netdev - Re: [PATCH v2 0/2] RFC, aiding pid/network correlation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <r3noaw4m8g6.fsf@perdido.sfo.corp.google.com>
Date:	Fri, 01 Aug 2014 10:22:01 -0700
From:	Peter Moody <pmoody@...gle.com>
To:	Samir Bellabes <sam@...ack.fr>
Cc:	linux-security-module@...r.kernel.org, brandon.carpenter@...l.gov,
	casey@...aufler-ca.com, netdev@...r.kernel.org
Subject: Re: [PATCH v2 0/2] RFC, aiding pid/network correlation

Hi Samir,

>>  * Is there already an existing mechanism to do this?
>
> Hi Peter,
> I have built a such subsystem, for years now.
> Please, you can access latest public patchset here :
>
> https://lkml.org/lkml/2011/5/5/132

Interesting, thanks! I hadn't know about snet.

The patches don't apply cleanly, and while the merge wasn't difficult,
it looks like the code has gotten out of sync with mainline and doesn't
build (at least when applied to security-next). Did anything ever happen
with snet?

>From looking at the code, it looks kind of like a 'little-snitch' for
linux, is that right? A process tries to open a socket/etc and snet
requests that the user accept/reject the connection, and presumably
while the user is being queried one could dig through /proc to find the
exe/cmdline of the process making the request.

One thing that Hone does which snet doesn't seem to do (apologies if
this is incorrect but I can't test) is that it provides a full process
tree for a given pid back to init. When doing an investigation into a
system compromise, knowing what started the process making the
suspicious connection(s) (and what started *that* process) is often just
as important as knowing that there's a compromise to begin with.

Cheers,

> monitoring events is possible with snet.
>
> thanks,
>
> (resending, first mail didn't hit lists)
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html