通过扩展LSM框架构建审计支持机制

LSM是纳入到Linux内核的一个安全模型支持框架，它通过提供钩子机制来支持安全机制的实现。审计机制是安全操作系统的重要组成部分。然而，LSM的现有设计主要考虑的是对访问控制的支持，对审计机制的支持存在着明显的不足。把审计支持纳入到LSM框架中，为审计系统或者是入侵检测系统提供统一的支持接口，对安全操作系统的研究有重要意义。本文提出一个扩展LSM框架的方法，以增强LSM框架对审计机制的支持能力。本文论述了扩展LSM框架实现审计的方法，以及如何在LSM框架中加入审计钩子及在内核函数中插入钩子函数。依照这种方法，作为安全操作系统SECIMOS开发工作的一个重要组成部分，我们在Linux内核中实现了一个审计系统，并对其性能进行了分析。

Enhancing the LSM Framework to Build Audit Support Mechanisms

LSM (Linux Security Module) is a security-model-support framework which is now an important part of the Linux kernel. It supports security mechanisms by providing hooks mechanism. Audit is an essential part of secure operating system. Mainly focusing on access control, LSM is lack of ability to support audit. It is significant to extend the LSM framework to support audit mechanism which can provide an interface to audit system or intrusion detection system. This paper presents a method to enhance the LSM framework to support audit functions. It discusses how to add audit hooks into the LSM framework and how to insert hook functions into Linux kernel functions. In this way, an audit system is implemented as a main part of the SECIMOS secure operating system. Also, its performance is test- ed and analyzed.