From: Paul Moore <paul@paul-moore.com>
To: Steve Grubb <sgrubb@redhat.com>
Cc: audit@vger.kernel.org,
linux-security-module <linux-security-module@vger.kernel.org>,
linux-audit@redhat.com
Subject: Re: [PATCH] audit: add task history record
Date: Tue, 22 Aug 2023 13:58:46 -0400 [thread overview]
Message-ID: <CAHC9VhTGQ7LF8BjZDJMj7F8Uo0AYsWtyce98kyQrsRYK1Ui1xg@mail.gmail.com> (raw)
In-Reply-To: <4865772.31r3eYUQgx@x2>
On Tue, Aug 22, 2023 at 12:29 PM Steve Grubb <sgrubb@redhat.com> wrote:
> On Wednesday, August 16, 2023 9:53:58 AM EDT Paul Moore wrote:
> > On Wed, Aug 16, 2023 at 6:10 AM Tetsuo Handa
> > <penguin-kernel@i-love.sakura.ne.jp> wrote:
> > > On 2023/08/16 3:44, Paul Moore wrote:
> > > > On Fri, Aug 11, 2023 at 6:58 AM Tetsuo Handa
> > > > <penguin-kernel@i-love.sakura.ne.jp> wrote:
> > > >> When an unexpected system event occurs, the administrator may want to
> > > >> identify which application triggered the event. For example,
> > > >> unexpected process termination is still a real concern enough to write
> > > >> articles like https://access.redhat.com/solutions/165993 .
> > > >>
> > > >> This patch adds a record which emits TOMOYO-like task history
> > > >> information into the audit logs for better understanding of unexpected
> > > >> system events.
> > > >>
> > > >> type=UNKNOWN[1340] msg=audit(1691750738.271:108):
> > > >> history="name=swapper/0;pid=1;start=20230811194329=>name=init;pid=1;s
> > > >> tart=20230811194343=>name=systemd;pid=1;start=20230811194439=>name=ssh
> > > >> d;pid=3660;start=20230811104504=>name=sshd;pid=3767;start=202308111045
> > > >> 35"
> > > >
> > > > While I respect your persistence, we've talked about this quite a bit
> > > > already in other threads. What you are trying to do is already
> > > > possible with audit
> > >
> > > How?
> >
> > If you configure audit to record exec() and friends you should have a
> > proper history of the processes started on the system.
>
> This is not a practical solution. Yes, technically this could be done. But it
> would be a huge burden on the system to keep up with this. And it would bury
> events you truly wanted to see effectively DoS'ing the audit system.
If the audit subsystem can't handle the load, that is a separate issue.
--
paul-moore.com
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
next prev parent reply other threads:[~2023-08-22 17:59 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-08-11 10:58 [PATCH] audit: add task history record Tetsuo Handa
2023-08-11 17:50 ` Richard Guy Briggs
2023-08-12 10:08 ` Tetsuo Handa
2023-08-15 18:44 ` Paul Moore
2023-08-16 10:10 ` Tetsuo Handa
2023-08-16 13:53 ` Paul Moore
2023-08-18 10:29 ` Tetsuo Handa
2023-08-18 14:59 ` Paul Moore
2023-08-19 7:09 ` Tetsuo Handa
2023-08-21 16:04 ` Serge E. Hallyn
2023-08-21 22:23 ` Tetsuo Handa
2023-08-21 16:35 ` Paul Moore
2023-08-23 14:18 ` Tetsuo Handa
2023-08-23 14:48 ` Paul Moore
2023-08-24 13:21 ` Tetsuo Handa
2023-08-24 13:30 ` Paul Moore
2023-08-24 13:39 ` Tetsuo Handa
2023-08-24 13:47 ` Tetsuo Handa
2023-08-24 14:26 ` Paul Moore
2023-08-24 22:24 ` Tetsuo Handa
2023-08-25 3:36 ` Paul Moore
2023-08-26 6:38 ` Tetsuo Handa
2023-08-26 14:47 ` Paul Moore
2023-08-24 14:24 ` Paul Moore
2023-08-24 15:55 ` Steve Grubb
2023-08-24 17:02 ` Paul Moore
2023-08-22 16:29 ` Steve Grubb
2023-08-22 17:58 ` Paul Moore [this message]
2023-08-21 17:29 ` Serge Hallyn
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAHC9VhTGQ7LF8BjZDJMj7F8Uo0AYsWtyce98kyQrsRYK1Ui1xg@mail.gmail.com \
--to=paul@paul-moore.com \
--cc=audit@vger.kernel.org \
--cc=linux-audit@redhat.com \
--cc=linux-security-module@vger.kernel.org \
--cc=sgrubb@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).