Re: [PATCH v2 0/2] RFC, aiding pid/network correlation

[Alex Elsayed <eternaleye@gmail.com>]

Peter Moody wrote:

> 
> On Sat, Aug 02 2014 at 19:47, Alex Elsayed wrote:
>>> #2012/04/08 05:03:03# global-pid=3720 result=allowed priority=100 / read
>>> path="/tmp/file1" task.pid=3720 task.ppid=3653 task.uid=0 task.gid=0
>>> task.euid=0 task.egid=0 task.suid=0 task.sgid=0 task.fsuid=0
>>> task.fsgid=0 task.type!=execute_handler task.exe="/bin/cat"
>>> task.domain="/usr/sbin/sshd" path.uid=0 path.gid=0 path.ino=2113451
>>> path.major=8 path.minor=1 path.perm=0644 path.type=file
>>> path.fsmagic=0xEF53 path.parent.uid=0 path.parent.gid=0
>>> path.parent.ino=2097153 path.parent.major=8 path.parent.minor=1
>>> path.parent.perm=01777 path.parent.type=directory
>>> path.parent.fsmagic=0xEF53
>>
>> Actually, now that I look at that, you'd need to audit 'domain
>> transition' events too - since that contains all the relevant PIDs, then
>> the most recent domain transition with all of the right PIDs is
>> sufficient to rebuild the tree back to init (recursively)
> 
> How are network events logged? The documentation on caitsith.sourceforge
> is lacking.

It depends on the event - if you look at the per-event docs[1], you'll see 
the variables it'll log. For instance, inet_stream_bind has 'ip', 'port', 
and 'task.$attribute' listed (and hyperlinked), so it'll log like this:

// These fields are common across all events:
// time, root-pid-ns PID, result, acl-priority, and chroot path
#2012/04/08 05:03:03# global-pid=3720 result=unmatched priority=0 /
// Then the action
inet_stream_bind
// then the variables
ip=0.0.0.0 port=80 task.pid=2245 task.ppid=3422 task.uid=81 task.gid=81
task.euid=81 task.egid=81 task.suid=0 task.sgid=0 task.fsuid=81
task.fsgid=81 task.type!=execute_handler task.exe="/user/bin/httpd"
task.domain="/usr/bin/httpd"

[1] Start at http://caitsith.sourceforge.jp/#5.26 and scroll