Re: [vserver] Process monitoring for host based intrusion detection

2014-10-06 8:06 GMT-04:00 Fiedler Roman <Roman.Fiedler@ait.ac.at>:

> Hello,
>
> > Von: Jacques Gélinas [mailto:jacques@croesus.com]
> >
> > Hello!
> >
> > This is to announce a new project called for-rest. It is an intrusion
> detection
> > system that works on a host runing vservers. It is using the bsd process
> > accounting in the kernel with a little enhancement. Using it, it can
> build a set
> > of process trees (a little like the pstree command).
> >
> > Interestingly the bsd process accounting is already PID namespace aware.
> So
> > you end up with one accounting file per vserver. Each file is tracking
> all
> > processes in a vserver. Normally process accounting is done at process
> end
> > time. With the patch, an accounting record is produced at process
> creation
> > time (fork()) and each time the process execs (thus changes name). Using
> this,
> > it is possible to build the complete execution tree up to PID 1 (init)
> for every
> > processes.
>
> OK, this is a simple and lean approach. What was the rationale to not
> fixing the audit subsystem, like e.g. done with [1], which would be very
> generic (should also work for other pid-ns cases, e.g. lxc or google chrome
> launcher if I remember correctly). Apart from that, audit logs can be used
> by other SIEM/IDS systems, some of those are already using audit data as
> input source, e.g. searching for "Intrusion detection system linux syscall"
> (and subtracting the entries for syscall-table-modification-checkers)
>

Ok, I admit I did not even look at the audit system when I had this idea.
It was back in 2007. At that time, my idea was to extend the account record
to include the XID. ... many years passed ... When I looked last thursday
at implementing that (in order to check if shellshock was being used on
us), I realized pretty much everything was done since the accounting was
alreay PID NS aware. So I just had to add two calls in the kernel, at fork
and exec time to complete the project. The accounting code in kernel/acct.c
was using "current" directly, so I had to make that a parameter so a record
could be generated for any process. It took one hour to complete.

Now, I checked the audit system. This could be interesting because it could
become almost real time. But here is what have to be done. Please correct
me.

-The XID would have to be included in the log record.
-There does not seem to be any event when a process ends.
-The patch you referenced seems to go the other way around as it tries to
put everything
 in the main PID namespace. If we have the XID, I guess this is not a
problem.
 We can split the event per XID, locate the init PID of the XID and so on.

Cool stuff! Thanks!

-- 
_________________________________________________________________________
*Avis *: Ce message ne vise uniquement que son destinataire et peut 
contenir de l’information confidentielle.  Son utilisation/divulgation 
non-autorisée est interdite.  Si reçu par erreur, veuillez en aviser 
l’expéditeur et supprimer ce message et toute pièce jointe de votre système.
*Notice*:  This  message  is  intended  to  its  recipient  only  and  may 
 contain  privileged  information.   Unauthorized  use/disclosure is 
 prohibited.    If  received  by  error,  please  notify the  sender  and 
 delete this message and any attachments from your system.