* Extracting written string from the write syscall @ 2018-04-26 20:34 Wajih Ul Hassan 2018-04-26 22:57 ` Steve Grubb 0 siblings, 1 reply; 12+ messages in thread From: Wajih Ul Hassan @ 2018-04-26 20:34 UTC (permalink / raw) To: linux-audit [-- Attachment #1.1: Type: text/plain, Size: 728 bytes --] Hi all, I am using Linux Audit module to monitor file accesses. However, I want to extract what exactly was written to a specific file. I am catching the events belonging to write syscall, for example: type=SYSCALL msg=audit(04/26/2018 15:11:33.568:307907) : arch=x86_64 syscall=write success=yes exit=37 a0=0x3 a1=0x1aee240 a2=0x25 a3=0x477 items=0 ppid=11376 pid=26771 auid=wajih uid=wajih gid=wajih euid=wajih suid=wajih fsuid=wajih egid=wajih sgid=wajih fsgid=wajih tty=pts1 ses=1 comm=a.out exe=/code/a.out key=(null) I know the "a1" is the pointer to buffer being written; however, is there a way I can take that pointer and extract the exact string? In the example above I was writing "Hello world ...". Thanks, Wajih [-- Attachment #1.2: Type: text/html, Size: 873 bytes --] [-- Attachment #2: Type: text/plain, Size: 0 bytes --] ^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: Extracting written string from the write syscall 2018-04-26 20:34 Extracting written string from the write syscall Wajih Ul Hassan @ 2018-04-26 22:57 ` Steve Grubb 2018-04-26 23:40 ` Casey Schaufler 0 siblings, 1 reply; 12+ messages in thread From: Steve Grubb @ 2018-04-26 22:57 UTC (permalink / raw) To: Wajih Ul Hassan; +Cc: linux-audit On Thu, 26 Apr 2018 20:34:57 +0000 Wajih Ul Hassan <wajih.lums@gmail.com> wrote: > Hi all, > I am using Linux Audit module to monitor file accesses. However, I > want to extract what exactly was written to a specific file. I am > catching the events belonging to write syscall, for example: > > type=SYSCALL msg=audit(04/26/2018 15:11:33.568:307907) : arch=x86_64 > syscall=write success=yes exit=37 a0=0x3 a1=0x1aee240 a2=0x25 a3=0x477 > items=0 ppid=11376 pid=26771 auid=wajih uid=wajih gid=wajih euid=wajih > suid=wajih fsuid=wajih egid=wajih sgid=wajih fsgid=wajih tty=pts1 > ses=1 comm=a.out exe=/code/a.out key=(null) > > I know the "a1" is the pointer to buffer being written; however, is > there a way I can take that pointer and extract the exact string? In > the example above I was writing "Hello world ...". Short answer is no. There is no way I know of to do that via the audit system. -Steve ^ permalink raw reply [flat|nested] 12+ messages in thread
* Extracting written string from the write syscall 2018-04-26 22:57 ` Steve Grubb @ 2018-04-26 23:40 ` Casey Schaufler 0 siblings, 0 replies; 12+ messages in thread From: Casey Schaufler @ 2018-04-26 23:40 UTC (permalink / raw) To: linux-security-module On 4/26/2018 3:57 PM, Steve Grubb wrote: > On Thu, 26 Apr 2018 20:34:57 +0000 > Wajih Ul Hassan <wajih.lums@gmail.com> wrote: > >> Hi all, >> I am using Linux Audit module to monitor file accesses. However, I >> want to extract what exactly was written to a specific file. I am >> catching the events belonging to write syscall, for example: >> >> type=SYSCALL msg=audit(04/26/2018 15:11:33.568:307907) : arch=x86_64 >> syscall=write success=yes exit=37 a0=0x3 a1=0x1aee240 a2=0x25 a3=0x477 >> items=0 ppid=11376 pid=26771 auid=wajih uid=wajih gid=wajih euid=wajih >> suid=wajih fsuid=wajih egid=wajih sgid=wajih fsgid=wajih tty=pts1 >> ses=1 comm=a.out exe=/code/a.out key=(null) >> >> I know the "a1" is the pointer to buffer being written; however, is >> there a way I can take that pointer and extract the exact string? In >> the example above I was writing "Hello world ...". > Short answer is no. There is no way I know of to do that via the audit > system. You could write a Linux Security Module (LSM) to monitor the content of writes. The performance impact would be rather amazing. > > -Steve > > -- > Linux-audit mailing list > Linux-audit at redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit > -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: Extracting written string from the write syscall @ 2018-04-26 23:40 ` Casey Schaufler 0 siblings, 0 replies; 12+ messages in thread From: Casey Schaufler @ 2018-04-26 23:40 UTC (permalink / raw) To: Steve Grubb, Wajih Ul Hassan; +Cc: LSM, linux-audit On 4/26/2018 3:57 PM, Steve Grubb wrote: > On Thu, 26 Apr 2018 20:34:57 +0000 > Wajih Ul Hassan <wajih.lums@gmail.com> wrote: > >> Hi all, >> I am using Linux Audit module to monitor file accesses. However, I >> want to extract what exactly was written to a specific file. I am >> catching the events belonging to write syscall, for example: >> >> type=SYSCALL msg=audit(04/26/2018 15:11:33.568:307907) : arch=x86_64 >> syscall=write success=yes exit=37 a0=0x3 a1=0x1aee240 a2=0x25 a3=0x477 >> items=0 ppid=11376 pid=26771 auid=wajih uid=wajih gid=wajih euid=wajih >> suid=wajih fsuid=wajih egid=wajih sgid=wajih fsgid=wajih tty=pts1 >> ses=1 comm=a.out exe=/code/a.out key=(null) >> >> I know the "a1" is the pointer to buffer being written; however, is >> there a way I can take that pointer and extract the exact string? In >> the example above I was writing "Hello world ...". > Short answer is no. There is no way I know of to do that via the audit > system. You could write a Linux Security Module (LSM) to monitor the content of writes. The performance impact would be rather amazing. > > -Steve > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit > ^ permalink raw reply [flat|nested] 12+ messages in thread
* Extracting written string from the write syscall 2018-04-26 23:40 ` Casey Schaufler @ 2018-04-27 0:08 ` Sargun Dhillon -1 siblings, 0 replies; 12+ messages in thread From: Sargun Dhillon @ 2018-04-27 0:08 UTC (permalink / raw) To: linux-security-module On Thu, Apr 26, 2018 at 4:40 PM, Casey Schaufler <casey@schaufler-ca.com> wrote: > On 4/26/2018 3:57 PM, Steve Grubb wrote: >> On Thu, 26 Apr 2018 20:34:57 +0000 >> Wajih Ul Hassan <wajih.lums@gmail.com> wrote: >> >>> Hi all, >>> I am using Linux Audit module to monitor file accesses. However, I >>> want to extract what exactly was written to a specific file. I am >>> catching the events belonging to write syscall, for example: >>> >>> type=SYSCALL msg=audit(04/26/2018 15:11:33.568:307907) : arch=x86_64 >>> syscall=write success=yes exit=37 a0=0x3 a1=0x1aee240 a2=0x25 a3=0x477 >>> items=0 ppid=11376 pid=26771 auid=wajih uid=wajih gid=wajih euid=wajih >>> suid=wajih fsuid=wajih egid=wajih sgid=wajih fsgid=wajih tty=pts1 >>> ses=1 comm=a.out exe=/code/a.out key=(null) >>> >>> I know the "a1" is the pointer to buffer being written; however, is >>> there a way I can take that pointer and extract the exact string? In >>> the example above I was writing "Hello world ...". >> Short answer is no. There is no way I know of to do that via the audit >> system. > > You could write a Linux Security Module (LSM) to monitor the > content of writes. The performance impact would be rather > amazing. > I would recommend using BPF + kprobes + perf_event buffers for this purpose. There are enough places you can probe to grab these strings in the kernel, and if you do your filtering in BPF, you can then push it into kernel space based on filtering. Although, AFAIK, the BPF JITs don't do vectorization of instructions, but it's still not too bad. If you put your kprobe on the syscall itself, and probe the userspace addr, remember you're going to be open to a time-of-use, time-of-check style attack. >> >> -Steve >> >> -- >> Linux-audit mailing list >> Linux-audit at redhat.com >> https://www.redhat.com/mailman/listinfo/linux-audit >> > > -- > To unsubscribe from this list: send the line "unsubscribe linux-security-module" in > the body of a message to majordomo at vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: Extracting written string from the write syscall @ 2018-04-27 0:08 ` Sargun Dhillon 0 siblings, 0 replies; 12+ messages in thread From: Sargun Dhillon @ 2018-04-27 0:08 UTC (permalink / raw) To: Casey Schaufler; +Cc: linux-audit, LSM, Wajih Ul Hassan On Thu, Apr 26, 2018 at 4:40 PM, Casey Schaufler <casey@schaufler-ca.com> wrote: > On 4/26/2018 3:57 PM, Steve Grubb wrote: >> On Thu, 26 Apr 2018 20:34:57 +0000 >> Wajih Ul Hassan <wajih.lums@gmail.com> wrote: >> >>> Hi all, >>> I am using Linux Audit module to monitor file accesses. However, I >>> want to extract what exactly was written to a specific file. I am >>> catching the events belonging to write syscall, for example: >>> >>> type=SYSCALL msg=audit(04/26/2018 15:11:33.568:307907) : arch=x86_64 >>> syscall=write success=yes exit=37 a0=0x3 a1=0x1aee240 a2=0x25 a3=0x477 >>> items=0 ppid=11376 pid=26771 auid=wajih uid=wajih gid=wajih euid=wajih >>> suid=wajih fsuid=wajih egid=wajih sgid=wajih fsgid=wajih tty=pts1 >>> ses=1 comm=a.out exe=/code/a.out key=(null) >>> >>> I know the "a1" is the pointer to buffer being written; however, is >>> there a way I can take that pointer and extract the exact string? In >>> the example above I was writing "Hello world ...". >> Short answer is no. There is no way I know of to do that via the audit >> system. > > You could write a Linux Security Module (LSM) to monitor the > content of writes. The performance impact would be rather > amazing. > I would recommend using BPF + kprobes + perf_event buffers for this purpose. There are enough places you can probe to grab these strings in the kernel, and if you do your filtering in BPF, you can then push it into kernel space based on filtering. Although, AFAIK, the BPF JITs don't do vectorization of instructions, but it's still not too bad. If you put your kprobe on the syscall itself, and probe the userspace addr, remember you're going to be open to a time-of-use, time-of-check style attack. >> >> -Steve >> >> -- >> Linux-audit mailing list >> Linux-audit@redhat.com >> https://www.redhat.com/mailman/listinfo/linux-audit >> > > -- > To unsubscribe from this list: send the line "unsubscribe linux-security-module" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply [flat|nested] 12+ messages in thread
* Extracting written string from the write syscall 2018-04-27 0:08 ` Sargun Dhillon @ 2018-04-27 0:46 ` Casey Schaufler -1 siblings, 0 replies; 12+ messages in thread From: Casey Schaufler @ 2018-04-27 0:46 UTC (permalink / raw) To: linux-security-module On 4/26/2018 5:08 PM, Sargun Dhillon wrote: > On Thu, Apr 26, 2018 at 4:40 PM, Casey Schaufler <casey@schaufler-ca.com> wrote: >> On 4/26/2018 3:57 PM, Steve Grubb wrote: >>> On Thu, 26 Apr 2018 20:34:57 +0000 >>> Wajih Ul Hassan <wajih.lums@gmail.com> wrote: >>> >>>> Hi all, >>>> ..... >> You could write a Linux Security Module (LSM) to monitor the >> content of writes. The performance impact would be rather >> amazing. >> > I would recommend using BPF + kprobes + perf_event buffers for this > purpose. There are enough places you can probe to grab these strings > in the kernel, and if you do your filtering in BPF, you can then push > it into kernel space based on filtering. Although, AFAIK, the BPF JITs > don't do vectorization of instructions, but it's still not too bad. If > you put your kprobe on the syscall itself, and probe the userspace > addr, remember you're going to be open to a time-of-use, time-of-check > style attack. That looks like a whole lot of mechanism to perform a simple task. -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: Extracting written string from the write syscall @ 2018-04-27 0:46 ` Casey Schaufler 0 siblings, 0 replies; 12+ messages in thread From: Casey Schaufler @ 2018-04-27 0:46 UTC (permalink / raw) To: Sargun Dhillon; +Cc: linux-audit, LSM, Wajih Ul Hassan On 4/26/2018 5:08 PM, Sargun Dhillon wrote: > On Thu, Apr 26, 2018 at 4:40 PM, Casey Schaufler <casey@schaufler-ca.com> wrote: >> On 4/26/2018 3:57 PM, Steve Grubb wrote: >>> On Thu, 26 Apr 2018 20:34:57 +0000 >>> Wajih Ul Hassan <wajih.lums@gmail.com> wrote: >>> >>>> Hi all, >>>> ..... >> You could write a Linux Security Module (LSM) to monitor the >> content of writes. The performance impact would be rather >> amazing. >> > I would recommend using BPF + kprobes + perf_event buffers for this > purpose. There are enough places you can probe to grab these strings > in the kernel, and if you do your filtering in BPF, you can then push > it into kernel space based on filtering. Although, AFAIK, the BPF JITs > don't do vectorization of instructions, but it's still not too bad. If > you put your kprobe on the syscall itself, and probe the userspace > addr, remember you're going to be open to a time-of-use, time-of-check > style attack. That looks like a whole lot of mechanism to perform a simple task. ^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: Extracting written string from the write syscall 2018-04-27 0:46 ` Casey Schaufler (?) @ 2018-04-27 2:37 ` Wajih Ul Hassan 2018-04-27 15:35 ` Casey Schaufler 2018-04-27 18:21 ` Richard Guy Briggs -1 siblings, 2 replies; 12+ messages in thread From: Wajih Ul Hassan @ 2018-04-27 2:37 UTC (permalink / raw) To: Casey Schaufler; +Cc: Sargun Dhillon, LSM, linux-audit [-- Attachment #1.1: Type: text/plain, Size: 1601 bytes --] Thanks for your replies. However, I am now thinking of another solution. Let's say I can capture write() in the userspace by either instrumenting the LibC or LD_PRELOAD wrapper and store the string buffer passed to write(). Can I call/generate *some other non-instrusive* syscall which can take that string buffer that I stored earlier and that syscall with the buffer will be visible in the audit.log? I am not worried about performance hit right now. On Thu, Apr 26, 2018 at 7:46 PM Casey Schaufler <casey@schaufler-ca.com> wrote: > On 4/26/2018 5:08 PM, Sargun Dhillon wrote: > > On Thu, Apr 26, 2018 at 4:40 PM, Casey Schaufler <casey@schaufler-ca.com> > wrote: > >> On 4/26/2018 3:57 PM, Steve Grubb wrote: > >>> On Thu, 26 Apr 2018 20:34:57 +0000 > >>> Wajih Ul Hassan <wajih.lums@gmail.com> wrote: > >>> > >>>> Hi all, > >>>> ..... > >> You could write a Linux Security Module (LSM) to monitor the > >> content of writes. The performance impact would be rather > >> amazing. > >> > > I would recommend using BPF + kprobes + perf_event buffers for this > > purpose. There are enough places you can probe to grab these strings > > in the kernel, and if you do your filtering in BPF, you can then push > > it into kernel space based on filtering. Although, AFAIK, the BPF JITs > > don't do vectorization of instructions, but it's still not too bad. If > > you put your kprobe on the syscall itself, and probe the userspace > > addr, remember you're going to be open to a time-of-use, time-of-check > > style attack. > > That looks like a whole lot of mechanism to perform a simple task. > > > [-- Attachment #1.2: Type: text/html, Size: 2198 bytes --] [-- Attachment #2: Type: text/plain, Size: 0 bytes --] ^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: Extracting written string from the write syscall 2018-04-27 2:37 ` Wajih Ul Hassan @ 2018-04-27 15:35 ` Casey Schaufler 2018-04-27 18:21 ` Richard Guy Briggs 1 sibling, 0 replies; 12+ messages in thread From: Casey Schaufler @ 2018-04-27 15:35 UTC (permalink / raw) To: Wajih Ul Hassan; +Cc: Sargun Dhillon, LSM, linux-audit [-- Attachment #1.1: Type: text/plain, Size: 1901 bytes --] On 4/26/2018 7:37 PM, Wajih Ul Hassan wrote: > Thanks for your replies. However, I am now thinking of another solution. > Let's say I can capture write() in the userspace by either instrumenting the LibC or LD_PRELOAD wrapper and store the string buffer passed to write(). > Can I call/generate *some other non-instrusive* syscall which can take that string buffer that I stored earlier and that syscall with the buffer will be visible in the audit.log? I am not worried about performance hit right now. I'm not 100% sure, but you might be able to do this with LandLock. > > On Thu, Apr 26, 2018 at 7:46 PM Casey Schaufler <casey@schaufler-ca.com <mailto:casey@schaufler-ca.com>> wrote: > > On 4/26/2018 5:08 PM, Sargun Dhillon wrote: > > On Thu, Apr 26, 2018 at 4:40 PM, Casey Schaufler <casey@schaufler-ca.com <mailto:casey@schaufler-ca.com>> wrote: > >> On 4/26/2018 3:57 PM, Steve Grubb wrote: > >>> On Thu, 26 Apr 2018 20:34:57 +0000 > >>> Wajih Ul Hassan <wajih.lums@gmail.com <mailto:wajih.lums@gmail.com>> wrote: > >>> > >>>> Hi all, > >>>> ..... > >> You could write a Linux Security Module (LSM) to monitor the > >> content of writes. The performance impact would be rather > >> amazing. > >> > > I would recommend using BPF + kprobes + perf_event buffers for this > > purpose. There are enough places you can probe to grab these strings > > in the kernel, and if you do your filtering in BPF, you can then push > > it into kernel space based on filtering. Although, AFAIK, the BPF JITs > > don't do vectorization of instructions, but it's still not too bad. If > > you put your kprobe on the syscall itself, and probe the userspace > > addr, remember you're going to be open to a time-of-use, time-of-check > > style attack. > > That looks like a whole lot of mechanism to perform a simple task. > > [-- Attachment #1.2: Type: text/html, Size: 3338 bytes --] [-- Attachment #2: Type: text/plain, Size: 0 bytes --] ^ permalink raw reply [flat|nested] 12+ messages in thread
* Extracting written string from the write syscall 2018-04-27 2:37 ` Wajih Ul Hassan @ 2018-04-27 18:21 ` Richard Guy Briggs 2018-04-27 18:21 ` Richard Guy Briggs 1 sibling, 0 replies; 12+ messages in thread From: Richard Guy Briggs @ 2018-04-27 18:21 UTC (permalink / raw) To: linux-security-module On 2018-04-27 02:37, Wajih Ul Hassan wrote: > Thanks for your replies. However, I am now thinking of another solution. > Let's say I can capture write() in the userspace by either instrumenting > the LibC or LD_PRELOAD wrapper and store the string buffer passed to > write(). > Can I call/generate *some other non-instrusive* syscall which can take that > string buffer that I stored earlier and that syscall with the buffer will > be visible in the audit.log? I am not worried about performance hit right > now. Use an AUDIT_USER message with the text and some identifier that links it with a particular write call? > On Thu, Apr 26, 2018 at 7:46 PM Casey Schaufler <casey@schaufler-ca.com> wrote: > > On 4/26/2018 5:08 PM, Sargun Dhillon wrote: > > > On Thu, Apr 26, 2018 at 4:40 PM, Casey Schaufler <casey@schaufler-ca.com> > > wrote: > > >> On 4/26/2018 3:57 PM, Steve Grubb wrote: > > >>> On Thu, 26 Apr 2018 20:34:57 +0000 > > >>> Wajih Ul Hassan <wajih.lums@gmail.com> wrote: > > >>> > > >>>> Hi all, > > >>>> ..... > > >> You could write a Linux Security Module (LSM) to monitor the > > >> content of writes. The performance impact would be rather > > >> amazing. > > >> > > > I would recommend using BPF + kprobes + perf_event buffers for this > > > purpose. There are enough places you can probe to grab these strings > > > in the kernel, and if you do your filtering in BPF, you can then push > > > it into kernel space based on filtering. Although, AFAIK, the BPF JITs > > > don't do vectorization of instructions, but it's still not too bad. If > > > you put your kprobe on the syscall itself, and probe the userspace > > > addr, remember you're going to be open to a time-of-use, time-of-check > > > style attack. > > > > That looks like a whole lot of mechanism to perform a simple task. - RGB -- Richard Guy Briggs <rgb@redhat.com> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635 -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: Extracting written string from the write syscall @ 2018-04-27 18:21 ` Richard Guy Briggs 0 siblings, 0 replies; 12+ messages in thread From: Richard Guy Briggs @ 2018-04-27 18:21 UTC (permalink / raw) To: Wajih Ul Hassan; +Cc: Sargun Dhillon, LSM, linux-audit On 2018-04-27 02:37, Wajih Ul Hassan wrote: > Thanks for your replies. However, I am now thinking of another solution. > Let's say I can capture write() in the userspace by either instrumenting > the LibC or LD_PRELOAD wrapper and store the string buffer passed to > write(). > Can I call/generate *some other non-instrusive* syscall which can take that > string buffer that I stored earlier and that syscall with the buffer will > be visible in the audit.log? I am not worried about performance hit right > now. Use an AUDIT_USER message with the text and some identifier that links it with a particular write call? > On Thu, Apr 26, 2018 at 7:46 PM Casey Schaufler <casey@schaufler-ca.com> wrote: > > On 4/26/2018 5:08 PM, Sargun Dhillon wrote: > > > On Thu, Apr 26, 2018 at 4:40 PM, Casey Schaufler <casey@schaufler-ca.com> > > wrote: > > >> On 4/26/2018 3:57 PM, Steve Grubb wrote: > > >>> On Thu, 26 Apr 2018 20:34:57 +0000 > > >>> Wajih Ul Hassan <wajih.lums@gmail.com> wrote: > > >>> > > >>>> Hi all, > > >>>> ..... > > >> You could write a Linux Security Module (LSM) to monitor the > > >> content of writes. The performance impact would be rather > > >> amazing. > > >> > > > I would recommend using BPF + kprobes + perf_event buffers for this > > > purpose. There are enough places you can probe to grab these strings > > > in the kernel, and if you do your filtering in BPF, you can then push > > > it into kernel space based on filtering. Although, AFAIK, the BPF JITs > > > don't do vectorization of instructions, but it's still not too bad. If > > > you put your kprobe on the syscall itself, and probe the userspace > > > addr, remember you're going to be open to a time-of-use, time-of-check > > > style attack. > > > > That looks like a whole lot of mechanism to perform a simple task. - RGB -- Richard Guy Briggs <rgb@redhat.com> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635 ^ permalink raw reply [flat|nested] 12+ messages in thread
end of thread, other threads:[~2018-04-27 18:21 UTC | newest] Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2018-04-26 20:34 Extracting written string from the write syscall Wajih Ul Hassan 2018-04-26 22:57 ` Steve Grubb 2018-04-26 23:40 ` Casey Schaufler 2018-04-26 23:40 ` Casey Schaufler 2018-04-27 0:08 ` Sargun Dhillon 2018-04-27 0:08 ` Sargun Dhillon 2018-04-27 0:46 ` Casey Schaufler 2018-04-27 0:46 ` Casey Schaufler 2018-04-27 2:37 ` Wajih Ul Hassan 2018-04-27 15:35 ` Casey Schaufler 2018-04-27 18:21 ` Richard Guy Briggs 2018-04-27 18:21 ` Richard Guy Briggs
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.