论文部分内容阅读
审计系统作为安全操作系统的重要组成部分,在系统监测中起着重要作用,它确保安全策略的正确实现和入侵检测系统的建立。原始的基于应用的Linux审计体系存在固有的缺点,应该对此进行改善。该篇介绍了在Linux内核中安全审计系统的设计与实现。在Linux内核中实现了基于可加载内核模块的安全审计模型并运用了一种新的基于复制中断描述表的系统调用拦截的方法。此外,该系统能在内核中全面采集信息,并且采取了有效的方法保护审计系统自身的安全。
As an important part of the security operating system, auditing system plays an important role in system monitoring. It ensures the correct implementation of security policy and the establishment of intrusion detection system. The original application-based Linux audit system has inherent shortcomings that should be improved. This article introduces the design and implementation of the security audit system in the Linux kernel. In the Linux kernel, a security auditing model based on loadable kernel module is implemented and a new method of system call interception based on replication interrupt description table is implemented. In addition, the system fully gathers information in the kernel and takes effective measures to protect the auditing system itself.