Messages in this thread | ![/](/images/icornerl.gif) | | Date | Fri, 23 Apr 2010 09:48:19 -0700 (PDT) | From | Jose Luis Marchetti <> | Subject | Suggestions on process integrity checking |
| |
Hi,
I need to implement a process integrity check, this is to make sure that a process that is running at the time of checking was not corrupted since it was first loaded in memory. I would appreciate suggestions on where I should implement this in the Linux kernel, my first outline of this work is:
1) Add a field to task_struct that would hold some sort of process digital signature, it could be a CRC32 of process code space, this is not defined yet. 2) For simplicity let us assume an elf file is being executed, in binfmt_elf.c I see the elf file program segments are mmap to the virtual addresses and no read is actually done there ( or am I wrong ?). Where the reading of program segments is actually being done. 3) When the program segments are read in memory I need to update the process digital signature. 4) Then there is the checking part, if the kernel have to perform this checking periodically, how/where do you suggest it to be implemented ?
I was not successful in finding any similar implementation on the Internet that I could base my work on, if you know of any, please let me know.
Thanks in advance for any suggestion.
José Luís Marchetti
-- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| ![\](/images/icornerr.gif) |