Re: [PATCH V9 3/3] audit: add audit by children of executable path
On Thursday, August 06, 2015 04:24:58 PM Paul Moore wrote:
On Wednesday, August 05, 2015 04:29:38 PM Richard Guy Briggs wrote:
> This adds the ability to audit the actions of children of a
> not-yet-running
> process.
>
>
>
> This is a split-out of a heavily modified version of a patch originally
> submitted by Eric Paris with some ideas from Peter Moody.
>
>
>
> Cc: Peter Moody <peter(a)hda3.com>
> Cc: Eric Paris <eparis(a)redhat.com>
> Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com>
> ---
>
> include/uapi/linux/audit.h | 1 +
> kernel/auditfilter.c | 5 +++++
> kernel/auditsc.c | 11 +++++++++++
> 3 files changed, 17 insertions(+), 0 deletions(-)
I'm still not really comfortable with that loop and since there hasn't been
a really convincing use case I'm going to pass on this patch for right
now. If someone comes up with a *really* compelling case in the future
I'll reconsider it.
Its the same reason strace has a -f option. Sometimes you need to also see
what the children did. For example, maybe you want to audit file access to a
specific directory and several cgi-bin programs can get there. You could write
a rule for apache and be done. Or maybe, you have an app that lets people have
shell access and you need to see files accessed or connections opened. Or maybe
its a control panel application with helper scripts and you need to see
changes that its making. Or maybe you have a program that is at risk of being
compromised and you want to see if someone gets a shell from it. There are a
lot of cases where it could be useful.
-Steve