Linux security modules enhancements: Module stacking framework and tcp state transition hooks for statedriven nids

Until the availability of Kernel 2.6 the Linux op-erating system lacked general support to integrate security mechanisms into the kernel. The Linux Se-curity Module Framework (LSM) was designed to overcome this limitation. Although LSM provides a solid baseline for kernel security, it lacks impor-tant features. In this paper two of these limitations are addressed: First a framework-managed module stacking mechanism is proposed that allows multi-ple security policies to be present in the kernel at the same time. The second aspect this paper deals with is the addition of LSM hooks to the Linux TCP layer. This extension was chosen because it allows the implementation of a State-Based Network In-trusion Detection Mechanism which is outlined at the end of the article