Logging of a system call

Logging of a system call

[Paulo Silva]

[-- Attachment #1: Type: text/plain, Size: 348 bytes --]

Hi all,

I was wondering if anyone knows an easy way to log all invocations of a
particular system call in a Linux system (kernel 2.6).

My first ideia was to use SELinux but I haven't experience developing
new policies, has anybody done something similar with SELinux?

Thanks
-- 
Paulo Silva <pjs@eurotux.com>
Eurotux Informática, SA

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: Logging of a system call

[Steve G]

>I was wondering if anyone knows an easy way to log all invocations of a
>particular system call in a Linux system (kernel 2.6).

If you have the audit system installed - http://people.redhat.com/sgrubb/audit,
you can do this:

auditctl -a entry,always -S syscallname

The results will be in either /var/log/audit/audit.log or syslog depending on
whether you are running the audit daemon or not.

>My first ideia was to use SELinux but I haven't experience developing
>new policies, has anybody done something similar with SELinux?

The audit system was designed for this, please give it a try.

-Steve


		
____________________________________________________ 
Yahoo! Sports 
Rekindle the Rivalries. Sign up for Fantasy Football 
http://football.fantasysports.yahoo.com

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.