Lids Mastery and Advanced (middle)

Author: chaobowang@sina.com
Iv. Protection of important processes
The process is the dynamic portal of the operating system. There are two special processes in the kernel, process ID 0 (SWAPD) and Process ID 1 (init). The init process is the parent process of all processes at the time the system starts.
1, not kill the process.
Just as you can see if someone is going to win root privileges, we can easily kill the process that the kernel sends a special signal. To kill a process, you have to get the ID of the process and kill it with the kill command.
The system kills the process by calling it a kill, which is called in the Sys_kill () command in the kernel.
Let's take a look at lids's protection code.
In the/USR/SRC/LINUX/KERNEL/SIGNAL.C.
Asmlinkage int
Sys_kill (int pid, int sig)
{
struct Siginfo info;
#ifdef Config_lids_init_children_lock pid_t this_pid;
int i;
#ifdef Config_lids_allow_kill_init_children
if (!) ( Current->flags & PF_KILLINITC))
#endif
if (lids_load && lids_local_load && lids_fisset (Lids_flags,lids_flags_lock_init_children)) {
This_pid = pid>0?pid:-pid;
for (i=0;i
if (This_pid = = Lids_protected_pid[i]) {
Lids_security_alert ("Try to Kill Pid=%d,sig=%dn", Pid,sig);
Return-eperm;
}
}