Research and Realization of Secure Audit Mechanism Based on LSM

The secure audit mechanism based on Linux security modules (LSM) is presented. The SAM enhances LSM in audit, makes security domain of process task structure point to the specified data structure, and adds audit hooks and hook functions to capture comprehensive audit information. Additionally, register functions and unregistered functions are provided to implement dynamic addition and deletion of security audit modules. Buffer with double-linked list structure is designed to solve easy lost of audit information and buffer overflow. Normal activities rule base, RVA, and its dynamic response algorithm are presented. And real-time security warning and punishment mechanisms are achieved by constraint control algorithm and the set of warning threshold and punish threshold. Audit log format based on efficiency is designed. And five kinds of basic query are provided to achieve effective log storage and query. The tested results indicate the mechanism has better security and running performance, less influence on the kernel, and adaptive kernel´s upgrade.