Re: How to define audit rule for one bit *not* set for a syscall argument?
Yes, the case is that we would like to filter out the "thread creation" and only keep the "process creation", by excluding the CLONE_THREAD flag bit of a0 of clone() syscall. Without the audit comparator support for this case, we have to filter out the "thread creation" in user space which introduces a performance penalty. Regards, Richard On Thu, Mar 9, 2023 at 6:22 AM Steve Grubb wrote: > Hello, > > On Wednesday, March 8, 2023 8:46:57 AM EST Richard Du wrote: > > I'm trying to define an audit rule with auditctl for clone() syscall, > and I > > would expect that the a0 of clone() syscall (i.e. the clone_flags > > argument) without the CLONE_THREAD flag bit being set. > > > > int clone(int (*fn)(void *), void *stack, int flags, void *arg, ... > > /* pid_t *parent_tid, void *tls, pid_t *child_tid */ ); > > > > From man page of auditctl, -F option build a rule file: name, operation, > > value. > > -F [n=v | n!=v | nv | n<=v | n>=v | n | n&=v] > > > > I can understand that, the n (Audit_bitmask) means any bit of a bitmast > > is set, and the n&=v (Audit_bittest) means all bits of a bitmask are set. > > > > While my question is, how to build a rule which means "none of bit of a > > bitmask is set", i.e. ( ! n&=v ). If the current audit comparator dosen't > > support this, can we add the support in furture? > > The comparator does not support this. This is a corner case in which this > is > the first time someone ever needed it. > > -Steve > > > -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit
Re: How to define audit rule for one bit *not* set for a syscall argument?
Hello, On Wednesday, March 8, 2023 8:46:57 AM EST Richard Du wrote: > I'm trying to define an audit rule with auditctl for clone() syscall, and I > would expect that the a0 of clone() syscall (i.e. the clone_flags > argument) without the CLONE_THREAD flag bit being set. > > int clone(int (*fn)(void *), void *stack, int flags, void *arg, ... > /* pid_t *parent_tid, void *tls, pid_t *child_tid */ ); > > From man page of auditctl, -F option build a rule file: name, operation, > value. > -F [n=v | n!=v | nv | n<=v | n>=v | n | n&=v] > > I can understand that, the n (Audit_bitmask) means any bit of a bitmast > is set, and the n&=v (Audit_bittest) means all bits of a bitmask are set. > > While my question is, how to build a rule which means "none of bit of a > bitmask is set", i.e. ( ! n&=v ). If the current audit comparator dosen't > support this, can we add the support in furture? The comparator does not support this. This is a corner case in which this is the first time someone ever needed it. -Steve -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit
How to define audit rule for one bit *not* set for a syscall argument?
Hello all, I'm trying to define an audit rule with auditctl for clone() syscall, and I would expect that the a0 of clone() syscall (i.e. the clone_flags argument) without the CLONE_THREAD flag bit being set. int clone(int (*fn)(void *), void *stack, int flags, void *arg, ... /* pid_t *parent_tid, void *tls, pid_t *child_tid */ ); >From man page of auditctl, -F option build a rule file: name, operation, value. -F [n=v | n!=v | nv | n<=v | n>=v | n | n&=v] I can understand that, the n (Audit_bitmask) means any bit of a bitmast is set, and the n&=v (Audit_bittest) means all bits of a bitmask are set. While my question is, how to build a rule which means "none of bit of a bitmask is set", i.e. ( ! n&=v ). If the current audit comparator dosen't support this, can we add the support in furture? Thanks, Richard -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit
