linux-kernel - Suggestions on process integrity checking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Fri, 23 Apr 2010 09:48:19 -0700 (PDT)
From:	Jose Luis Marchetti <joseluismarchetti@...oo.com.br>
To:	linux-kernel@...r.kernel.org
Subject: Suggestions on process integrity checking

Hi,

I need to implement a process integrity check, this is to make sure that a process that is running at the time of checking was not corrupted since it was first loaded in memory.
I would appreciate suggestions on where I should implement this in the Linux kernel, my first outline of this work is:

1) Add a field to task_struct that would hold some sort of process digital signature, it could be a CRC32 of process code space, this is not defined yet.
2) For simplicity let us assume an elf file is being executed, in binfmt_elf.c I see the elf file program segments are mmap to the virtual addresses and no read is actually done there ( or am I wrong ?). Where the reading of program segments is actually being done.
3) When the program segments are read in memory I need to update the process digital signature.
4) Then there is the checking part, if the kernel have to perform this checking periodically, how/where do you suggest it to be implemented ?

I was not successful in finding any similar implementation on the Internet that I could base my work on, if you know of any, please let me know.

Thanks in advance for any suggestion.

José Luís Marchetti

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/