Re: Extending LOG target to display pid

[Nick Hay <nickjhay@hotmail.com>]

Tobias DiPasquale wrote:
> On 7/5/05, Nick Hay <nickjhay@hotmail.com> wrote:
> 
>>2. Any ideas on how I can get the pid of a local packet's creator in the
>>log module?  I couldn't find any structures connected to the sk_buff
>>that might contain it, and couldn't think of where the data would
>>originally come from.
> 
> 
> A security framework, with the proper auditing and accounting
> mechanisms in place in the network stack could make this possible (any
> it may already be). But in general, it would be quite a lot of work to
> add the necessary code to the stack to account for the
> sending/receiving PID at the correct stage. Unless you're doing MAC,
> its probably not worth it.

My original intention was to replicate some part of Windows' ZoneAlarm
package: the ability to recognise which program was asking for access,
and to filter based on that.  Noticing a strange packet that was blocked
by my filter on outgoing ports, and not being able to find out where it
came from was the immediate motivation :)

Is it better to try this at the SELinux level,
blocking/monitoring/adjusting access to socket creation/use?

>>Actually... would current->pid work?
> 
> No, because there's no guarantee that the same process is on the CPU
> by the time the packet hits your rule.
>
> Can't check on #1 right now, but I believe that its filled in by the
> module itself in whatever way it chooses.

-- Nick