netdev - Re: [PATCH v2 0/2] RFC, aiding pid/network correlation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 02 Aug 2014 08:05:23 -0700
From:	Peter Moody <pmoody@...gle.com>
To:	Samir Bellabes <sam@...ack.fr>
Cc:	linux-security-module@...r.kernel.org, brandon.carpenter@...l.gov,
	casey@...aufler-ca.com, netdev@...r.kernel.org
Subject: Re: [PATCH v2 0/2] RFC, aiding pid/network correlation


Hi Sam

> snet is more like a framework now.
> you can interactively register which syscall you want to monitor.
> then kernel substem will sent you informations.
> unregister, and the kernel subsystem is going quiet.
>
> in order to build your process tree, you just use the userspace lib (I
> don't think it is yet publicly available, I have to put this up-to-date
> too) 
>
> the lib is build on the same libpcap callback mecanism : you register a
> syscall with a callback function. your callback function is called to
> manage the informations every time the related syscall occured.
> Here you can build your process tree, or do whatever you want. 
>
> Now, kernel subsystem doesn't required always a userspace verdict, as
> there is a "monitor mode", which is exactly what you will use if you
> decide to use snet.
>
> As I said, snet is more like a framework to push this valuable
> informations to userspace, do whatever you want, and send back your
> policy decision (if it needs one) 

It sounds at least in theory like snet can do what I'm looking for. I
have a few concerns however:

 * since I'm trying to tie individual packets to processes, I think that
   would mean that I'd have to register for socket_sendmsg/socket_recvmsg.
   Would that mean a trip to userspace (for the bpf callback at least if
   this is just in monitor mode) for every packet?

 * obviously the current lsm hooks/attributes from snet.h don't account
   for tracking processes.

In any event, I'm interested in seeing the updated patchset/userspace
lib for registering/reading events.

Cheers
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html