Date: Mon, 22 Nov 1999 12:27:01 +0100 (CET) From: Andrzej Bialecki <abial@webgiro.com> To: freebsd-current@freebsd.org Subject: ANNOUNCE: SPY-0.1 - syscalls monitor Message-ID: <Pine.BSF.4.05.9911221220440.81981-100000@freja.webgiro.com>
next in thread | raw e-mail | index | archive | help
Hi, SPY allows you to monitor and/or selectively block syscalls on your system. It could be used either as a safety monitoring device, policy enforcement, or debugging tool. You can download the sources (NOTE: -current only) from: http://www.freebsd.org/~abial/spy-0.1.tgz Excerpt of README follows: --------------------------------------------------------------------- This kernel module allows you to selectivly monitor and/or disable execution of system calls (syscalls) on your system, and log detailed info to syslog service. It's sometimes desirable to monitor selected syscalls for security reasons, or for debugging. For example, many security holes are related to setuid/setgid programs. You can monitor and log all attempts to use these syscalls. You can also disable certain syscalls altogether, if you really know what you're doing... Already existing tools (like ktrace(1) or truss(1)) can provide much more detailed information, but they are more fit to tracing single processes or process groups, and not setting overall system policy (speaking of which: this module is an example of very primitive auditing and policy enforcing device). Features -------- Using SPY module you can set up your system to: * log detailed info on execution of any selected syscall. In case of a few most important ones, there are specific handlers to log also the arguments of the syscall in understandable format. They are as follows: execve, set*id, chdir, open, link, unlink, chmod, chown, mkdir, rmdir (You are welcome to add others :-) Any syscall can be monitored, but in general case its arguments cannot be interpreted. * set kind of information to be logged. You can restrict logging on a per syscall basis, with the following constraints (OR-ed): - uid or gid - superuser only - all users except superuser - combination of the above You can also adjust level of logging on a per syscall basis. There are three levels available: - basic: logs minimum information sufficient to identify the syscall and process owner - arg: logs also the arguments of the syscall, if possible - full: logs all information available. * disable selected syscalls, which prevents specified categories of users to use them at all, and any such attempt is logged. By default the SPY module logs attempts to use execve syscall by root owned processes, and setuid/setgid by any user owned process. Default mode for other syscalls, used when you add them to monitoring, is to log all uses with all arguments. --------------------------------------------------------------------- Andrzej Bialecki // <abial@webgiro.com> WebGiro AB, Sweden (http://www.webgiro.com) // ------------------------------------------------------------------- // ------ FreeBSD: The Power to Serve. http://www.freebsd.org -------- // --- Small & Embedded FreeBSD: http://www.freebsd.org/~picobsd/ ---- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-current" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.05.9911221220440.81981-100000>