操作系统内核级安全审计系统的设计与实现

Design and Implementation of Kernel Level Secure Auditing System in Operating System

随着人们对操作系统的安全要求越来越高,建立安全、完备的审计子系统成为操作系统安全领域的一个重要课题。本文提出一个通过在内核安插钩子函数来实现模块化审计系统的方法,用这种方法设计并实现一个基于 Linux操作系统的、遵循国家标准 GB17859-1999第四级要求的安全审计子系统。这个审计系统以模块形式连入内核,通过往内核中安插审计钩子来收集审计信息,对内核影响较小,并能适应内核的升级;通过用内核线程代替后台进程将审计记录存入磁盘,实现了审计的完全内核化,增强了系统安全;通过对所有系统调用进行审计,实现了对利用隐蔽存储信道时可能被使用的事件的审计。

With the ever-increasing demands on operating system security,to build up secure auditing subsystems is becoming an important issue in the area of operating system security. This paper presents a method to implement a modular auditing system by inserting hooks into the Linux kernel. In this way,a secure kernel-level auditing subsys- tem,which is Linux-based and accords with the fourth level requirements of the National Standard of China,is de- signed and implemented. The auditing subsystem is used as a loadable kernel module. It can be easily upgraded with the development of the Linux kernel. It implements kernel-level audit by using kernel thread instead of user-level dae- mon. Audit events that might be used in the exploitation of covert storage channels are auditable due to the full cover- age of all system calls by the auditing subsystem.