參考案例mcafee培訓(xùn)hips move

1、HIP 8.0 Knowledge TransferMartin Stoilov HIP 8.0 for LinuxHIP Linux 8.0 architecture overviewHIP Linux 8.0 7.0 differencesHIP Linux Kernel modules overview. How they fit in the architecture. Why we introduced them.How we support multiple kernel versions and distributions.Troubleshooting what to look

2、 for and where to find information.Martin Stoilov has been responsible for the HIP 7.1 and HIP 8.0 development for the past 3+ years.Martin StoilovSoftware Engineer Architecture OverviewHow the product changed from 7.0HIPS Linux kernel modulesHIPS for different Linux kernels/Distributions.Troublesho

3、otingHIP 8.0 Architecture overviewKernel Modulesschook.kohipsec.koUsermode servicehipushipclientPolicy and Event ManagementHIPPluginDifferences between version 7.0 and 8.0 (Linux)7.0 requires SE Linux turned on, 8.0 requires SE Linux turned off7.0 enumerates the file the whole file system to set the

4、 security attributes.7.0 cannot set security directives for file system entities that do not exist.7.0 generates violation events, by monitoring the SE Linux log.7.0 doesnt have kernel mode code.HIPS 8.0 Kernel modulesKernel modules code license is GPL. Why?Why do we need them?Kernel modules:schookh

5、ipsecHow does the kernel module communicate with the rest of HIPS?/dev/hipsecHIPS for different Linux kernels/DistributionsHIPS 8.0 works with the following Linux distributions:RHEL 4.0RHEL 5.0SLES 10SLES 11HIPS 8.0 use the RPM packages.HIPS 8.0 uses different packages for the kernel modules and the

6、 user mode components.The package name contain the supported distribution and processor architecture. Example:MFEhiplsm-8.0.0-1331.SUSE11.i386.rpmHow do we minimize the number of piled module versions?TroubleshootingUseful command line tools:/opt/McAfee/hip/hipts/sbin/lsmodThe log files are located in /optMcAfee/hip/loghipus.log (when DEBUG message is enabled will log every access to the filesystem)HipClient.logDifferences between the previous HIPS major ver