摘要： 安全和完整地获得信息对于审计和入侵检测系统是极其重要的,但是Linux的shell记录并没有提供充足的信息并且历史记录可以被用户轻易地修改。分析了当前审计系统的缺点,给出了一个利用可加载内核模块的方法实现审计功能的例子。

关键词: 审计, 系统调用, 可加载内核模块, 设备驱动

Abstract: Obtaining information of Linux safely and sufficiently is critical for system auditing or IDS. But Linux shell records do not provide sufficient information and the history records can be readily modified by user. This paper analyses the disadvantage of current Linux audit system, then an example using LKM is given to illustrat the realization of the function of auditing.

中图分类号: 

• TP393.08