| Since the first one appeared, the computer virus is always being one of the main threats to information security. The file system is one of the most major media as the survival and attacking target of the virus. Therefore, it is always an anti-virus protection object. Compared with Windows operating system, due to its excellent design, Linux initially has the innate immune capability to virus attacking. However, when more Linux operating system viruses started to appear, and more enterprises began to use Linux as the server operating system, Linux anti-virus application study become more and more important.For the Linux server anti-virus system, real-time virus scanning function is generally required. The traditional real-time virus scaning technology for Linux file system, is replacing the file system operation system call with anti-virus system call added the virus detection logic, installed into the Linux kernel in the form of kernel hook module. However, the development process of the kernel module is usually more complex, and it is difficult to debug, during the running process it could also influence the normal operation of the operating system. In view of above problems, a user space module based on the file system change event notification mechanism provided by the Linux kernel itself was developed in this paper, therefore the main virus detection logic would be running in user space, avoiding the usage of a kernel module that might cause problems. In this paper, the API Layer for a Linux server anit-virus system was designed and implemented, the main research work included as follows:(1) Comparing several file system change notification mechanisms the Linux system kernel provided, the feature of inotify mechanism supporting multiple types of file system change events and fanotify mechanism supporting file access descision were found to be able to be used in anti-virus software application development.(2) The API Layer of the file system change event notification was designed and implemented based on inotify mechanism and fanotify mechanism, then support for obtaining the file system change event information and determining the scanning target was provided.(3) Combining with the developed API Layer as the kernel and user space connection layer, the real-time virus scanning module of Linux server anti-virus system was designed and implemented, making the Linux server anti-virus system with real-time virus scanning function could work with no need to rely on the corresponding kernel hook module, therefore reduced the risk of effecting normal operating system running and costs of development and maintenance, and made the system be able to be applied to more Linux operating system versions.(4) Some defects and deficiencies and project experience were summarized, the improvement current system needed in the future was also discussed. |
