Re:Syscall Auditing at Scale
by amluto on Tuesday November 22, 2016 @12:44AM
(#13011904)
>> It doesn't robustly match entries to returns
> Do you mean it fails to match the call/return (annoying), or that it may mismatch them? (pretty bad...)
__audit_syscall_entry() and __audit_syscall_exit() have some interesting checks in them, and I was never convinced that every entry would get paired with the corresponding exit and logged correctly.
>> It doesn't handle containerization sensibly at all.
> Do you mean it's just oblivious to namespaces (but works as far as I know) or something actually not working?
As far as I know, there is one global audit daemon and audit log, and you have to be globally privileged to use it.
> Do you mean it fails to match the call/return (annoying), or that it may mismatch them? (pretty bad...)
__audit_syscall_entry() and __audit_syscall_exit() have some interesting checks in them, and I was never convinced that every entry would get paired with the corresponding exit and logged correctly.
>> It doesn't handle containerization sensibly at all.
> Do you mean it's just oblivious to namespaces (but works as far as I know) or something actually not working?
As far as I know, there is one global audit daemon and audit log, and you have to be globally privileged to use it.