diff --git a/LICENSE b/LICENSE
index fc48fd2..aa97504 100644
--- a/LICENSE
+++ b/LICENSE
@@ -2,5 +2,7 @@
./newip/
./xpm/
./qos_auth/
+ ./ucollection/
+ ./memory_security/
As for the specific use of the licenses, please refer to the relevant description in the documents.
diff --git a/OAT.xml b/OAT.xml
index 9de7aac..0c71260 100644
--- a/OAT.xml
+++ b/OAT.xml
@@ -59,10 +59,14 @@ Note:If the text contains special characters, please escape them according to th
+
+
+
+
@@ -81,6 +85,7 @@ Note:If the text contains special characters, please escape them according to th
+
diff --git a/memory_security/Kconfig b/memory_security/Kconfig
new file mode 100755
index 0000000..f3a2762
--- /dev/null
+++ b/memory_security/Kconfig
@@ -0,0 +1,16 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+# Copyright (c) 2023 Huawei Device Co., Ltd.
+#
+# Config for hide excutable memory address of process manager
+#
+
+menu "Hide memory address manager"
+
+config HIDE_MEM_ADDRESS
+ default n
+ bool "Hide excutable memory address in proc/[pid]/maps "
+ help
+ Select show address about anonymous area of the process memory
+ with -rx- permissions or not.
+endmenu
+# a blank line must be existed
\ No newline at end of file
diff --git a/memory_security/Makefile b/memory_security/Makefile
new file mode 100755
index 0000000..41e5324
--- /dev/null
+++ b/memory_security/Makefile
@@ -0,0 +1,21 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Copyright (c) 2023 Huawei Device Co., Ltd.
+#
+# Makefile for memory_security manager module
+#
+obj-$(CONFIG_HIDE_MEM_ADDRESS) += hideaddr.o
+
+ccflags-$(CONFIG_HIDE_MEM_ADDRESS) += \
+ -I$(srctree)/fs/proc \
+ -I$(srctree)/security/selinux/include \
+ -I$(srctree)/security/selinux
+
+$(addprefix $(obj)/,$(obj-y)): $(obj)/flask.h
+
+quiet_cmd_flask = GEN $(obj)/flask.h $(obj)/av_permissions.h
+ cmd_flask = scripts/selinux/genheaders/genheaders $(obj)/flask.h $(obj)/av_permissions.h
+
+targets += flask.h av_permissions.h
+$(obj)/flask.h: $(srctree)/security/selinux/include/classmap.h FORCE
+ $(call if_changed,flask)
diff --git a/memory_security/README_zh.md b/memory_security/README_zh.md
new file mode 100644
index 0000000..062ded5
--- /dev/null
+++ b/memory_security/README_zh.md
@@ -0,0 +1,51 @@
+## 背景
+
+当前linux内核在内存安全方面还有需要加固的空间，memory_security模块为内存安全定制相应的功能来增强安全能力。
+
+## MEMORY_SECURITY 模块
+
+memory_security模块定制化内存的安全增强能力
+
+### MEMORY_SECURITY/hideaddr 模块
+
+MEMORY_SECURITY/hideaddr模块通过检查渲染进程映射的匿名内存是否具有可执行的权限，来针对性的将映射后的内存地址的start和end值设置为NULL，以此达到隐藏内存地址的目的
+
+#### 1.进程类型检查
+
+通过进程的selinux安全上下文来判定当前proc/[pid]/maps中的pid对应的进程是否为渲染进程
+
+#### 2.匿名内存区域权限检查
+
+内存区域的权限由vm_flags_t结构体的 flags成员呈现，通过检查flags是否具有-x-权限来决定是否将其所对应的地址隐藏起来。
+
+## 目录
+
+## MEMORY_SECURITY执行权限管控的主要代码目录结构如下：
+
+```
+# 代码路径 /kernel/linux/common_modules/memory_security
+├── hideaddr.h # memory_security 头文件
+├── hideaddr.c # memory_security 管控代码
+├── Konfig
+├── Makefile
+```
+
+## MEMORY_SECURITY配置指导
+
+1. MEMORY_SECURITY/HIDEADDR使能
+ `CONFIG_HIDE_MEM_ADDRESS=y`
+
+2. MEMORY_SECURITY/HIDEADDR禁用
+ `CONFIG_HIDE_MEM_ADDRESS=n`
+
+## 相关仓
+
+[内核子系统](https://gitee.com/openharmony/docs/blob/master/zh-cn/readme/%E5%86%85%E6%A0%B8%E5%AD%90%E7%B3%BB%E7%BB%9F.md)
+
+[kernel_linux_5.10](https://gitee.com/openharmony/kernel_linux_5.10)
+
+[kernel_linux_config](https://gitee.com/openharmony/kernel_linux_config)
+
+[device_board_hihope](https://gitee.com/openharmony/device_board_hihope)
+
+[security_selinux_adapter](https://gitee.com/openharmony/security_selinux_adapter)
diff --git a/memory_security/apply_hideaddr.sh b/memory_security/apply_hideaddr.sh
new file mode 100755
index 0000000..bbc2662
--- /dev/null
+++ b/memory_security/apply_hideaddr.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2022 Huawei Device Co., Ltd.
+#
+#Description: Create a symbolic link for memory_security in Linux 5.10
+#
+
+set -e
+
+OHOS_SOURCE_ROOT=$1
+KERNEL_BUILD_ROOT=$2
+PRODUCT_NAME=$3
+KERNEL_VERSION=$4
+MEMORY_SECURITY_SOURCE_ROOT=$OHOS_SOURCE_ROOT/kernel/linux/common_modules/memory_security
+
+function main()
+{
+ pushd .
+
+ if [ ! -d "$KERNEL_BUILD_ROOT/fs/proc/memory_security" ]; then
+ mkdir $KERNEL_BUILD_ROOT/fs/proc/memory_security
+ fi
+
+ cd $KERNEL_BUILD_ROOT/fs/proc/memory_security
+ ln -s -f $(realpath --relative-to=$KERNEL_BUILD_ROOT/fs/proc/memory_security/ $MEMORY_SECURITY_SOURCE_ROOT)/* ./
+
+ popd
+}
+
+main
diff --git a/memory_security/hideaddr.c b/memory_security/hideaddr.c
new file mode 100644
index 0000000..259d382
--- /dev/null
+++ b/memory_security/hideaddr.c
@@ -0,0 +1,83 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (c) 2023 Huawei Device Co., Ltd.
+ */
+
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+
+#include "avc.h"
+#include "objsec.h"
+
+static bool is_anon_exec(struct vm_area_struct *vma)
+{
+ const char *name = NULL;
+ vm_flags_t flags = vma->vm_flags;
+
+ if (!(flags & VM_EXEC))
+ return false;
+
+ name = arch_vma_name(vma);
+ if (!name) {
+ struct anon_vma_name *anon_name;
+ anon_name = anon_vma_name(vma);
+ if (!anon_name)
+ return false;
+ }
+ return true;
+}
+
+static int hideaddr_avc_has_perm(u16 tclass, u32 requested, struct seq_file *m)
+{
+ struct av_decision avd;
+ struct inode *inode_task = file_inode(m->file);
+ struct task_struct *task = get_proc_task(inode_task);
+ u32 secid;
+
+ security_cred_getsecid(task->cred, &secid);
+ return avc_has_perm_noaudit(&selinux_state, secid, secid, tclass, requested,
+ AVC_STRICT, &avd);
+}
+
+static void hideaddr_header_prefix(unsigned long *start, unsigned long *end,
+ vm_flags_t *flags, struct seq_file *m, struct vm_area_struct *vma)
+{
+ if (!is_anon_exec(vma))
+ return;
+
+ if (hideaddr_avc_has_perm(SECCLASS_HIDEADDR, HIDEADDR__HIDE_EXEC_ANON_MEM, m))
+ return;
+
+ if (!hideaddr_avc_has_perm(SECCLASS_HIDEADDR, HIDEADDR__HIDE_EXEC_ANON_MEM_DEBUG, m))
+ return;
+
+ *start = 0;
+ *end = 0;
+ *flags = 0;
+}
+
+static void hideaddr_header_prefix_lhck_register(void)
+{
+ REGISTER_HCK_LITE_HOOK(hideaddr_header_prefix_lhck, hideaddr_header_prefix);
+}
+
+static int __init hideaddr_hooks_init(void)
+{
+ hideaddr_header_prefix_lhck_register();
+ return 0;
+}
+
+static void __exit hideaddr_hooks_exit(void)
+{
+}
+
+module_init(hideaddr_hooks_init);
+module_exit(hideaddr_hooks_exit);