Logging from within kernel

Logging from within kernel

[Ranran]

Hello,

Is it possible to log all messages from within kernel, (without any
userspace application and daemon) ?

Thank you,
Ran

Re: Logging from within kernel

[Richard Guy Briggs]

On 2018-11-24 01:47, Ranran wrote:
> Hello,
> 
> Is it possible to log all messages from within kernel, (without any
> userspace application and daemon) ?

No.  The log messages leave the kernel via the audit netlink socket and
get consumed by a userspace process.

There is no facility to write it directly to disk in the kernel if that
is what you are asking.

> Ran

- RGB

--
Richard Guy Briggs <rgb@redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635

Re: Logging from within kernel

[Paul Moore]

On Fri, Nov 23, 2018 at 6:47 PM Ranran <ranshalit@gmail.com> wrote:
> Hello,
>
> Is it possible to log all messages from within kernel, (without any
> userspace application and daemon) ?

If you are not running an audit daemon then the audit records will be
written to kernel's ring buffer (look for them in dmesg).  This is not
really considered ideal (e.g. one drawback is that the output is rate
limited), but it can be attractive for small systems with a limited
number of audit events; last I checked this is the approach used by
Android.

If you want to configure the audit subsystem beyond the "audit=1/0" on
the kernel command line, or whatever systemd is doing these days, you
will need to use auditctl (or a similar tool).  Unfortunately the
in-kernel audit subsystem does a number of really awful things when it
comes to the netlink interface so that generic netlink tools can not
be used to configure the audit subsystem, you must use an audit
specific tool.

-- 
paul moore
www.paul-moore.com

Re: Logging from within kernel

[William Roberts]

On Mon, Nov 26, 2018 at 8:48 AM Paul Moore <paul@paul-moore.com> wrote:
>
> On Fri, Nov 23, 2018 at 6:47 PM Ranran <ranshalit@gmail.com> wrote:
> > Hello,
> >
> > Is it possible to log all messages from within kernel, (without any
> > userspace application and daemon) ?
>
> If you are not running an audit daemon then the audit records will be
> written to kernel's ring buffer (look for them in dmesg).  This is not
> really considered ideal (e.g. one drawback is that the output is rate
> limited), but it can be attractive for small systems with a limited
> number of audit events; last I checked this is the approach used by
> Android.

Not since the official merge into mainline. I wrote a libaudit port
and Android's
logd system uses it. It pulls them up from audit into userspace, does some stuff
and send them out to log cat and back down to dmesg (I have no idea why).

It also does things like make sure any denials seen are tracked by a
bug and outputs
the bug information in the log.

If you have the AOSP tree checked out, you can see it:
system/core/logd/LogAudit.cpp

>
> If you want to configure the audit subsystem beyond the "audit=1/0" on
> the kernel command line, or whatever systemd is doing these days, you
> will need to use auditctl (or a similar tool).  Unfortunately the
> in-kernel audit subsystem does a number of really awful things when it
> comes to the netlink interface so that generic netlink tools can not
> be used to configure the audit subsystem, you must use an audit
> specific tool.
>
> --
> paul moore
> www.paul-moore.com
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

Re: Logging from within kernel

[Paul Moore]

On Mon, Nov 26, 2018 at 12:06 PM William Roberts
<bill.c.roberts@gmail.com> wrote:
> On Mon, Nov 26, 2018 at 8:48 AM Paul Moore <paul@paul-moore.com> wrote:
> > On Fri, Nov 23, 2018 at 6:47 PM Ranran <ranshalit@gmail.com> wrote:
> > > Hello,
> > >
> > > Is it possible to log all messages from within kernel, (without any
> > > userspace application and daemon) ?
> >
> > If you are not running an audit daemon then the audit records will be
> > written to kernel's ring buffer (look for them in dmesg).  This is not
> > really considered ideal (e.g. one drawback is that the output is rate
> > limited), but it can be attractive for small systems with a limited
> > number of audit events; last I checked this is the approach used by
> > Android.
>
> Not since the official merge into mainline. I wrote a libaudit port
> and Android's logd system uses it ...

Good to know, thanks!

-- 
paul moore
www.paul-moore.com