[PATCH] Abnormal End of Processes
Hi, I have been working on some code that detects abnormal events based on audit system events. One kind of event that we currently have no visibility for is when a program terminates due to segfault - which should never happen on a production machine. And if it did, you'd want to investigate it. Attached is a patch that collects these events and sends them into the audit system. Signed-off-by: Steve Grubb <sgrubb@redhat.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Родитель
5712e88f2b
Коммит
0a4ff8c259
|
@ -1488,6 +1488,8 @@ int do_coredump(long signr, int exit_code, struct pt_regs * regs)
|
|||
int flag = 0;
|
||||
int ispipe = 0;
|
||||
|
||||
audit_core_dumps(signr);
|
||||
|
||||
binfmt = current->binfmt;
|
||||
if (!binfmt || !binfmt->core_dump)
|
||||
goto fail;
|
||||
|
|
|
@ -112,6 +112,7 @@
|
|||
#define AUDIT_FIRST_KERN_ANOM_MSG 1700
|
||||
#define AUDIT_LAST_KERN_ANOM_MSG 1799
|
||||
#define AUDIT_ANOM_PROMISCUOUS 1700 /* Device changed promiscuous mode */
|
||||
#define AUDIT_ANOM_ABEND 1701 /* Process ended abnormally */
|
||||
|
||||
#define AUDIT_KERNEL 2000 /* Asynchronous audit record. NOT A REQUEST. */
|
||||
|
||||
|
@ -377,6 +378,7 @@ static inline void audit_inode_child(const char *dname,
|
|||
if (unlikely(!audit_dummy_context()))
|
||||
__audit_inode_child(dname, inode, parent);
|
||||
}
|
||||
void audit_core_dumps(long signr);
|
||||
|
||||
static inline void audit_ptrace(struct task_struct *t)
|
||||
{
|
||||
|
@ -467,6 +469,7 @@ extern int audit_signals;
|
|||
#define __audit_inode_child(d,i,p) do { ; } while (0)
|
||||
#define audit_inode(n,i) do { ; } while (0)
|
||||
#define audit_inode_child(d,i,p) do { ; } while (0)
|
||||
#define audit_core_dumps(i) do { ; } while (0)
|
||||
#define auditsc_get_stamp(c,t,s) do { BUG(); } while (0)
|
||||
#define audit_get_loginuid(c) ({ -1; })
|
||||
#define audit_log_task_context(b) do { ; } while (0)
|
||||
|
|
|
@ -2037,3 +2037,42 @@ int __audit_signal_info(int sig, struct task_struct *t)
|
|||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* audit_core_dumps - record information about processes that end abnormally
|
||||
* @sig: signal value
|
||||
*
|
||||
* If a process ends with a core dump, something fishy is going on and we
|
||||
* should record the event for investigation.
|
||||
*/
|
||||
void audit_core_dumps(long signr)
|
||||
{
|
||||
struct audit_buffer *ab;
|
||||
u32 sid;
|
||||
|
||||
if (!audit_enabled)
|
||||
return;
|
||||
|
||||
if (signr == SIGQUIT) /* don't care for those */
|
||||
return;
|
||||
|
||||
ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_ANOM_ABEND);
|
||||
audit_log_format(ab, "auid=%u uid=%u gid=%u",
|
||||
audit_get_loginuid(current->audit_context),
|
||||
current->uid, current->gid);
|
||||
selinux_get_task_sid(current, &sid);
|
||||
if (sid) {
|
||||
char *ctx = NULL;
|
||||
u32 len;
|
||||
|
||||
if (selinux_sid_to_string(sid, &ctx, &len))
|
||||
audit_log_format(ab, " ssid=%u", sid);
|
||||
else
|
||||
audit_log_format(ab, " subj=%s", ctx);
|
||||
kfree(ctx);
|
||||
}
|
||||
audit_log_format(ab, " pid=%d comm=", current->pid);
|
||||
audit_log_untrustedstring(ab, current->comm);
|
||||
audit_log_format(ab, " sig=%ld", signr);
|
||||
audit_log_end(ab);
|
||||
}
|
||||
|
|
Загрузка…
Ссылка в новой задаче