Problems and Countermeasures of Linux operating system calls

Linux Process monitoring methods and tools are implemented based on the corresponding API functions or system calls provided to us by calling the operating system. All we get is the result of interface function processing. We cannot actively obtain the information we need from the process data structure of the operating system kernel.

Therefore, they have the following problems:

1. Traditional process monitoring methods have low operation efficiency, long response time, and poor real-time performance.

2. It is impossible to report the security status of the current system to the user in real time and efficiently. Even if any illegal process in the system is running, the system cannot identify it.

3. users cannot be provided with evidence to capture behaviors of illegal processes and the activity track of the processes. When an illegal process runs and damages the system, the user finds an illegal process by checking the process list, it is also unclear what damage the process has caused to the system for a period of time from the process to the capture of such an illegal process. For example, access and modify important system files and occupy system resources. These problems have brought a lot of problems to future recovery and processing.

4. The execution of the program is in the user State and is not secure. hackers who intrude into the system can easily find the disk images of these process monitoring programs and delete or replace them, this will cause immeasurable losses to the system. This is particularly important. For example, if hackers successfully intrude into the system, they can implant the ps program they have rewritten to replace the ps program of the original system, in this way, the user cannot use this tool to learn about the illegal processes currently running in the system. No matter how hackers implant Trojans or other programs, the user cannot know and thus cannot take measures to terminate these activities. It is self-evident that such consequences are very serious. In the process monitoring program running on the kernel described below, hackers cannot or are difficult to penetrate into the kernel to destroy the process monitoring program, so that it can ensure its own security.

Based on these shortcomings, we propose the principles and technologies for real-time process monitoring in the Linux kernel. This technology involves the following steps:

First, in a "clean" system environment, the security process in the system is fully run, analyze and collect information about these processes in Linux (including the process ID, process name, executable process image, process start time, and process parent process ), form a list of system security processes as the basis for Process Monitoring.

Then, the monitoring code collects information about processes running in the system in real time during process scheduling. If a process is found not in the "system security process list", the PID number, name, executable image, and other information of the process are immediately output through the terminal, or an alarm is reported to the user through sound, wait for the user to process and terminate the scheduling process during the waiting process until the user responds (allow the process or kill the process ).

In step 2, if the super user (System Administrator) releases the process, you can add the process to the "System Security Process List" to complete the list; if a user allows a process during use, the user's username and identity must be recorded and recorded as logs, A Super User (System Administrator) is a powerful basis for reviewing user behavior or modifying the "System Security Process List.

In addition, if some important processes (including kswapd and bdflush) in the system security process list are not running, then, the lost information of the process will be immediately stored in a file for targeted recovery during the system recovery process. According to different situations, some of them need to be stopped immediately, recovery process, and some can be recovered on site.