Bug 2020 - probe kernel audit hooks
Summary: probe kernel audit hooks
Status: RESOLVED WONTFIX
Alias: None
Product: systemtap
Classification: Unclassified
Component: translator (show other bugs)
Version: unspecified
: P2 normal
Target Milestone: ---
Assignee: Unassigned
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2005-12-09 22:45 UTC by Frank Ch. Eigler
Modified: 2010-04-17 14:59 UTC (History)
0 users

See Also:
Host:
Target:
Build:
Last reconfirmed:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Frank Ch. Eigler 2005-12-09 22:45:56 UTC 
create another probe point family, to represent the kernel audit subsystem's
existing hooks
Comment 1 Frank Ch. Eigler 2007-04-11 18:36:20 UTC 
Exploiting the audit code already in the kernel would allow systemtap scripts to
do all these and more:

http://www.cyberciti.biz/tips/linux-audit-files-to-see-who-made-changes-to-a-file.html
Comment 2 Frank Ch. Eigler 2007-10-21 17:26:57 UTC 
http://sourceware.org/ml/systemtap/2007-q4/msg00212.html
Comment 3 Frank Ch. Eigler 2010-04-17 14:59:42 UTC 
This is unnecessary now, with kprobe access into kernel/audit*
as needed, and several other probe technologies tracking system calls.