[lkml]   [2006]   [Apr]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectQ on audit, audit-syscall

good afternoon,

I'm searching for a way to trace/intercept syscalls, both before and
after execution. "ptrace" is not an option (you probably know why).
I've found CONFIG_AUDIT and CONFIG_AUDITSYSCALL, which offer
"audit_syscall_entry" and "audit_syscall_exit", but I dont know
how to use this. Also, the comment in kernel/auditsc.c reads:
* The method for actual interception of syscall entry and exit (not in
* this file -- see entry.S) is based on a GPL'd patch written by
* and Copyright 2003 SuSE Linux AG.

So, am I looking in the wrong file?

I just cant see how this software communicates with user-space,
there is no "register_xxx" (or whatever) in the source-files.
Is it neccessary to write an additional module (like se-linux does)
which makes use of audit and exports its own functionality to

So far, in the audit-1.1.5 deamon, I've only found a PF_NETLINK/NETLINK_AUDIT
socket. *Is* this it?

What's additionally confusing me is that linux/Documentation/devices.txt
says that "block 130 minor 0 = Audit device", yet, allthugh I'm running
with 2.6.16 + CONFIG_AUDIT & CONFIG_AUDITSYSCALL, there just is no
block dev 130 in /proc/devices. Is the entry in devices.txt wrong?


To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2006-04-05 13:34    [W:0.061 / U:4.792 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site