Re: [PATCH v2 0/2] RFC, aiding pid/network correlation

[Alex Elsayed <eternaleye@gmail.com>]

Peter Moody wrote:

> 
> On Sat, Aug 02 2014 at 20:41, Alex Elsayed wrote:
>> Peter Moody wrote:
>>
>>> 
>>> On Sat, Aug 02 2014 at 19:47, Alex Elsayed wrote:
>>>>> #2012/04/08 05:03:03# global-pid=3720 result=allowed priority=100 /
>>>>> #read
>>>>> path="/tmp/file1" task.pid=3720 task.ppid=3653 task.uid=0 task.gid=0
>>>>> task.euid=0 task.egid=0 task.suid=0 task.sgid=0 task.fsuid=0
>>>>> task.fsgid=0 task.type!=execute_handler task.exe="/bin/cat"
>>>>> task.domain="/usr/sbin/sshd" path.uid=0 path.gid=0 path.ino=2113451
>>>>> path.major=8 path.minor=1 path.perm=0644 path.type=file
>>>>> path.fsmagic=0xEF53 path.parent.uid=0 path.parent.gid=0
>>>>> path.parent.ino=2097153 path.parent.major=8 path.parent.minor=1
>>>>> path.parent.perm=01777 path.parent.type=directory
>>>>> path.parent.fsmagic=0xEF53
>>>>
>>>> Actually, now that I look at that, you'd need to audit 'domain
>>>> transition' events too - since that contains all the relevant PIDs,
>>>> then the most recent domain transition with all of the right PIDs is
>>>> sufficient to rebuild the tree back to init (recursively)
>>> 
>>> How are network events logged? The documentation on caitsith.sourceforge
>>> is lacking.
>>
>> It depends on the event - if you look at the per-event docs[1], you'll
>> see the variables it'll log. For instance, inet_stream_bind has 'ip',
>> 'port', and 'task.$attribute' listed (and hyperlinked), so it'll log like
>> this:
> 
> Is this all caitsaith-specific? I don't see how to test what you're
> describing with tomoyo.

Looking at Tomoyo, it seems to do it differently (and less conveniently) - 
the best way might be to:

1.) be in "permissive" mode so that "deny" doesn't actually prevent anything
2.) Set "grant_log=no" and "reject_log=yes" in the CONFIG section
3.) in acl_group zero, allow by default but deny network operations
4.) Watch the logs

It does seem like the logs are less verbose than CaitSith, though.

Note that CaitSith can be built as a kernel module (without patching), so 
that might be worth testing as well.