Re: Extracting written string from the write syscall

On Thu, Apr 26, 2018 at 4:40 PM, Casey Schaufler <casey(a)schaufler-ca.com&gt; wrote: > On 4/26/2018 3:57 PM, Steve Grubb wrote: >> On Thu, 26 Apr 2018 20:34:57 +0000 >> Wajih Ul Hassan <wajih.lums(a)gmail.com&gt; wrote: >> >>> Hi all, >>> ..... > You could write a Linux Security Module (LSM) to monitor the > content of writes. The performance impact would be rather > amazing. > I would recommend using BPF + kprobes + perf_event buffers for this purpose. There are enough places you can probe to grab these strings in the kernel, and if you do your filtering in BPF, you can then push it into kernel space based on filtering. Although, AFAIK, the BPF JITs don't do vectorization of instructions, but it's still not too bad. If you put your kprobe on the syscall itself, and probe the userspace addr, remember you're going to be open to a time-of-use, time-of-check style attack.