linux-kernel - Re: [PATCH V9 3/3] audit: add audit by children of executable path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <18689423.1lXpkUPLpg@x2>
Date:	Thu, 06 Aug 2015 17:08:14 -0400
From:	Steve Grubb <sgrubb@...hat.com>
To:	Paul Moore <pmoore@...hat.com>
Cc:	Richard Guy Briggs <rgb@...hat.com>, linux-audit@...hat.com,
	linux-kernel@...r.kernel.org, eparis@...hat.com, peter@...3.com
Subject: Re: [PATCH V9 3/3] audit: add audit by children of executable path

On Thursday, August 06, 2015 04:24:58 PM Paul Moore wrote:
> On Wednesday, August 05, 2015 04:29:38 PM Richard Guy Briggs wrote:
> > This adds the ability to audit the actions of children of a
> > not-yet-running
> > process.
> >
> > 
> >
> > This is a split-out of a heavily modified version of a patch originally
> > submitted by Eric Paris with some ideas from Peter Moody.
> >
> > 
> >
> > Cc: Peter Moody <peter@...3.com>
> > Cc: Eric Paris <eparis@...hat.com>
> > Signed-off-by: Richard Guy Briggs <rgb@...hat.com>
> > ---
> >
> >  include/uapi/linux/audit.h |    1 +
> >  kernel/auditfilter.c       |    5 +++++
> >  kernel/auditsc.c           |   11 +++++++++++
> >  3 files changed, 17 insertions(+), 0 deletions(-)
> 
> I'm still not really comfortable with that loop and since there hasn't been
> a  really convincing use case I'm going to pass on this patch for right
> now.  If someone comes up with a *really* compelling case in the future
> I'll reconsider it.

Its the same reason strace has a -f option. Sometimes you need to also see 
what the children did. For example, maybe you want to audit file access to a 
specific directory and several cgi-bin programs can get there. You could write 
a rule for apache and be done. Or maybe, you have an app that lets people have 
shell access and you need to see files accessed or connections opened. Or maybe 
its a control panel application with helper scripts and you need to see 
changes that its making. Or maybe you have a program that is at risk of being 
compromised and you want to see if someone gets a shell from it. There are a 
lot of cases where it could be useful.

-Steve
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/