防止恶意LKM修改Linux系统调用的方法研究

Research of Protecting Linux System Calls from Being Modified by Vicious LKM

目前存在大量的恶意LKM(Loaded Kernel Module),其中大部分都是修改Linux系统调用的.而系统调用一旦被修改,Linux系统就无法正常工作.针对这种情况,文中提出了一种在LKM加载时对系统调用表进行检测的方法,并对其进行了研究与实现,采用这种方法能够防止恶意LKM修改系统调用,使Linux系统更安全.

At the moment there are a lot of vicious LKMs, most of them modify Linux system calls. If system calls are modified, Linux system will not work well. In order to solve this problem, this paper brought forward a new method that detects system call table when LKM is being loaded, and discussed the realization of it.