Extracting written string from the write syscall

Extracting written string from the write syscall

[Wajih Ul Hassan]

[-- Attachment #1.1: Type: text/plain, Size: 728 bytes --]

Hi all,
I am using Linux Audit module to monitor file accesses. However, I want to
extract what exactly was written to a specific file. I am catching the
events belonging to write syscall, for example:

type=SYSCALL msg=audit(04/26/2018 15:11:33.568:307907) : arch=x86_64
syscall=write success=yes exit=37 a0=0x3 a1=0x1aee240 a2=0x25 a3=0x477
items=0 ppid=11376 pid=26771 auid=wajih uid=wajih gid=wajih euid=wajih
suid=wajih fsuid=wajih egid=wajih sgid=wajih fsgid=wajih tty=pts1 ses=1
comm=a.out exe=/code/a.out key=(null)

I know the "a1" is the pointer to buffer being written; however, is there a
way I can take that pointer and extract the exact string? In the example
above I was writing "Hello world ...".

Thanks,
Wajih

[-- Attachment #1.2: Type: text/html, Size: 873 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Extracting written string from the write syscall

[Steve Grubb]

On Thu, 26 Apr 2018 20:34:57 +0000
Wajih Ul Hassan <wajih.lums@gmail.com> wrote:

> Hi all,
> I am using Linux Audit module to monitor file accesses. However, I
> want to extract what exactly was written to a specific file. I am
> catching the events belonging to write syscall, for example:
> 
> type=SYSCALL msg=audit(04/26/2018 15:11:33.568:307907) : arch=x86_64
> syscall=write success=yes exit=37 a0=0x3 a1=0x1aee240 a2=0x25 a3=0x477
> items=0 ppid=11376 pid=26771 auid=wajih uid=wajih gid=wajih euid=wajih
> suid=wajih fsuid=wajih egid=wajih sgid=wajih fsgid=wajih tty=pts1
> ses=1 comm=a.out exe=/code/a.out key=(null)
> 
> I know the "a1" is the pointer to buffer being written; however, is
> there a way I can take that pointer and extract the exact string? In
> the example above I was writing "Hello world ...".

Short answer is no. There is no way I know of to do that via the audit
system.

-Steve

Extracting written string from the write syscall

[Casey Schaufler]

On 4/26/2018 3:57 PM, Steve Grubb wrote:
> On Thu, 26 Apr 2018 20:34:57 +0000
> Wajih Ul Hassan <wajih.lums@gmail.com> wrote:
>
>> Hi all,
>> I am using Linux Audit module to monitor file accesses. However, I
>> want to extract what exactly was written to a specific file. I am
>> catching the events belonging to write syscall, for example:
>>
>> type=SYSCALL msg=audit(04/26/2018 15:11:33.568:307907) : arch=x86_64
>> syscall=write success=yes exit=37 a0=0x3 a1=0x1aee240 a2=0x25 a3=0x477
>> items=0 ppid=11376 pid=26771 auid=wajih uid=wajih gid=wajih euid=wajih
>> suid=wajih fsuid=wajih egid=wajih sgid=wajih fsgid=wajih tty=pts1
>> ses=1 comm=a.out exe=/code/a.out key=(null)
>>
>> I know the "a1" is the pointer to buffer being written; however, is
>> there a way I can take that pointer and extract the exact string? In
>> the example above I was writing "Hello world ...".
> Short answer is no. There is no way I know of to do that via the audit
> system.

You could write a Linux Security Module (LSM) to monitor the
content of writes. The performance impact would be rather
amazing. 

>
> -Steve
>
> --
> Linux-audit mailing list
> Linux-audit at redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
>

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: Extracting written string from the write syscall

[Casey Schaufler]

On 4/26/2018 3:57 PM, Steve Grubb wrote:
> On Thu, 26 Apr 2018 20:34:57 +0000
> Wajih Ul Hassan <wajih.lums@gmail.com> wrote:
>
>> Hi all,
>> I am using Linux Audit module to monitor file accesses. However, I
>> want to extract what exactly was written to a specific file. I am
>> catching the events belonging to write syscall, for example:
>>
>> type=SYSCALL msg=audit(04/26/2018 15:11:33.568:307907) : arch=x86_64
>> syscall=write success=yes exit=37 a0=0x3 a1=0x1aee240 a2=0x25 a3=0x477
>> items=0 ppid=11376 pid=26771 auid=wajih uid=wajih gid=wajih euid=wajih
>> suid=wajih fsuid=wajih egid=wajih sgid=wajih fsgid=wajih tty=pts1
>> ses=1 comm=a.out exe=/code/a.out key=(null)
>>
>> I know the "a1" is the pointer to buffer being written; however, is
>> there a way I can take that pointer and extract the exact string? In
>> the example above I was writing "Hello world ...".
> Short answer is no. There is no way I know of to do that via the audit
> system.

You could write a Linux Security Module (LSM) to monitor the
content of writes. The performance impact would be rather
amazing. 

>
> -Steve
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
>

Extracting written string from the write syscall

[Sargun Dhillon]

On Thu, Apr 26, 2018 at 4:40 PM, Casey Schaufler <casey@schaufler-ca.com> wrote:
> On 4/26/2018 3:57 PM, Steve Grubb wrote:
>> On Thu, 26 Apr 2018 20:34:57 +0000
>> Wajih Ul Hassan <wajih.lums@gmail.com> wrote:
>>
>>> Hi all,
>>> I am using Linux Audit module to monitor file accesses. However, I
>>> want to extract what exactly was written to a specific file. I am
>>> catching the events belonging to write syscall, for example:
>>>
>>> type=SYSCALL msg=audit(04/26/2018 15:11:33.568:307907) : arch=x86_64
>>> syscall=write success=yes exit=37 a0=0x3 a1=0x1aee240 a2=0x25 a3=0x477
>>> items=0 ppid=11376 pid=26771 auid=wajih uid=wajih gid=wajih euid=wajih
>>> suid=wajih fsuid=wajih egid=wajih sgid=wajih fsgid=wajih tty=pts1
>>> ses=1 comm=a.out exe=/code/a.out key=(null)
>>>
>>> I know the "a1" is the pointer to buffer being written; however, is
>>> there a way I can take that pointer and extract the exact string? In
>>> the example above I was writing "Hello world ...".
>> Short answer is no. There is no way I know of to do that via the audit
>> system.
>
> You could write a Linux Security Module (LSM) to monitor the
> content of writes. The performance impact would be rather
> amazing.
>
I would recommend using BPF + kprobes + perf_event buffers for this
purpose. There are enough places you can probe to grab these strings
in the kernel, and if you do your filtering in BPF, you can then push
it into kernel space based on filtering. Although, AFAIK, the BPF JITs
don't do vectorization of instructions, but it's still not too bad. If
you put your kprobe on the syscall itself, and probe the userspace
addr, remember you're going to be open to a time-of-use, time-of-check
style attack.


>>
>> -Steve
>>
>> --
>> Linux-audit mailing list
>> Linux-audit at redhat.com
>> https://www.redhat.com/mailman/listinfo/linux-audit
>>
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
> the body of a message to majordomo at vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: Extracting written string from the write syscall

[Sargun Dhillon]

On Thu, Apr 26, 2018 at 4:40 PM, Casey Schaufler <casey@schaufler-ca.com> wrote:
> On 4/26/2018 3:57 PM, Steve Grubb wrote:
>> On Thu, 26 Apr 2018 20:34:57 +0000
>> Wajih Ul Hassan <wajih.lums@gmail.com> wrote:
>>
>>> Hi all,
>>> I am using Linux Audit module to monitor file accesses. However, I
>>> want to extract what exactly was written to a specific file. I am
>>> catching the events belonging to write syscall, for example:
>>>
>>> type=SYSCALL msg=audit(04/26/2018 15:11:33.568:307907) : arch=x86_64
>>> syscall=write success=yes exit=37 a0=0x3 a1=0x1aee240 a2=0x25 a3=0x477
>>> items=0 ppid=11376 pid=26771 auid=wajih uid=wajih gid=wajih euid=wajih
>>> suid=wajih fsuid=wajih egid=wajih sgid=wajih fsgid=wajih tty=pts1
>>> ses=1 comm=a.out exe=/code/a.out key=(null)
>>>
>>> I know the "a1" is the pointer to buffer being written; however, is
>>> there a way I can take that pointer and extract the exact string? In
>>> the example above I was writing "Hello world ...".
>> Short answer is no. There is no way I know of to do that via the audit
>> system.
>
> You could write a Linux Security Module (LSM) to monitor the
> content of writes. The performance impact would be rather
> amazing.
>
I would recommend using BPF + kprobes + perf_event buffers for this
purpose. There are enough places you can probe to grab these strings
in the kernel, and if you do your filtering in BPF, you can then push
it into kernel space based on filtering. Although, AFAIK, the BPF JITs
don't do vectorization of instructions, but it's still not too bad. If
you put your kprobe on the syscall itself, and probe the userspace
addr, remember you're going to be open to a time-of-use, time-of-check
style attack.


>>
>> -Steve
>>
>> --
>> Linux-audit mailing list
>> Linux-audit@redhat.com
>> https://www.redhat.com/mailman/listinfo/linux-audit
>>
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Extracting written string from the write syscall

[Casey Schaufler]

On 4/26/2018 5:08 PM, Sargun Dhillon wrote:
> On Thu, Apr 26, 2018 at 4:40 PM, Casey Schaufler <casey@schaufler-ca.com> wrote:
>> On 4/26/2018 3:57 PM, Steve Grubb wrote:
>>> On Thu, 26 Apr 2018 20:34:57 +0000
>>> Wajih Ul Hassan <wajih.lums@gmail.com> wrote:
>>>
>>>> Hi all,
>>>>  .....
>> You could write a Linux Security Module (LSM) to monitor the
>> content of writes. The performance impact would be rather
>> amazing.
>>
> I would recommend using BPF + kprobes + perf_event buffers for this
> purpose. There are enough places you can probe to grab these strings
> in the kernel, and if you do your filtering in BPF, you can then push
> it into kernel space based on filtering. Although, AFAIK, the BPF JITs
> don't do vectorization of instructions, but it's still not too bad. If
> you put your kprobe on the syscall itself, and probe the userspace
> addr, remember you're going to be open to a time-of-use, time-of-check
> style attack.

That looks like a whole lot of mechanism to perform a simple task.


--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: Extracting written string from the write syscall

[Casey Schaufler]

On 4/26/2018 5:08 PM, Sargun Dhillon wrote:
> On Thu, Apr 26, 2018 at 4:40 PM, Casey Schaufler <casey@schaufler-ca.com> wrote:
>> On 4/26/2018 3:57 PM, Steve Grubb wrote:
>>> On Thu, 26 Apr 2018 20:34:57 +0000
>>> Wajih Ul Hassan <wajih.lums@gmail.com> wrote:
>>>
>>>> Hi all,
>>>>  .....
>> You could write a Linux Security Module (LSM) to monitor the
>> content of writes. The performance impact would be rather
>> amazing.
>>
> I would recommend using BPF + kprobes + perf_event buffers for this
> purpose. There are enough places you can probe to grab these strings
> in the kernel, and if you do your filtering in BPF, you can then push
> it into kernel space based on filtering. Although, AFAIK, the BPF JITs
> don't do vectorization of instructions, but it's still not too bad. If
> you put your kprobe on the syscall itself, and probe the userspace
> addr, remember you're going to be open to a time-of-use, time-of-check
> style attack.

That looks like a whole lot of mechanism to perform a simple task.

Re: Extracting written string from the write syscall

[Wajih Ul Hassan]

[-- Attachment #1.1: Type: text/plain, Size: 1601 bytes --]

Thanks for your replies. However, I am now thinking of another solution.
Let's say I can capture write() in the userspace by either instrumenting
the LibC or LD_PRELOAD wrapper and store the string buffer passed to
write().
Can I call/generate *some other non-instrusive* syscall which can take that
string buffer that I stored earlier and that syscall with the buffer will
be visible in the audit.log? I am not worried about performance hit right
now.


On Thu, Apr 26, 2018 at 7:46 PM Casey Schaufler <casey@schaufler-ca.com>
wrote:

> On 4/26/2018 5:08 PM, Sargun Dhillon wrote:
> > On Thu, Apr 26, 2018 at 4:40 PM, Casey Schaufler <casey@schaufler-ca.com>
> wrote:
> >> On 4/26/2018 3:57 PM, Steve Grubb wrote:
> >>> On Thu, 26 Apr 2018 20:34:57 +0000
> >>> Wajih Ul Hassan <wajih.lums@gmail.com> wrote:
> >>>
> >>>> Hi all,
> >>>>  .....
> >> You could write a Linux Security Module (LSM) to monitor the
> >> content of writes. The performance impact would be rather
> >> amazing.
> >>
> > I would recommend using BPF + kprobes + perf_event buffers for this
> > purpose. There are enough places you can probe to grab these strings
> > in the kernel, and if you do your filtering in BPF, you can then push
> > it into kernel space based on filtering. Although, AFAIK, the BPF JITs
> > don't do vectorization of instructions, but it's still not too bad. If
> > you put your kprobe on the syscall itself, and probe the userspace
> > addr, remember you're going to be open to a time-of-use, time-of-check
> > style attack.
>
> That looks like a whole lot of mechanism to perform a simple task.
>
>
>

[-- Attachment #1.2: Type: text/html, Size: 2198 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Extracting written string from the write syscall

[Casey Schaufler]

[-- Attachment #1.1: Type: text/plain, Size: 1901 bytes --]

On 4/26/2018 7:37 PM, Wajih Ul Hassan wrote:
> Thanks for your replies. However, I am now thinking of another solution.
> Let's say I can capture write() in the userspace by either instrumenting the LibC or LD_PRELOAD wrapper and store the string buffer passed to write().
> Can I call/generate *some other non-instrusive* syscall which can take that string buffer that I stored earlier and that syscall with the buffer will be visible in the audit.log? I am not worried about performance hit right now.

I'm not 100% sure, but you might be able to do this with LandLock.

>
> On Thu, Apr 26, 2018 at 7:46 PM Casey Schaufler <casey@schaufler-ca.com <mailto:casey@schaufler-ca.com>> wrote:
>
>     On 4/26/2018 5:08 PM, Sargun Dhillon wrote:
>     > On Thu, Apr 26, 2018 at 4:40 PM, Casey Schaufler <casey@schaufler-ca.com <mailto:casey@schaufler-ca.com>> wrote:
>     >> On 4/26/2018 3:57 PM, Steve Grubb wrote:
>     >>> On Thu, 26 Apr 2018 20:34:57 +0000
>     >>> Wajih Ul Hassan <wajih.lums@gmail.com <mailto:wajih.lums@gmail.com>> wrote:
>     >>>
>     >>>> Hi all,
>     >>>>  .....
>     >> You could write a Linux Security Module (LSM) to monitor the
>     >> content of writes. The performance impact would be rather
>     >> amazing.
>     >>
>     > I would recommend using BPF + kprobes + perf_event buffers for this
>     > purpose. There are enough places you can probe to grab these strings
>     > in the kernel, and if you do your filtering in BPF, you can then push
>     > it into kernel space based on filtering. Although, AFAIK, the BPF JITs
>     > don't do vectorization of instructions, but it's still not too bad. If
>     > you put your kprobe on the syscall itself, and probe the userspace
>     > addr, remember you're going to be open to a time-of-use, time-of-check
>     > style attack.
>
>     That looks like a whole lot of mechanism to perform a simple task.
>
>


[-- Attachment #1.2: Type: text/html, Size: 3338 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Extracting written string from the write syscall

[Richard Guy Briggs]

On 2018-04-27 02:37, Wajih Ul Hassan wrote:
> Thanks for your replies. However, I am now thinking of another solution.
> Let's say I can capture write() in the userspace by either instrumenting
> the LibC or LD_PRELOAD wrapper and store the string buffer passed to
> write().
> Can I call/generate *some other non-instrusive* syscall which can take that
> string buffer that I stored earlier and that syscall with the buffer will
> be visible in the audit.log? I am not worried about performance hit right
> now.

Use an AUDIT_USER message with the text and some identifier that links
it with a particular write call?

> On Thu, Apr 26, 2018 at 7:46 PM Casey Schaufler <casey@schaufler-ca.com> wrote:
> > On 4/26/2018 5:08 PM, Sargun Dhillon wrote:
> > > On Thu, Apr 26, 2018 at 4:40 PM, Casey Schaufler <casey@schaufler-ca.com>
> > wrote:
> > >> On 4/26/2018 3:57 PM, Steve Grubb wrote:
> > >>> On Thu, 26 Apr 2018 20:34:57 +0000
> > >>> Wajih Ul Hassan <wajih.lums@gmail.com> wrote:
> > >>>
> > >>>> Hi all,
> > >>>>  .....
> > >> You could write a Linux Security Module (LSM) to monitor the
> > >> content of writes. The performance impact would be rather
> > >> amazing.
> > >>
> > > I would recommend using BPF + kprobes + perf_event buffers for this
> > > purpose. There are enough places you can probe to grab these strings
> > > in the kernel, and if you do your filtering in BPF, you can then push
> > > it into kernel space based on filtering. Although, AFAIK, the BPF JITs
> > > don't do vectorization of instructions, but it's still not too bad. If
> > > you put your kprobe on the syscall itself, and probe the userspace
> > > addr, remember you're going to be open to a time-of-use, time-of-check
> > > style attack.
> >
> > That looks like a whole lot of mechanism to perform a simple task.

- RGB

--
Richard Guy Briggs <rgb@redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: Extracting written string from the write syscall

[Richard Guy Briggs]

On 2018-04-27 02:37, Wajih Ul Hassan wrote:
> Thanks for your replies. However, I am now thinking of another solution.
> Let's say I can capture write() in the userspace by either instrumenting
> the LibC or LD_PRELOAD wrapper and store the string buffer passed to
> write().
> Can I call/generate *some other non-instrusive* syscall which can take that
> string buffer that I stored earlier and that syscall with the buffer will
> be visible in the audit.log? I am not worried about performance hit right
> now.

Use an AUDIT_USER message with the text and some identifier that links
it with a particular write call?

> On Thu, Apr 26, 2018 at 7:46 PM Casey Schaufler <casey@schaufler-ca.com> wrote:
> > On 4/26/2018 5:08 PM, Sargun Dhillon wrote:
> > > On Thu, Apr 26, 2018 at 4:40 PM, Casey Schaufler <casey@schaufler-ca.com>
> > wrote:
> > >> On 4/26/2018 3:57 PM, Steve Grubb wrote:
> > >>> On Thu, 26 Apr 2018 20:34:57 +0000
> > >>> Wajih Ul Hassan <wajih.lums@gmail.com> wrote:
> > >>>
> > >>>> Hi all,
> > >>>>  .....
> > >> You could write a Linux Security Module (LSM) to monitor the
> > >> content of writes. The performance impact would be rather
> > >> amazing.
> > >>
> > > I would recommend using BPF + kprobes + perf_event buffers for this
> > > purpose. There are enough places you can probe to grab these strings
> > > in the kernel, and if you do your filtering in BPF, you can then push
> > > it into kernel space based on filtering. Although, AFAIK, the BPF JITs
> > > don't do vectorization of instructions, but it's still not too bad. If
> > > you put your kprobe on the syscall itself, and probe the userspace
> > > addr, remember you're going to be open to a time-of-use, time-of-check
> > > style attack.
> >
> > That looks like a whole lot of mechanism to perform a simple task.

- RGB

--
Richard Guy Briggs <rgb@redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635