From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Hassan Sultan" Subject: Re: Filtering Connect syscalls for af_inet only Date: Thu, 05 Feb 2015 12:26:44 -0800 Message-ID: References: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============2727473088244618974==" Return-path: Received: from mx1.redhat.com (ext-mx15.extmail.prod.ext.phx2.redhat.com [10.5.110.20]) by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id t15KQiPi029087 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL) for ; Thu, 5 Feb 2015 15:26:44 -0500 Received: from homiemail-a93.g.dreamhost.com (sub5.mail.dreamhost.com [208.113.200.129]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id t15KQgaw030420 for ; Thu, 5 Feb 2015 15:26:43 -0500 In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Paul Moore , F Rafi Cc: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com --===============2727473088244618974== Content-Type: multipart/alternative; boundary=----------006IxC3cz6wNa7w9Zz4SUe ------------006IxC3cz6wNa7w9Zz4SUe Content-Type: text/plain; charset=iso-8859-15; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Wouldn't x86 simply be a filter with 2 comparisons : one on a0 to filter only connect, and one on a3 for the sockaddr size ? Basically, on x86 you have one rule : the one with 2 comparisons On x64 you have 2 rules : one on the connect syscall, and one on the socketcall syscall with 2 comparisons Thanks, Hassan On Thu, 05 Feb 2015 11:06:03 -0800, F Rafi wrote: > I did some digging and now I understand the different size variations of > sockaddr_storage. I guess I can just filter on a2!=6e then. > > And we'd have to keep an eye out for x86 systems. I understand that > x86_64 does not use socketcall() but, do you know if multiarch support > somehow >allows 32bit apps on x86_64 to use / translate these calls? > > Thanks again! > Farhan > > On Thu, Feb 5, 2015 at 10:38 AM, Paul Moore wrote: >> On Thu, Feb 5, 2015 at 10:31 AM, F Rafi wrote: >>> Ahh..thanks Paul! >>> >>> Is there a better way to intercept outbound network access calls while >>> avoiding af_unix? >> >> I'm not sure, I'm not overly familiar with the auditd/auditctl >> filtering capabilities. There are several people on this list that >> are far more knowledgeable about that than me. >> >>>>> I assume sockaddr_storage is just a different size (I think 128?) >> >> The idea behind the sockaddr_storage struct was to create a structure >> that could be used to represent any address family that the system >> supports. I don't believe there is a standard size across OSes due to >> different level of support, padding, etc; in other words, it's >> probably best not to rely on a specific size of sockaddr_storage. >> >>>> -- >> paul moore >> www.paul-moore.com ------------006IxC3cz6wNa7w9Zz4SUe Content-Type: multipart/related; boundary=----------006IxC3cz6wNa7IhNx9pm1 ------------006IxC3cz6wNa7IhNx9pm1 Content-Type: text/html; charset=iso-8859-15 Content-ID: Content-Transfer-Encoding: Quoted-Printable
Wouldn't x86 simply be a filter with 2 comparisons : one on a= 0 to filter only connect, and one on a3 for the sockaddr size ?

Basically, on x86 you have one rule : the one with 2 co= mparisons
On x64 you have 2 rules : one on the connect syscall= , and one on the socketcall syscall with 2 comparisons

Thanks,

Hassan

On Thu, 05 Feb 2015 11:06:03 -0800, F Rafi <farhanible@gmail.com>= wrote:

I did some dig= ging and now I understand the different size variations of sockaddr_stor= age. I guess I can just filter on a2!=3D6e then.

And = we'd have to keep an eye out for x86 systems. I understand that x86_64 d= oes not use socketcall() but, do you know if multiarch support somehow a= llows 32bit apps on x86_64 to use / translate these calls?
Thanks again!
Farhan

On Thu, Feb 5, 2015 at 10:38 AM,= Paul Moore <paul@paul-moore.com> wrote:
On Thu, Feb 5, 2015 at 10:31 = AM, F Rafi <farhanible@gmail.= com> wrote:
> Ahh..thanks Paul!
>
> Is there a better way to intercept outbound network access calls wh= ile
> avoiding af_unix?

I'm not sure, I'm not overly familiar with the auditd/auditctl filtering capabilities.  There are several people on this list that=
are far more knowledgeable about that than me.

> I assume sockaddr_storage is just a different size (I think 128?)
The idea behind the sockaddr_storage struct was to create a struc= ture
that could be used to represent any address family that the system
supports.  I don't believe there is a standard size across OSes due= to
different level of support, padding, etc; in other words, it's
probably best not to rely on a specific size of sockaddr_storage.

--
paul moore
www.paul-moore.c= om




------------006IxC3cz6wNa7IhNx9pm1-- ------------006IxC3cz6wNa7w9Zz4SUe-- --===============2727473088244618974== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============2727473088244618974==--