Thanks for your replies. However, I am now thinking of another solution. Let's say I can capture write() in the userspace by either instrumenting the LibC or LD_PRELOAD wrapper and store the string buffer passed to write(). Can I call/generate *some other non-instrusive* syscall which can take that string buffer that I stored earlier and that syscall with the buffer will be visible in the audit.log? I am not worried about performance hit right now. On Thu, Apr 26, 2018 at 7:46 PM Casey Schaufler wrote: > On 4/26/2018 5:08 PM, Sargun Dhillon wrote: > > On Thu, Apr 26, 2018 at 4:40 PM, Casey Schaufler > wrote: > >> On 4/26/2018 3:57 PM, Steve Grubb wrote: > >>> On Thu, 26 Apr 2018 20:34:57 +0000 > >>> Wajih Ul Hassan wrote: > >>> > >>>> Hi all, > >>>> ..... > >> You could write a Linux Security Module (LSM) to monitor the > >> content of writes. The performance impact would be rather > >> amazing. > >> > > I would recommend using BPF + kprobes + perf_event buffers for this > > purpose. There are enough places you can probe to grab these strings > > in the kernel, and if you do your filtering in BPF, you can then push > > it into kernel space based on filtering. Although, AFAIK, the BPF JITs > > don't do vectorization of instructions, but it's still not too bad. If > > you put your kprobe on the syscall itself, and probe the userspace > > addr, remember you're going to be open to a time-of-use, time-of-check > > style attack. > > That looks like a whole lot of mechanism to perform a simple task. > > >