Gitweb:
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0a4ff8c2598b72f2fa9d50aae9e1809e684dbf41
Commit: 0a4ff8c2598b72f2fa9d50aae9e1809e684dbf41
Parent: 5712e88f2b0f626a4857c24128810bbf8ce09537
Author: Steve Grubb <[EMAIL PROTECTED]>
AuthorDate: Thu Apr 19 10:28:21 2007 -0400
Committer: Al Viro <[EMAIL PROTECTED]>
CommitDate: Fri May 11 05:38:26 2007 -0400
[PATCH] Abnormal End of Processes
Hi,
I have been working on some code that detects abnormal events based on audit
system events. One kind of event that we currently have no visibility for is
when a program terminates due to segfault - which should never happen on a
production machine. And if it did, you'd want to investigate it. Attached
is a
patch that collects these events and sends them into the audit system.
Signed-off-by: Steve Grubb <[EMAIL PROTECTED]>
Signed-off-by: Al Viro <[EMAIL PROTECTED]>
---
fs/exec.c | 2 ++
include/linux/audit.h | 3 +++
kernel/auditsc.c | 39 +++++++++++++++++++++++++++++++++++++++
3 files changed, 44 insertions(+), 0 deletions(-)
diff --git a/fs/exec.c b/fs/exec.c
index 1ba85c7..7cf078e 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1488,6 +1488,8 @@ int do_coredump(long signr, int exit_code, struct pt_regs
* regs)
int flag = 0;
int ispipe = 0;
+ audit_core_dumps(signr);
+
binfmt = current->binfmt;
if (!binfmt || !binfmt->core_dump)
goto fail;
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 22976dd..fccc6e5 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -112,6 +112,7 @@
#define AUDIT_FIRST_KERN_ANOM_MSG 1700
#define AUDIT_LAST_KERN_ANOM_MSG 1799
#define AUDIT_ANOM_PROMISCUOUS 1700 /* Device changed promiscuous mode */
+#define AUDIT_ANOM_ABEND 1701 /* Process ended abnormally */
#define AUDIT_KERNEL 2000 /* Asynchronous audit record. NOT A
REQUEST. */
@@ -377,6 +378,7 @@ static inline void audit_inode_child(const char *dname,
if (unlikely(!audit_dummy_context()))
__audit_inode_child(dname, inode, parent);
}
+void audit_core_dumps(long signr);
static inline void audit_ptrace(struct task_struct *t)
{
@@ -467,6 +469,7 @@ extern int audit_signals;
#define __audit_inode_child(d,i,p) do { ; } while (0)
#define audit_inode(n,i) do { ; } while (0)
#define audit_inode_child(d,i,p) do { ; } while (0)
+#define audit_core_dumps(i) do { ; } while (0)
#define auditsc_get_stamp(c,t,s) do { BUG(); } while (0)
#define audit_get_loginuid(c) ({ -1; })
#define audit_log_task_context(b) do { ; } while (0)
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 5276b7e..e36481e 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -2037,3 +2037,42 @@ int __audit_signal_info(int sig, struct task_struct *t)
return 0;
}
+
+/**
+ * audit_core_dumps - record information about processes that end abnormally
+ * @sig: signal value
+ *
+ * If a process ends with a core dump, something fishy is going on and we
+ * should record the event for investigation.
+ */
+void audit_core_dumps(long signr)
+{
+ struct audit_buffer *ab;
+ u32 sid;
+
+ if (!audit_enabled)
+ return;
+
+ if (signr == SIGQUIT) /* don't care for those */
+ return;
+
+ ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_ANOM_ABEND);
+ audit_log_format(ab, "auid=%u uid=%u gid=%u",
+ audit_get_loginuid(current->audit_context),
+ current->uid, current->gid);
+ selinux_get_task_sid(current, &sid);
+ if (sid) {
+ char *ctx = NULL;
+ u32 len;
+
+ if (selinux_sid_to_string(sid, &ctx, &len))
+ audit_log_format(ab, " ssid=%u", sid);
+ else
+ audit_log_format(ab, " subj=%s", ctx);
+ kfree(ctx);
+ }
+ audit_log_format(ab, " pid=%d comm=", current->pid);
+ audit_log_untrustedstring(ab, current->comm);
+ audit_log_format(ab, " sig=%ld", signr);
+ audit_log_end(ab);
+}
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
