Linux可加载内核模块LKM机制安全性研究  

Research on security of Linux loadable kernel modules facility

作　　者：姜湘岗[1] 

机构地区：[1]北京电子科技学院计算机科学与技术系,北京100070

出　　处：《计算机工程与设计》2007年第20期4904-4907,共4页Computer Engineering and Design

摘　　要：基于访问控制策略,对Linux系统可加载内核模块LKM机制的安全缺陷进行了研究,对各种利用LKM的攻击方法进行了深入的综合分析,最后从监控所有的模块操作、基于capabilities能力机制的权限分解、基于加密模块的安全的LKM这3个方面,对LKM安全增强技术进行了探讨,并重点从机密模块加载过程、ELF格式文件操作等关键技术,对基于加密模块的安全LKM设计进行阐述。The security flaw of Linux loadable kernel modules is analyzed based on its access control strategy. Then the attack methods based on LKM are integrated analyzed. At last, the security-enhanced technologies are discussed, which include monitoring all the operations relative to modules, privileges divided using capabilities facility and security LKM based on encrypted modules. The design of security LKM based on encrypted modules is discussed, which includes key technologies such as the load of encrypted modules and operate of ELF files.

关 键 词：可加载内核模块 安全 加密 访问控制 攻击 权限 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]