Re: Filtering Connect syscalls for af_inet only
On Thu, Feb 5, 2015 at 10:31 AM, F Rafi <farhanible(a)gmail.com> wrote:
Ahh..thanks Paul!
Is there a better way to intercept outbound network access calls while
avoiding af_unix?
I'm not sure, I'm not overly familiar with the auditd/auditctl
filtering capabilities. There are several people on this list that
are far more knowledgeable about that than me.
I assume sockaddr_storage is just a different size (I think 128?)
The idea behind the sockaddr_storage struct was to create a structure
that could be used to represent any address family that the system
supports. I don't believe there is a standard size across OSes due to
different level of support, padding, etc; in other words, it's
probably best not to rely on a specific size of sockaddr_storage.
--
paul moore
www.paul-moore.com