Linux Kernel Analysis

With reference to the LinSec design (Chapter 4), four kernel mechanisms that would suffer most alterations were identified as:

• Access Control
• Executing a binary
• Changing ownership of a process
• Sending packets via INET protocols

Although level of understanding of these mechanisms was high on the theoretical side [14,25,6], some practical insight into up-to-date kernel was needed before the actual implementation started. The approach used was to place calls to LinSec functions where it was thought they should go, determined by reading the kernel source, but with the actual LinSec functions being dummies printing a text message via printk. This proved invaluable as it revealed some undocumented intricacies of the Linux kernel. Having the actual references to LinSec code in correct places in Linux kernel formed a framework for further implementation.