Re: Abnormal End of Processes

Hi, I have been working on some code that detects abnormal events based on audit system events. One kind of event that we currently have no visibility for is when a program terminates due to segfault - which should never happen on a production machine. And if it did, you'd want to investigate it. Attached is a patch that collects these events and sends them into the audit system. Signed-off-by: Steve Grubb <sgrubb(a)redhat.com&gt; diff -urp linux-2.6.18.x86_64.orig/fs/exec.c linux-2.6.18.x86_64/fs/exec.c --- linux-2.6.18.x86_64.orig/fs/exec.c 2007-04-13 17:26:19.000000000 -0400 +++ linux-2.6.18.x86_64/fs/exec.c 2007-04-13 17:25:34.000000000 -0400 @@ -49,6 +49,7 @@ #include <linux/acct.h> #include <linux/cn_proc.h> #include <linux/audit.h> +#include <linux/selinux.h> #include <asm/uaccess.h> #include <asm/mmu_context.h> @@ -1462,6 +1463,32 @@ int do_coredump(long signr, int exit_cod int fsuid = current->fsuid; int flag = 0; int ispipe = 0; + extern int audit_enabled; + + if (unlikely(audit_enabled) && signr != SIGQUIT && signr != SIGABRT) {