From mboxrd@z Thu Jan  1 00:00:00 1970
From: Wajih Ul Hassan <wajih.lums@gmail.com>
Subject: Extracting written string from the write syscall
Date: Thu, 26 Apr 2018 20:34:57 +0000
Message-ID: <CAH5sRbr_-nHPb8moqPyZ--JVOzGi+_PHVVteA+TXe-Yqaoa5xA@mail.gmail.com>
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="===============6921847518590494082=="
Return-path: <linux-audit-bounces@redhat.com>
Received: from mx1.redhat.com (ext-mx18.extmail.prod.ext.phx2.redhat.com
	[10.5.110.47])
	by smtp.corp.redhat.com (Postfix) with ESMTPS id E035218E20
	for <linux-audit@redhat.com>; Thu, 26 Apr 2018 20:35:19 +0000 (UTC)
Received: from mail-it0-f46.google.com (mail-it0-f46.google.com
	[209.85.214.46])
	(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
	(No client certificate requested)
	by mx1.redhat.com (Postfix) with ESMTPS id 1D2CB30BB7D0
	for <linux-audit@redhat.com>; Thu, 26 Apr 2018 20:35:09 +0000 (UTC)
Received: by mail-it0-f46.google.com with SMTP id 144-v6so12005iti.5
	for <linux-audit@redhat.com>; Thu, 26 Apr 2018 13:35:09 -0700 (PDT)
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: "linux-audit@redhat.com" <linux-audit@redhat.com>
List-Id: linux-audit@redhat.com

--===============6921847518590494082==
Content-Type: multipart/alternative; boundary="000000000000c02f9f056ac652da"

--000000000000c02f9f056ac652da
Content-Type: text/plain; charset="UTF-8"

Hi all,
I am using Linux Audit module to monitor file accesses. However, I want to
extract what exactly was written to a specific file. I am catching the
events belonging to write syscall, for example:

type=SYSCALL msg=audit(04/26/2018 15:11:33.568:307907) : arch=x86_64
syscall=write success=yes exit=37 a0=0x3 a1=0x1aee240 a2=0x25 a3=0x477
items=0 ppid=11376 pid=26771 auid=wajih uid=wajih gid=wajih euid=wajih
suid=wajih fsuid=wajih egid=wajih sgid=wajih fsgid=wajih tty=pts1 ses=1
comm=a.out exe=/code/a.out key=(null)

I know the "a1" is the pointer to buffer being written; however, is there a
way I can take that pointer and extract the exact string? In the example
above I was writing "Hello world ...".

Thanks,
Wajih

--000000000000c02f9f056ac652da
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi all,<div>I am using Linux Audit module to monitor file =
accesses. However, I want to extract what exactly was written to a specific=
 file. I am catching the events belonging to write syscall, for example:</d=
iv><div><div><br></div><div>type=3DSYSCALL msg=3Daudit(04/26/2018 15:11:33.=
568:307907) : arch=3Dx86_64 syscall=3Dwrite success=3Dyes exit=3D37 a0=3D0x=
3 a1=3D0x1aee240 a2=3D0x25 a3=3D0x477 items=3D0 ppid=3D11376 pid=3D26771 au=
id=3Dwajih uid=3Dwajih gid=3Dwajih euid=3Dwajih suid=3Dwajih fsuid=3Dwajih =
egid=3Dwajih sgid=3Dwajih fsgid=3Dwajih tty=3Dpts1 ses=3D1 comm=3Da.out exe=
=3D/code/a.out key=3D(null)</div></div><div><br></div><div>I know the &quot=
;a1&quot; is the pointer to buffer being written; however, is there a way I=
 can take that pointer and extract the exact string? In the example above I=
 was writing &quot;Hello world ...&quot;.</div><div><br></div><div>Thanks,<=
/div><div>Wajih</div></div>

--000000000000c02f9f056ac652da--


--===============6921847518590494082==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============6921847518590494082==--