SELinux security identifier anti-tamper detection method and system

Abstract

The invention discloses a SELinux security identifier anti-tamper detection method and system. The method comprises the implementation steps of: establishing a mapping relational table of processes and security identifiers thereof, when a process is created, taking the process and the security identifier thereof as new nodes to be inserted into the mapping relational table, when the process is removed, deleting the nodes, and updating the nodes when change is generated through a legal calling interface; and, when the process executes a new program, performing legality detection on a security identifier of a parent process, if the security identifier of the parent process is not same as the security identifier in the mapping relational table, recovering the security identifier of the parentprocess according to the mapping relational table, and starting to execute by setting the security identifier of the parent process as the default security identifier of a sub-process. By means of the SELinux security identifier anti-tamper detection method and system disclosed by the invention, illegal tampering on the security identifier of the process by an attacker using a kernel root attackmeans can be detected; furthermore, the security identifier of the process is recovered to the security identifier before illegal tampering; and the attacker can be prevented from breaking through security protection on the system by SELinux through the kernel root attack means.

Description

technical field [0001] The invention relates to the field of Linux system security, in particular to an SELinux security identifier anti-tampering detection method and system. Background technique [0002] The system administrator of the Linux operating system has the privilege of accessing and managing all resources within the system, and has become one of the main targets of malicious attackers. Under normal circumstances, after malicious attackers obtain general system permissions through remote attacks, etc., they often use the system's privilege escalation loopholes to carry out privilege escalation attacks, gaining system root privileges and controlling the system overall. In order to protect the privileges of system administrators, the mandatory access control mechanism of the operating system breaks the privileges of the root user, and controls and manages the access control behavior between various objects in the system according to different access control security...

AI Technical Summary

Problems solved by technology

[0007] To sum up, the SELinux security identifier of the Linux system may be illegally tampered with through the kernel-level privilege escalation vulnerability, so that the inspection of the access control mechanism is bypassed

Images