On Thu, 26 Apr 2018 20:34:57 +0000 Wajih Ul Hassan <wajih.lums(a)gmail.com&gt; wrote: > Hi all, > I am using Linux Audit module to monitor file accesses. However, I > want to extract what exactly was written to a specific file. I am > catching the events belonging to write syscall, for example: > > type=SYSCALL msg=audit(04/26/2018 15:11:33.568:307907) : arch=x86_64 > syscall=write success=yes exit=37 a0=0x3 a1=0x1aee240 a2=0x25 a3=0x477 > items=0 ppid=11376 pid=26771 auid=wajih uid=wajih gid=wajih euid=wajih > suid=wajih fsuid=wajih egid=wajih sgid=wajih fsgid=wajih tty=pts1 > ses=1 comm=a.out exe=/code/a.out key=(null) > > I know the "a1" is the pointer to buffer being written; however, is > there a way I can take that pointer and extract the exact string? In > the example above I was writing "Hello world ...". Short answer is no. There is no way I know of to do that via the audit system.

-Steve -- Linux-audit mailing list Linux-audit(a)redhat.com https://www.redhat.com/mailman/listinfo/linux-audit

On Thu, Apr 26, 2018 at 4:40 PM, Casey Schaufler <casey(a)schaufler-ca.com&gt; wrote: > On 4/26/2018 3:57 PM, Steve Grubb wrote: >> On Thu, 26 Apr 2018 20:34:57 +0000 >> Wajih Ul Hassan <wajih.lums(a)gmail.com&gt; wrote: >> >>> Hi all, >>> ..... > You could write a Linux Security Module (LSM) to monitor the > content of writes. The performance impact would be rather > amazing. > I would recommend using BPF + kprobes + perf_event buffers for this purpose. There are enough places you can probe to grab these strings in the kernel, and if you do your filtering in BPF, you can then push it into kernel space based on filtering. Although, AFAIK, the BPF JITs don't do vectorization of instructions, but it's still not too bad. If you put your kprobe on the syscall itself, and probe the userspace addr, remember you're going to be open to a time-of-use, time-of-check style attack.

Thanks for your replies. However, I am now thinking of another solution. Let's say I can capture write() in the userspace by either instrumenting the LibC or LD_PRELOAD wrapper and store the string buffer passed to write(). Can I call/generate *some other non-instrusive* syscall which can take that string buffer that I stored earlier and that syscall with the buffer will be visible in the audit.log? I am not worried about performance hit right now.

On Thu, Apr 26, 2018 at 7:46 PM Casey Schaufler <casey(a)schaufler-ca.com <mailto:casey@schaufler-ca.com>> wrote: On 4/26/2018 5:08 PM, Sargun Dhillon wrote: > On Thu, Apr 26, 2018 at 4:40 PM, Casey Schaufler <casey(a)schaufler-ca.com <mailto:casey@schaufler-ca.com>> wrote: >> On 4/26/2018 3:57 PM, Steve Grubb wrote: >>> On Thu, 26 Apr 2018 20:34:57 +0000 >>> Wajih Ul Hassan <wajih.lums(a)gmail.com <mailto:wajih.lums@gmail.com>> wrote: >>> >>>> Hi all, >>>>  ..... >> You could write a Linux Security Module (LSM) to monitor the >> content of writes. The performance impact would be rather >> amazing. >> > I would recommend using BPF + kprobes + perf_event buffers for this > purpose. There are enough places you can probe to grab these strings > in the kernel, and if you do your filtering in BPF, you can then push > it into kernel space based on filtering. Although, AFAIK, the BPF JITs > don't do vectorization of instructions, but it's still not too bad. If > you put your kprobe on the syscall itself, and probe the userspace > addr, remember you're going to be open to a time-of-use, time-of-check > style attack. That looks like a whole lot of mechanism to perform a simple task.