基于LSM的安全审计机制研究与实现  

Research and realization of secure audit mechanism based on LSM

作　　者：曲坤[1] 周莲英[1] 

机构地区：[1]江苏大学计算机科学与通信工程学院,江苏镇江212013

出　　处：《计算机工程与设计》2009年第12期2882-2885,2918,共5页Computer Engineering and Design

基　　金：国家863高技术研究发展计划基金项目(2003AA414031);江苏省教育厅自然科学资金立项基金项目(03KJD520068)

摘　　要：提出了基于Linux安全模块(LSM)的安全审计机制。分析了进程任务结构并将安全域指向特定的数据结构,对LSM进行了审计功能的扩展。添加了审计钩子和审计钩子函数,以收集更加全面的审计信息;提供了加载函数和卸载函数,以实现安全审计模块的动态增删;增加了安全预警模块和日志管理模块,提高了审计机制的实时性和审计日志信息的安全性。测试结果表明,所实现的审计机制具有良好的安全性和运行性能,同时对内核影响较小,能自适应内核的升级。The secure audit mechanism based on Linux security modules （LSM） is presented. Security domain of process task structure is pointed to the specified data structure, which enhanced LSM in audit. Besides, audit hooks and hook functions are added to capture comprehensive audit information. Furthermore, register functions and unregister functions are provided to implement dynamic addition and deletion of security audit modules. Lastly, secure alarm module and log management module are presented to improve real-time of audit mechanism and security of audit logs. The tested results indicate that the mechanism has better security and running performance, less influence on the kernel, and adaptive kernel＇s upgrade.

关 键 词：安全审计机制 LSM LINUX 模块化 内核 

分 类 号：TP316[自动化与计算机技术—计算机软件与理论]