Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0a4ff8c2 authored by Steve Grubb's avatar Steve Grubb Committed by Al Viro
Browse files

[PATCH] Abnormal End of Processes 



Hi,

I have been working on some code that detects abnormal events based on audit
system events. One kind of event that we currently have no visibility for is
when a program terminates due to segfault - which should never happen on a
production machine. And if it did, you'd want to investigate it. Attached is a
patch that collects these events and sends them into the audit system.

Signed-off-by: default avatarSteve Grubb <sgrubb@redhat.com>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 5712e88f

fs/exec.c

+2 −0
Original line number Diff line number Diff line
@@ -1488,6 +1488,8 @@ int do_coredump(long signr, int exit_code, struct pt_regs * regs) 
	int flag = 0;

	int ispipe = 0;



	audit_core_dumps(signr);



	binfmt = current->binfmt;

	if (!binfmt || !binfmt->core_dump)

		goto fail;

include/linux/audit.h

+3 −0
Original line number Diff line number Diff line
@@ -112,6 +112,7 @@ 
#define AUDIT_FIRST_KERN_ANOM_MSG   1700

#define AUDIT_LAST_KERN_ANOM_MSG    1799

#define AUDIT_ANOM_PROMISCUOUS      1700 /* Device changed promiscuous mode */

#define AUDIT_ANOM_ABEND            1701 /* Process ended abnormally */



#define AUDIT_KERNEL		2000	/* Asynchronous audit record. NOT A REQUEST. */
@@ -377,6 +378,7 @@ static inline void audit_inode_child(const char *dname, 
	if (unlikely(!audit_dummy_context()))

		__audit_inode_child(dname, inode, parent);

}

void audit_core_dumps(long signr);



static inline void audit_ptrace(struct task_struct *t)

{
@@ -467,6 +469,7 @@ extern int audit_signals; 
#define __audit_inode_child(d,i,p) do { ; } while (0)

#define audit_inode(n,i) do { ; } while (0)

#define audit_inode_child(d,i,p) do { ; } while (0)

#define audit_core_dumps(i) do { ; } while (0)

#define auditsc_get_stamp(c,t,s) do { BUG(); } while (0)

#define audit_get_loginuid(c) ({ -1; })

#define audit_log_task_context(b) do { ; } while (0)

kernel/auditsc.c

+39 −0
Original line number Diff line number Diff line
@@ -2037,3 +2037,42 @@ int __audit_signal_info(int sig, struct task_struct *t) 


	return 0;

}



/**

 * audit_core_dumps - record information about processes that end abnormally

 * @sig: signal value

 *

 * If a process ends with a core dump, something fishy is going on and we

 * should record the event for investigation.

 */

void audit_core_dumps(long signr)

{

	struct audit_buffer *ab;

	u32 sid;



	if (!audit_enabled)

		return;



	if (signr == SIGQUIT)	/* don't care for those */

		return;



	ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_ANOM_ABEND);

	audit_log_format(ab, "auid=%u uid=%u gid=%u",

			audit_get_loginuid(current->audit_context),

			current->uid, current->gid);

	selinux_get_task_sid(current, &sid);

	if (sid) {

		char *ctx = NULL;

		u32 len;



		if (selinux_sid_to_string(sid, &ctx, &len))

			audit_log_format(ab, " ssid=%u", sid);

		else

			audit_log_format(ab, " subj=%s", ctx);

		kfree(ctx);

	}

	audit_log_format(ab, " pid=%d comm=", current->pid);

	audit_log_untrustedstring(ab, current->comm);

	audit_log_format(ab, " sig=%ld", signr);

	audit_log_end(ab);

}