Executable file integrity verification method based on Linux kernel binfmt framework

Abstract

The invention relates to an executable file integrity verification method based on a Linux kernel binfmt framework. The method comprises the steps that a verification module is registered in the Linux kernel binfmt framework; the verification module is executed before the module for loading the ELF executable file, and the verification module judges whether the executable file is complete or not by detecting the content of a. Signal section of the ELF executable file; the method comprises the following steps of: adding an fs / binfmtelfination module, registering before binfmtelf, multiplexing integrity verification logic of a kernel pair drive, namely a kernel module, adding a. Signal segment to be verified for ELF format expansion, and verifying the integrity of all ELF files by using a kernel certificate chain. The whole process is completely carried out in a kernel space, a mature kernel encryption and decryption algorithm framework and a certificate-based integrity check framework are reused, the assistance of an external user space check program is not needed, the performance bottleneck of going back and forth a kernel mode and a user mode is got rid of, and the method is weakly related to other functional modules of an operating system and is convenient to transplant.

Description

Technical Field

[0001] The present invention relates to the field of file integrity verification, and in particular to an executable file integrity verification method based on a Linux kernel binfmt framework. Background Art

[0002] The existing method of verifying the integrity of executable files of the Linux operating system is usually implemented by adding hooks in the Linux kernel, which usually works in the call chain of opening files in the file system, and the verification function is usually performed in the user space. The entire verification process needs to go through user space call loading, kernel space hook pre-loading process, user space integrity check, kernel space hook post-loading process, and user space program execution. Since the switching cost of the operating system between kernel state and user state is high, it adds at least two round trips between kernel state and user state relative to the ordinary opening operation, which makes the verification efficiency bottleneck.

[0003] Since the Linux kernel already has a complete integrity verification function and framework based on certificate signatures, and it has been used to verify the integrity of drivers, i.e. kernel modules, and has been verified in large-scale applications of several Linux operating systems over the years, adding hooks in the kernel and performing verification in user space actually bypasses the entire certificate chain system of the kernel, making the trust source non-unique, and due to the vulnerability of user space processes, the integrity verification of executable files may be destroyed by high-privilege attacks. Summary of the invention

[0004] The present invention aims at the technical problems existing in the prior art and provides an executable file integrity verification method based on the Linux kernel binfmt framework to realize pure kernel state integrity protection of ELF executable files.

[0005] According to a first aspect of the present invention, there is provided a method for verifying the integrity of an executable file based on a Linux kernel binfmt framework, comprising: Register the verification module in the Linux kernel binfmt framework; The verification module is executed before loading the module of the ELF executable file, and the verification module determines whether the executable file is complete by detecting the content of the .signature segment of the ELF executable file.

[0006] Based on the above technical solution, the present invention can also make the following improvements.

[0007] Optionally, the process of the verification module determining whether the executable file is complete includes: The ELF header information is analyzed to determine whether the ELF executable file contains a valid .signature segment, and if not, the executable file is determined to be incomplete.

[0008] Optionally, the process of the verification module determining whether the executable file is complete includes: Generate an ELF executable file image according to the ELF executable file containing a valid .signature segment and read it into the memory, set the .signature segment of the ELF executable file image to all 0s to obtain the ELF file to be signed, and use the certificate chain in the kernel to sign the ELF file to be signed; The ELF file to be signed is verified according to the certificate chain in the kernel. When the .signature segment is not in a signature format recognizable by the kernel signature authentication module, the used signature certificate is not in the kernel certificate chain, or the signature hash value does not meet the expected certificate public key, the executable file is judged to be incomplete.

[0009] Optionally, the ELF file to be signed is signed using the signelf tool generated by modifying the Linux kernel source code script / sign-file.c; The signing process of the signelf tool includes: adding an empty file with the same expected size as .signature to the ELF executable file image to generate an ELF file to be signed by objcopy --add-section .signature=, generating a separate signature for the ELF file to be signed using the same signing method as the kernel module, and merging the separate signature into the ELF file to be signed by objcopy --add-sectionsignature=.

[0010] Optionally, when the verification module determines that the executable file is complete, it returns a skip, allowing the binfmt framework to proceed to the subsequent module that loads the ELF executable file to execute normally, otherwise it returns an error and blocks the binfmt framework.

[0011] Optionally, the creation process of the verification module includes: Write binfmt_elf_integrity.c under fs of the Linux kernel source code of the target operating system or write it separately outside the Linux kernel source code, and set the option of whether the verification module can be uninstalled.

[0012] According to a second aspect of the present invention, there is provided an executable file integrity verification system based on the Linux kernel binfmt framework, comprising: a verification module registered in the Linux kernel binfmt framework; The verification module is executed before loading the module of the ELF executable file, and the verification module determines whether the executable file is complete by detecting the content of the .signature segment of the ELF executable file.

[0013] According to a third aspect of the present invention, there is provided an electronic device comprising a memory and a processor, wherein the processor is used to implement the steps of an executable file integrity verification method based on a Linux kernel binfmt framework when executing a computer management program stored in the memory.

[0014] According to a fourth aspect of the present invention, there is provided a computer-readable storage medium on which a computer management program is stored, and when the computer management program is executed by a processor, the steps of an executable file integrity verification method based on a Linux kernel binfmt framework are implemented.

[0015] The present invention provides an executable file integrity verification method, system, electronic device and storage medium based on the Linux kernel binfmt framework. The entire verification process is carried out in the binfmt framework of the original exec call chain of the Linux kernel executing the ELF executable file, and no hook is additionally registered in the open process, so that no obvious performance impact is caused to the exec and open system calls. The verification logic is based on the existing kernel certificate chain and kernel module (driver) signature verification logic, and is completely run in the kernel space, saving multiple round trips between the kernel state and the user state. When the module is compiled as a kernel built-in, the verification logic cannot be removed by a high-authority user in the user space, thereby avoiding the problem that the verification work is easily destroyed by a high-authority attacker during the progress in the user state. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A flowchart of an embodiment of an executable file integrity verification method based on the Linux kernel binfmt framework provided by the present invention; Figure 2 A logical schematic diagram of generating a signature for the ELF executable file provided by the present invention and adding a .signature signature segment to be verified; Figure 3 A schematic diagram of the publishing logic of the certificate and the signed ELF after the ELF is issued using the certificate private key provided in the embodiment of the present invention; Figure 4 A schematic diagram of the hardware structure of a possible electronic device provided by the present invention; Figure 5 A schematic diagram of the hardware structure of a possible computer-readable storage medium provided by the present invention. DETAILED DESCRIPTION

[0017] The principles and features of the present invention are described below in conjunction with the accompanying drawings. The examples given are only used to explain the present invention and are not used to limit the scope of the present invention.

[0018] Figure 1 The flowchart of an embodiment of an executable file integrity verification method based on the Linux kernel binfmt framework provided by the present invention is as follows: Figure 1 As shown, the verification method includes: Registers the authentication module in the Linux kernel binfmt framework.

[0019] The verification module is executed before loading the module of the ELF executable file. The verification module determines whether the executable file is complete by detecting the content of the .signature segment of the ELF executable file.

[0020] ELF is the most common and widely used executable file format in Unix-like operating systems, and is also the only executable file format used in the current mainstream Linux operating system. In recent years, almost all executable files on Linux-based operating systems are either ELF executable files or script files executed by ELF executable files. ELF files contain a file header with relatively fixed fields, several sections with different definitions, and a section table. Since ELF is executed after loading several section offsets into memory, adding or removing sections to ELF will not affect the loading process, and therefore will not destroy the function of ELF itself.

[0021] Due to the variability of Unix executable files, in order to expand compatibility with various current and even future executable file formats, and even executable file formats that are not native to the native architecture, the Linux kernel uses the binfmt framework defined in several fs / binfmt_xxx files. In the binfmt framework, a registered binfmt module can return three results to an exec() target: execution, skipping, and refusal to execute. When the user requests to call exec() to open an ELF executable file, the kernel polls all binfmt_ modules in the order of registration, and because binfmt_elf returns recognition and allows execution, the subsequent loading and execution operations are handed over to the binfmt_elf built-in module of the binfmt framework for execution. The binfmt framework is highly extensible, and all the binfmt_frameworks built into the Linux kernel are pure kernel logic, with only one exception, which is binfmt_misc, which provides a hook to allow registration to user space, and is often used to allow user space to register other opening methods. The most common use is to implement qemu-user-static to open other files like opening executable files of the native architecture.

[0022] In the open source native Linux kernel, the exec() operation that is required for an ELF executable file can be simply understood as the exec() in fs / exec.c checks the corresponding file permission bit to allow execution and after open(), calls each preparation function, and then polls the kernel's registered binfmt hooks one by one until the member .load_binary function load_elf_binary() in the elf_format of the type struct linux_binfmt registered in fs / binfmt_elf.c processes and judges that it is an ELF file and can be executed by binfmt_elf, and then executes it.

[0023] The present invention provides an executable file integrity verification method based on the Linux kernel binfmt framework. The entire verification process is carried out in the binfmt framework of the original exec call chain of the Linux kernel executing the ELF executable file, and no hook is additionally registered in the open process, so that no obvious performance impact is caused to the exec and open system calls. The verification logic is based on the existing kernel certificate chain and kernel module (driver) signature verification logic, and is completely run in the kernel space, saving multiple round trips between the kernel state and the user state. When the module is compiled as a kernel built-in, the verification logic cannot be removed by a high-authority user in the user space, thereby avoiding the problem that the verification work is easily destroyed by a high-authority attacker during the progress in the user state.

[0024] Example 1 Embodiment 1 provided by the present invention is an embodiment of an executable file integrity verification method based on the Linux kernel binfmt framework provided by the present invention, combined with Figure 1 It can be seen that the embodiments of the verification method include: Registers the authentication module in the Linux kernel binfmt framework.

[0025] The verification module is executed before loading the module of the ELF executable file. The verification module determines whether the executable file is complete by detecting the content of the .signature segment of the ELF executable file.

[0026] In a specific implementation, the verification module is defined as a binfmt_elf_integrity module, and the module for loading the ELF executable file is a binfmt_elf or binfmt_misc module.

[0027] In a possible implementation manner, the process of the verification module determining whether the executable file is complete includes: Analyze the ELF header information to determine whether the ELF executable file contains a valid .signature segment. If not, the executable file is considered incomplete.

[0028] The specific processing process includes: rejecting the execution of all ELF executable files without .signature segments, returning errors, and blocking the binfmt framework from proceeding to the binfmt_elf module.

[0029] In a possible implementation manner, the process of the verification module determining whether the executable file is complete includes: Generate an ELF executable file image based on the ELF executable file containing a valid .signature segment and read it into memory, set the .signature segment of the ELF executable file image to all 0s, obtain the ELF file to be signed, and use the certificate chain in the kernel to sign the ELF file to be signed.

[0030] The ELF file to be signed is verified according to the certificate chain in the kernel. When the .signature segment is not in the signature format recognizable by the kernel signature authentication module, the signature certificate used is not in the kernel certificate chain, or the signature hash value does not match the expected certificate public key, the executable file is judged to be incomplete.

[0031] Copy the .signature segment, then empty the .signature segment, reuse the kernel check driver, i.e., the kernel module integrity function, for the image in memory. The original data segment is the ELF image with .signature empty, and the signature information is the original information of the .signature segment. Verify according to the certificate chain in the kernel if and only if the .signature segment exists, is valid, and is issued by the certificate in the kernel certificate chain.

[0032] like Figure 2 The figure shows a logical diagram of the ELF executable file provided by the present invention generating a signature and adding a .signature signature segment to be verified, combined with Figure 1 and Figure 2It can be seen that the signature certificate used by the ELF file to be signed and all its parent certificates are stored in the kernel certificate chain; the signature certificate is the same or different from the signature certificate used by the kernel module. When the signature certificate is different from the signature certificate used by the kernel module, its own or parent certificate is set as CONFIG_SYSTEM_TRUSTED_KEYS during the kernel compilation stage, and if the certificate built-in is not itself and is set as CONFIG_SYSTEM_TRUSTED_KEYS in advance during the kernel compilation stage, it must be pre-imported into the kernel secondary certificate chain by executing sudo keyctl paddasymmetric "" %:.secondary_trusted_keys<[os-elf.cert.der] after the kernel is started (where [os-elf.cert.der] is an X.509 certificate file in DER format). Otherwise, the same as the kernel module signature verification logic, the ELF signed by a certificate not in the kernel certificate chain will be considered untrustworthy and will be refused to execute.

[0033] The signature certificate used is the internationally accepted X.509 certificate that is already used for kernel module signatures. The present invention does not impose additional restrictions on the hash algorithm and key format of the certificate itself. Any X.509 certificate hash algorithm and key format accepted by the Linux kernel module signature can be used.

[0034] The binfmt_elf_integrity module must include a signature of an empty ELF with the same size and 0s after the .signature is set to all 0s using the certificate in the kernel certificate chain. The signature is generated by the kernel source tree script / sign-file.c modified sign-elf in the same way as the kernel signs the driver, i.e. the kernel module. The logic of this sign-elf tool is: first add an empty file with the same expected size of .signature to the ELF to generate the ELF to be signed through objcopy --add-section .signature=, then use the same signing method as the kernel module to generate a separate signature for this ELF to be signed, and finally merge the separate signature into the ELF to be signed again using objcopy --add-section signature=. When verifying, read the entire ELF into memory, copy the .signature section in it in memory, and then set the .signature section in the ELF in memory to all 0s, which is the ELF to be verified, and then use the same logic, signature format requirements and certificate chain as the kernel module signature verification to calculate the hash of this ELF and compare it with the kernel certificate chain.

[0035] In a possible implementation manner, the signelf tool generated by modifying the Linux kernel source code script / sign-file.c is used to sign the ELF file to be signed.

[0036] The signing process of the signelf tool includes: adding an empty file with the same expected size as .signature to the ELF executable file image through objcopy --add-section .signature= to generate the ELF file to be signed, generating a separate signature for the ELF file to be signed using the same signing method as the kernel module, and merging the separate signature into the ELF file to be signed using objcopy --add-sectionsignature=.

[0037] In the specific implementation, the pre-generated, non-embedded ELF separate signature is required to adopt the same signature generation format as the Linux kernel module, that is, CMS or PKCS7 format. However, since the final ELF signature needs to be embedded as the .signature segment, and the kernel module signature is appended at the end, when it completes the signing of ELF, it does not use the same tool script / sign-file.c used to generate the kernel module signature, but needs to use the signelf.c based on this modification, which is generated and embedded by its logic.

[0038] The signelf tool can support X.509 private key + certificate single PEM file or DER file with the same format and specifications as the kernel module signing certificate as input, or it can support separate X.509 private key PEM file or DER file and X.509 certificate PEM file or DER file as input. In all combinations, the private key is required to correspond to the public key contained in the certificate.

[0039] The signelf tool is used to generate signatures for ELF files without a .signature segment. It cannot be used to regenerate and replace signatures for ELF files that already have a .signature segment. That is, it can only be used for the initial signature release and cannot be used to re-release binary files that are considered final products.

[0040] In a possible implementation manner, when the verification module determines that the executable file is complete, it returns a skip, allowing the binfmt framework to proceed to the subsequent module that loads the ELF executable file to execute normally, otherwise it returns an error and blocks the binfmt framework.

[0041] In the specific implementation, the binfmt_elf_integrity module operates before binfmt_elf and binfmt_misc in the binfmt framework. Only when it detects that the ELF integrity is good, it will return the skip prompt -ENOEXEC, allowing the binfmt framework to continue to execute to the binfmt_elf module (execute the native architecture ELF file) or the binfmt_misc module (execute the non-native architecture ELF file through the binfmt hook of qemu). Otherwise, it will return the error result -EBADMSG, etc., not allowing the binfmt framework to continue to execute, blocking the exec operation; for non-ELF files, it will also return the skip prompt -ENOEXEC, allowing the binfmt framework to continue to execute to the binfmt_script module (execute text files with #! headers, such as Shell scripts, Python scripts, etc.), etc.

[0042] When the loaded ELF does not contain the .signature segment, -EBADMSG is returned, the binfmt framework is not allowed to continue executing, and the exec operation is blocked; when the .signature segment in the loaded ELF is not in the signature format recognizable by the kernel signature authentication module, -EBADMSG is returned, the binfmt framework is not allowed to continue executing, and the exec operation is blocked; when the signature certificate used by the .signature in the loaded ELF is not in the kernel certificate chain, -EBADMSG is returned, the binfmt framework is not allowed to continue executing, and the exec operation is blocked; when the signature hash value of the .signature in the loaded ELF does not match the expected certificate public key, -EBADMSG is returned, the binfmt framework is not allowed to continue executing, and the exec operation is blocked.

[0043] In a possible implementation manner, the process of creating a verification module includes: Write binfmt_elf_integrity.c under the fs of the Linux kernel source code of the target operating system or write it separately outside the Linux kernel source code, and set the option to check whether the module can be uninstalled.

[0044] In the specific implementation, the binfmt_elf_integrity module is directly implemented by writing binfmt_elf_integrity.c under the fs of the Linux kernel source code of the target operating system, and fs / Kconfig.binfmt and fs / Makefile are modified to add corresponding build options to the kernel. When the build option is set to = y, the module will be built into the kernel and cannot be uninstalled, and the integrity of all ELF executable files will be checked; when the build option is set to = m, the module can be dynamically loaded, and the integrity of all ELF executable files will be checked only after it is loaded.

[0045] When the binfmt_elf_integrity module is implemented as binfmt_elf_integrity.c outside the Linux kernel source code of the target operating system, it is compiled as a module separately or with DKMS and can be loaded on demand. Only when it is loaded will the integrity of all ELF executable files be checked. The module can be loaded dynamically, and only when it is loaded will the integrity of all ELF executable files be checked.

[0046] like Figure 3 The figure shows a schematic diagram of the logic of issuing the certificate and the signed ELF after the certificate private key is used to issue the ELF according to the embodiment of the present invention, combined with Figure 3 It can be seen that the interaction and publishing logic of certificates, private keys, ELF to be signed, and signed ELF is as follows: the system or application developer holds the certificate and private key, uses signelf to sign the ELF to be signed, and generates a signed ELF; the developer publishes the certificate and signed ELF; the user can only use the developer's certificate to verify the signed ELF and perform operations, but cannot use the same certificate to modify the signature by himself.

[0047] The beneficial effects of the present invention are that the entire verification process is carried out in the binfmt framework of the original exec call chain of the Linux kernel executing the ELF executable file, no hook is additionally registered in the open process, and no obvious performance impact is caused on the exec and open system calls; the verification logic is based on the existing kernel certificate chain and kernel module (driver) signature verification logic, and is completely run in the kernel space, saving multiple round trips between the kernel state and the user state; when the module is compiled as a kernel built-in, the verification logic cannot be removed by a high-authority user in the user space, avoiding the problem that the verification work is easily destroyed by a high-authority attacker during the progress of the user state.

[0048] The embodiment of the present invention proposes an executable file integrity verification method based on the Linux kernel binfmt framework. The entire verification process is carried out in the binfmt framework of the original exec call chain of the Linux kernel executing the ELF executable file. No hook is additionally registered in the open process, and no obvious performance impact is caused on the exec and open system calls. The verification logic is based on the existing kernel certificate chain and kernel module (driver) signature verification logic, and is completely run in the kernel space, saving multiple round trips between the kernel state and the user state. When the module is compiled as a kernel built-in, the verification logic cannot be removed by a high-authority user in the user space, avoiding the problem that the verification work is easily destroyed by a high-authority attacker during the progress in the user state.

[0049] Example 2 Embodiment 2 provided by the present invention is an embodiment of an executable file integrity verification system based on the Linux kernel binfmt framework provided by the present invention. The embodiment of the verification system includes: a verification module registered in the Linux kernel binfmt framework.

[0050] The verification module is executed before loading the module of the ELF executable file. The verification module determines whether the executable file is complete by detecting the content of the .signature segment of the ELF executable file.

[0051] It can be understood that the executable file integrity verification system based on the Linux kernel binfmt framework provided by the present invention corresponds to the executable file integrity verification method based on the Linux kernel binfmt framework provided by the aforementioned embodiments, and the relevant technical features of the executable file integrity verification system based on the Linux kernel binfmt framework can refer to the relevant technical features of the executable file integrity verification method based on the Linux kernel binfmt framework, which will not be repeated here.

[0052] See also Figure 4 , Figure 4 Schematic diagram of an electronic device provided by an embodiment of the present invention. Figure 4 As shown, an embodiment of the present invention provides an electronic device, including a memory 1310, a processor 1320, and a computer program 1311 stored in the memory 1310 and executable on the processor 1320. When the processor 1320 executes the computer program 1311, the following steps are implemented: registering a verification module in the Linux kernel binfmt framework; the verification module is executed before the module of the ELF executable file is loaded, and the verification module determines whether the executable file is complete by detecting the content of the .signature segment of the ELF executable file.

[0053] See also Figure 5 , Figure 5 Schematic diagram of an embodiment of a computer-readable storage medium provided by the present invention. Figure 5 As shown, this embodiment provides a computer-readable storage medium 1400, on which a computer program 1411 is stored. When the computer program 1411 is executed by a processor, the following steps are implemented: registering a verification module in the Linux kernel binfmt framework; the verification module is executed before loading the module of the ELF executable file, and the verification module determines whether the executable file is complete by detecting the content of the .signature segment of the ELF executable file.

[0054] In order to overcome the existing Linux ELF executable file integrity protection technology, it is necessary to add hooks to the kernel key call chain, and it is necessary to go back and forth between the kernel state and the user state for many times, the performance bottleneck problem, and overcome the problem that the integrity of the user state verification program itself is difficult to ensure and difficult to deal with the destruction of high-authority attackers, and overcome the problem that the kernel state and the user state certificate chain trust sources are different, the present invention provides a kind of executable file integrity verification method based on the Linux kernel binfmt framework, by adding fs / binfmt_elf_integrity module, registering before binfmt_elf, reusing the kernel to drive the integrity verification logic of the kernel module, adding .signature to be verified segment for ELF format extension, and verifying the integrity of all ELF files using the kernel certificate chain. The whole process is completely carried out in the kernel space, reusing the mature kernel encryption and decryption algorithm framework and the integrity verification framework based on the certificate, without the assistance of the external user space verification program, getting rid of the performance bottleneck of going back and forth between the kernel state and the user state, and weakly related to other functional modules of the operating system, easy to transplant.

[0055] An embodiment of the present invention provides an executable file integrity verification method, system, electronic device and storage medium based on the Linux kernel binfmt framework, It should be noted that in the above embodiments, the description of each embodiment has its own emphasis, and for parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0056] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0057] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded computer, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0058] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0059] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0060] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0061] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for verifying the integrity of executable files based on the Linux kernel binfmt framework, characterized in that: The method comprises: Register the verification module in the Linux kernel binfmt framework; The verification module is executed before loading the module of the ELF executable file, and the verification module determines whether the executable file is complete by detecting the content of the .signature segment of the ELF executable file.

2. The method according to claim 1, characterized in that The process of the verification module determining whether the executable file is complete includes: The ELF header information is analyzed to determine whether the ELF executable file contains a valid .signature segment, and if not, the executable file is determined to be incomplete.

3. The method according to claim 1, characterized in that The process of the verification module determining whether the executable file is complete includes: Generate an ELF executable file image according to the ELF executable file containing a valid .signature segment and read it into the memory, set the .signature segment of the ELF executable file image to all 0s to obtain the ELF file to be signed, and use the certificate chain in the kernel to sign the ELF file to be signed; The ELF file to be signed is verified according to the certificate chain in the kernel. When the .signature segment is not in a signature format recognizable by the kernel signature authentication module, the used signature certificate is not in the kernel certificate chain, or the signature hash value does not meet the expected certificate public key, the executable file is judged to be incomplete.

4. The method according to claim 3, characterized in that: Use the signelf tool generated by modifying the Linux kernel source code script / sign-file.c to sign the ELF file to be signed; The signing process of the signelf tool includes: adding an empty file with the same expected size as .signature to the ELF executable file image to generate an ELF file to be signed by objcopy --add-section .signature=, generating a separate signature for the ELF file to be signed using the same signing method as the kernel module, and merging the separate signature into the ELF file to be signed by objcopy --add-sectionsignature=.

5. The method according to claim 2 or 3, characterized in that: When the verification module determines that the executable file is complete, it returns to skip, allowing the binfmt framework to proceed to the subsequent module loading the ELF executable file to execute normally, otherwise it returns an error and blocks the binfmt framework.

6. The method according to claim 1, characterized in that The creation process of the verification module includes: Write binfmt_elf_integrity.c under fs of the Linux kernel source code of the target operating system or write it separately outside the Linux kernel source code, and set the option of whether the verification module can be uninstalled.

7. An executable file integrity verification system based on the Linux kernel binfmt framework, characterized in that: The system comprises: a verification module registered in a Linux kernel binfmt framework; The verification module is executed before loading the module of the ELF executable file, and the verification module determines whether the executable file is complete by detecting the content of the .signature segment of the ELF executable file.

8. An electronic device, characterized in that: It comprises a memory and a processor, wherein the processor is used to implement the steps of the executable file integrity verification method based on the Linux kernel binfmt framework as described in any one of claims 1 to 6 when executing a computer management program stored in the memory.

9. A computer-readable storage medium, characterized in that: A computer management program is stored thereon, and when the computer management program is executed by a processor, the steps of the executable file integrity verification method based on the Linux kernel binfmt framework as described in any one of claims 1 to 6 are implemented.

Images