform, and a code platform, such as Figure 1 As shown, the following steps are included:

[0064] S01) Obtaining and parsing the scanning instructions of the test platform to obtain the information of the operating system to be audited;

[0065] S02) according to the information of the operating system to be audited, obtaining a package list corresponding to the operating system to be audited from the version building platform;

[0066] S03) Initialize and monitor the shared memory area in real time;

[0067] S04) loading preset scanning rules or accessing a scanning engine;

[0068] S05) starting multiple threads to traverse the package list in parallel, each thread obtains the corresponding source code file from the code platform according to the software package information in the package list, and then selects the corresponding scanning rule or scanning engine according to the file type of the source code file to scan the source code file to obtain the audit result corresponding to each source code file, and finally stores the audit result in the shared memory area;

[0069] S06) dynamically and persistently storing the data in the shared memory area;

[0070] S07) Summarize all audit results and generate corresponding test reports, and send the test reports to the test platform.

[0071] Through the above steps, this embodiment links the version building platform and the test platform to realize the automatic processing of the scanning process without manual intervention. At the same time, through code classification, custom scanning rules, parallel scanning, and dynamic memory processing, efficient and accurate security audit of the entire operating system code is realized.

[0072] The following uses the code security audit activity of Kylin Server Operating System SP1 as an example to explain each step in detail.

[0073] In step S01 of this embodiment, the scanning instruction includes information such as the type, architecture, and version number of the operating system, and the format is as follows:

[0074] {“action”:”scan”,

[0075] "name":"Kylin-Server",

[0076] "version":"10-SP1-Release-Build20-20210518",

[0077] "arch":"x86_64"}.

[0078] Among them, "action":"scan" indicates that the type of instruction is a scan instruction, "name":"Kylin-Server" indicates that the type of operating system is the Kylin Server operating system, "version":"10-SP1-Release-Build20-20210518" indicates that the version number of the operating system is "10-SP1-Release-Build20-20210518", and "arch":"x86_64" indicates that the architecture of the operating system is 32-bit.

[0079] In step S02 of this embodiment, the package list obtained from the version building platform according to the above information in step S01 is as follows: Figure 2 As shown, it contains the name of the software package, version number, and build time.

[0080] Step S03 of this embodiment includes the following steps:

[0081] S031) Create a shared memory A1 for storing audit results, with a memory size of 10M;

[0082] S032) Establish a monitoring process to monitor the created shared memory area in real time. If the data of shared memory A1 reaches a preset time or space threshold, the data of shared memory A1 is persistently stored and shared memory A1 is cleared. When the data of shared memory A1 is persistently stored, the audit result of each source code file is stored as one file with the file name '{software package name}+{software package version}+{source code file name}'.data.

[0083] In step S04 of this embodiment, different custom scanning rules can be loaded according to the language type. In addition to loading custom scanning rules, a third-party code audit engine can also be connected as a scanning engine. In order to simplify the process, only C / C++ and python scanning rules are loaded in this embodiment.

[0084] In step S05 of this embodiment, when multiple threads are started to traverse the package list in parallel, the following steps are specifically performed:

[0085] Start a specified number of threads according to the preset configuration file;

[0086] If the package list is not empty, each idle thread selects an untraversed software package from the package list. If the package list is empty, the idle thread is terminated and the corresponding end instruction is issued to the monitoring process. If the monitoring process receives the end instruction of all threads, it will store the shared memory area data persistently and end the memory monitoring activity.

[0087] Step S05 of this embodiment starts multiple threads to scan concurrently. The execution steps of each thread are the same. The execution steps of a single thread are as follows:

[0088] First, each thread obtains the corresponding source code file from the code platform according to the software package information in the package list, including:

[0089] S051) acquiring a corresponding source code package from the code platform according to the package name and version number in the software package information, for example, for the software package information whose package name and version number are abattis-cantarell-fonts-help-0.111-2.ky10.noarch, the corresponding source code package is abattis-cantarell-fonts-help-0.111-2.ky10.noarch.src.rpm;

[0090] S052) using the rpm-ivh abattis-cantarell-fonts-help-0.111-2.ky10.noarch.src.rpm command to decompress the source code package to obtain the package information, and after executing the command, a corresponding rpmbuild directory structure will be created to obtain the source code file;

[0091] S053) Execute the command rpmbuild-bp*.spec in the SRPMS subdirectory (rpmbuild / SPECS) of the rpmbuild directory structure to find the SPEC file and merge the corresponding Patch file into the source code file according to the SPEC file information to generate the latest source code file. The latest source code file will be generated in the BUILD subdirectory (rpmbuild / BUILD / directory) of the rpmbuild directory structure.

[0092] Secondly, according to the file type of the source code file, a corresponding scanning rule or scanning engine is selected to scan the source code file to obtain the audit result corresponding to each source code file. In this embodiment, the corresponding scanning rule or scanning engine is selected according to the suffix of the source code file to scan the source code file. For example, the source code file with the suffix of c or cpp adopts the custom C / C++ scanning rule, and the source code file with the suffix of py adopts the custom python scanning rule.

[0093] In this embodiment, the code snippet of the custom C / C++ scanning rule is:

[0094]

[0095] The above code snippet means:

[0096] Matches the character sequence of letters, numbers, or underscores preceding sprintf;

[0097] Matches the blank character and left bracket before the sprintf function, as well as the newline character;

[0098] Matches any parameter in the sprintf function;

[0099] Matches the blank characters, right brackets, and newline characters after the parameters in the sprintf function;

[0100] Matches lines starting with sprintf;

[0101] If there are one or more matching results, a rule description "sprintf is a dangerous function, snprintf should be called to perform string formatting operations" is generated to prompt users to avoid using sprintf.

[0102] In this embodiment, the code snippet of the custom python scanning rule is:

[0103]

[0104] The above code snippet means:

[0105] Matches a URL starting with http, https, ftp or file;

[0106] Matches a sequence of characters in a URL;

[0107] Matches the last character of the URL;

[0108] If there are one or more matching results, a rule description "URL addresses cannot be hard-coded into source code to prevent information leakage" is generated to remind users not to hard-code URL addresses in source code.

[0109] In step S06 of this embodiment, when the data in the shared memory area is dynamically and persistently stored, it specifically includes:

[0110] Determine whether the data in the shared memory area reaches the time threshold or the space threshold. Specifically, the monitoring process checks the data volume of the shared memory area in real time. If the data volume is greater than a specified value (8M in this embodiment), the data in the shared memory area reaches the space threshold.

[0111] If the time difference between the time when the data volume of the shared memory area is checked this time and the time when the data of the shared memory area is last persistently stored exceeds the specified time (30s in this embodiment), the data of the shared memory area reaches the time threshold;

[0112] If the data in the shared memory area reaches the time threshold or the space threshold, the data in the shared memory area is persistently stored and the shared memory area is cleared. Otherwise, the process waits for the data in the shared memory area to reach the time threshold or the space threshold. During the waiting process, if all threads are terminated, that is, the end instruction of all threads is received, the data in the shared memory area is persistently stored. Specifically, the audit result of each source code file is stored as a file with the file name '{software package name}+{software package version}+{source code file name}'.data, and then the monitoring of memory activity is terminated.

[0113] Embodiment 2

[0114] This embodiment proposes a security audit method for the entire code of an operating system, which is basically the same as the first embodiment, except that in step S05 of this embodiment, when multiple threads are started to traverse the package list in parallel, the number of threads is dynamically adjusted to improve resource utilization and system performance, which specifically includes:

[0115] Determine the number of available threads in real time based on the system's available resources and start the corresponding number of threads;

[0116] If the package list is not empty, each idle thread selects an untraversed software package from the package list. If the package list is empty, the idle thread is terminated and the corresponding end instruction is issued to the monitoring process. If the monitoring process receives the end instruction of all threads, it will store the shared memory area data persistently and end the memory monitoring activity.

[0117] In this embodiment, when determining the number of available threads in real time based on the available resources of the system, the key performance indicators such as CPU, memory, IO, etc. are monitored, a comprehensive indicator is calculated based on the key performance indicators, and the number of available threads is determined according to the interval to which the comprehensive indicator belongs. The comprehensive indicator can be obtained by weighting the key performance indicators through subjective weighting method, objective weighting method or subjective and objective combined weighting method, and then calculating the weighted sum of the key performance indicators.

[0118] In this embodiment, when starting a corresponding number of threads, the number of started threads is compared with the number of available threads. If the number of started threads is less than the number of available threads, a corresponding number of new threads are started according to the difference between the two. If the number of started threads is less than the number of available threads, a corresponding number of idle threads are terminated according to the difference between the two.

[0119] In order to avoid system overhead and performance degradation caused by frequent thread switching, in this embodiment, when starting a corresponding number of new threads according to the difference between the two, and ending a corresponding number of idle threads according to the difference between the two, the ratio of the difference between the two to the number of available threads can be calculated. If the ratio is less than the preset ratio value, it is considered that there is no need to change the number of threads immediately, and the new number of available threads is waited and obtained for comparison with the number of started threads. If the ratio is greater than the preset ratio value, a gradual fine-tuning method is adopted, for example, each time according to the specified ratio of the difference between the two, the number of started threads is updated after starting or ending the corresponding number of threads, and then the new number of available threads is waited and obtained for comparison with the updated number of started threads.

[0120] In addition, in order to avoid unnecessary thread creation and destruction, in this embodiment, when terminating an idle thread, it is determined whether the survival time of the idle thread is greater than the specified survival time. If so, the idle process is terminated, otherwise wait and search for an idle process whose survival time meets the requirements.

[0121] Embodiment 3

[0122] This embodiment provides a security audit device for the full code of an operating system, wherein the security audit device is connected to a test platform, a version building platform, and a code platform, respectively. Figure 3 As shown, the security audit device of this embodiment includes:

[0123] The instruction parsing unit is used to obtain and parse the scanning instructions of the test platform to obtain the information of the operating system to be audited;

[0124] A package list acquisition unit, used to acquire a package list corresponding to the operating system to be audited from the version building platform according to the information of the operating system to be audited;

[0125] The memory management unit is used to initialize and monitor the shared memory area in real time, and dynamically and persistently store the data in the shared memory area;

[0126] The code scanning unit is used to load the preset scanning rules or scanning engine, start multiple threads to traverse the package list in parallel, each thread obtains the corresponding source code file from the code platform according to the software package information in the package list, and then selects the corresponding scanning rule or scanning engine according to the file type of the source code file to scan the source code file to obtain the audit result corresponding to each source code file, and finally stores the audit result in the shared memory area;

[0127] The report generation unit is used to summarize all audit results and generate corresponding test reports, and send the test reports to the test platform.

[0128] Embodiment 4

[0129] This embodiment proposes a security audit system for the entire code of an operating system, including a microprocessor and a computer-readable storage medium connected to each other, wherein the microprocessor is programmed or configured to execute the security audit method for the entire code of an operating system described in Embodiment 1 and / or Embodiment 2.

[0130] In summary, the present invention proposes a security audit method and device for the full code of an operating system. After receiving the instruction from the test platform to start scanning, the package list information of the operating system is obtained from the version building platform, and the source code file is automatically obtained from the code platform. The source code file is classified and matched according to the scanning rules to achieve accurate scanning of source codes of different coding languages. In the process of processing the source code, parallel scanning and dynamic processing memory are used to achieve rapid processing of tens of millions of lines of code, reduce the consumption of memory resources by scanning activities, and have the following advantages:

[0131] 1. The code audit activities are linked with the construction platform and code platform, reducing labor costs;

[0132] 2. Accurately match scanning rules according to source code file types to reduce false positive rates;

[0133] 3. The mechanism of monitoring and dynamically processing memory is adopted to reduce the occupancy rate of system memory resources by audit activities.

[0134] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A security audit method for the entire code of an operating system, characterized in that: The following steps are involved: Obtain the scanning instructions of the test platform and parse them to obtain the information of the operating system to be audited; Obtain a list of packages corresponding to the information of the operating system to be audited from the version building platform; Initialize and monitor the shared memory area in real time; Load preset scanning rules or access the scanning engine; Start multiple threads to traverse the package list in parallel. Each thread obtains the corresponding source code file from the code platform according to the software package information in the package list, and then selects the corresponding scanning rule or scanning engine according to the file type of the source code file to scan the source code file to obtain the audit result corresponding to each source code file, and finally stores the audit result in the shared memory area; Dynamically and persistently store data in the shared memory area; Summarize all audit results and generate corresponding test reports, and send the test reports to the test platform.

2. The security audit method for the full code of an operating system according to claim 1 is characterized in that: When starting multiple threads to traverse the package list in parallel, it includes: Start a specified number of threads according to the preset configuration file; If the package list is not empty, each idle thread selects an untraversed software package from the package list. If the package list is empty, the idle thread is terminated.

3. The security audit method for the full code of an operating system according to claim 2 is characterized in that: When the data in the shared memory area is dynamically and persistently stored, it specifically includes: Determine whether the data in the shared memory area reaches the time threshold or the space threshold. If so, store the data in the shared memory area persistently and clear the shared memory area. Otherwise, wait for the data in the shared memory area to reach the time threshold or the space threshold. During the waiting process, if all threads end, store the data in the shared memory area persistently.

4. The security audit method for the full code of an operating system according to claim 3 is characterized in that: When judging whether the data in the shared memory area reaches the time threshold or space threshold, it includes: Check the data volume in the shared memory area. If the data volume is greater than the specified value, the data in the shared memory area reaches the space threshold. If the time difference between the time when the data volume of the shared memory area is checked this time and the time when the data of the shared memory area is last persistently stored exceeds the specified time, the data of the shared memory area reaches the time threshold.

5. The security audit method for the full code of an operating system according to claim 1 is characterized in that: Each thread obtains the corresponding source code file from the code platform according to the software package information in the package list, specifically including: Obtain the corresponding source code package from the code platform according to the package name and version number in the software package information; The source code package is decompressed to obtain the source code file, and a corresponding rpmbuild directory structure is created. The SPEC file is found in the SRPMS subdirectory, and the corresponding Patch file is merged into the source code file according to the SPEC file information to generate the latest source code file.

6. The security audit method for the full code of an operating system according to claim 1, characterized in that: When selecting a corresponding scanning rule or scanning engine according to the file type of the source code file to scan the source code file to obtain the audit result corresponding to each source code file, specifically selecting a corresponding scanning rule or scanning engine according to the suffix of the source code file to scan the source code file.

7. The security audit method for the full code of an operating system according to claim 1, characterized in that: The scanning rules include custom C / C++ scanning rules, and the custom C / C++ scanning rules specifically include: Matches the character sequence of letters, numbers, or underscores preceding sprintf; Matches the blank character and left bracket before the sprintf function, as well as the newline character; Matches any parameter in the sprintf function; Matches the blank characters, right brackets, and newline characters after the parameters in the sprintf function; Matches lines starting with sprintf; If there are one or more matching results, a rule description is generated to remind you to avoid using sprintf.

8. The security audit method for the full code of an operating system according to claim 1, characterized in that: The scanning rules include a custom python scanning rule, and the custom python scanning rule specifically includes: Matches a URL starting with http, https, ftp or file; Matches a sequence of characters in a URL; Matches the last character of the URL; If there are one or more matching results, a rule description is generated to remind you not to hardcode the URL address in the source code.

9. A security audit device for the entire code of an operating system, characterized in that: The security audit device is connected to the test platform, the version building platform and the code platform respectively, and the security audit device includes: The instruction parsing unit is used to obtain and parse the scanning instructions of the test platform to obtain the information of the operating system to be audited; A package list acquisition unit, used to acquire a package list corresponding to the information of the operating system to be audited from the version building platform; The memory management unit is used to initialize and monitor the shared memory area in real time, and dynamically and persistently store the data in the shared memory area; The code scanning unit is used to load preset scanning rules or scanning engines, start multiple threads to traverse the package list in parallel, each thread obtains the corresponding source code file from the code platform according to the software package information in the package list, and then selects the corresponding scanning rule or scanning engine according to the file type of the source code file to scan the source code file to obtain the audit result corresponding to each source code file, and finally stores the audit result in the shared memory area; The report generation unit is used to summarize all audit results and generate corresponding test reports, and send the test reports to the test platform.

10. A security audit system for the full code of an operating system, comprising a microprocessor and a computer-readable storage medium connected to each other, characterized in that: The microprocessor is programmed or configured to execute the security audit method for the entire code of the operating system as described in any one of claims 1 to 8.

Images