Extracting written string from the write syscall

[Wajih Ul Hassan]

Hi all,
I am using Linux Audit module to monitor file accesses. However, I want to
extract what exactly was written to a specific file. I am catching the
events belonging to write syscall, for example:

type=SYSCALL msg=audit(04/26/2018 15:11:33.568:307907) : arch=x86_64
syscall=write success=yes exit=37 a0=0x3 a1=0x1aee240 a2=0x25 a3=0x477
items=0 ppid=11376 pid=26771 auid=wajih uid=wajih gid=wajih euid=wajih
suid=wajih fsuid=wajih egid=wajih sgid=wajih fsgid=wajih tty=pts1 ses=1
comm=a.out exe=/code/a.out key=(null)

I know the "a1" is the pointer to buffer being written; however, is there a
way I can take that pointer and extract the exact string? In the example
above I was writing "Hello world ...".

Thanks,
Wajih

[Steve Grubb]

On Thu, 26 Apr 2018 20:34:57 +0000

Post by Wajih Ul Hassan
Hi all,
I am using Linux Audit module to monitor file accesses. However, I
want to extract what exactly was written to a specific file. I am
type=SYSCALL msg=audit(04/26/2018 15:11:33.568:307907) : arch=x86_64
syscall=write success=yes exit=37 a0=0x3 a1=0x1aee240 a2=0x25 a3=0x477
items=0 ppid=11376 pid=26771 auid=wajih uid=wajih gid=wajih euid=wajih
suid=wajih fsuid=wajih egid=wajih sgid=wajih fsgid=wajih tty=pts1
ses=1 comm=a.out exe=/code/a.out key=(null)
I know the "a1" is the pointer to buffer being written; however, is
there a way I can take that pointer and extract the exact string? In
the example above I was writing "Hello world ...".

Short answer is no. There is no way I know of to do that via the audit
system.

-Steve

[Casey Schaufler]

Post by Steve Grubb
On Thu, 26 Apr 2018 20:34:57 +0000

Post by Wajih Ul Hassan
Hi all,
I am using Linux Audit module to monitor file accesses. However, I
want to extract what exactly was written to a specific file. I am
type=SYSCALL msg=audit(04/26/2018 15:11:33.568:307907) : arch=x86_64
syscall=write success=yes exit=37 a0=0x3 a1=0x1aee240 a2=0x25 a3=0x477
items=0 ppid=11376 pid=26771 auid=wajih uid=wajih gid=wajih euid=wajih
suid=wajih fsuid=wajih egid=wajih sgid=wajih fsgid=wajih tty=pts1
ses=1 comm=a.out exe=/code/a.out key=(null)
I know the "a1" is the pointer to buffer being written; however, is
there a way I can take that pointer and extract the exact string? In
the example above I was writing "Hello world ...".

Short answer is no. There is no way I know of to do that via the audit
system.

You could write a Linux Security Module (LSM) to monitor the
content of writes. The performance impact would be rather
amazing.

Post by Steve Grubb
-Steve
--
Linux-audit mailing list
https://www.redhat.com/mailman/listinfo/linux-audit

[Casey Schaufler]

Post by Casey Schaufler

Post by Steve Grubb
On Thu, 26 Apr 2018 20:34:57 +0000

Post by Wajih Ul Hassan
Hi all,
.....

You could write a Linux Security Module (LSM) to monitor the
content of writes. The performance impact would be rather
amazing.

I would recommend using BPF + kprobes + perf_event buffers for this
purpose. There are enough places you can probe to grab these strings
in the kernel, and if you do your filtering in BPF, you can then push
it into kernel space based on filtering. Although, AFAIK, the BPF JITs
don't do vectorization of instructions, but it's still not too bad. If
you put your kprobe on the syscall itself, and probe the userspace
addr, remember you're going to be open to a time-of-use, time-of-check
style attack.

That looks like a whole lot of mechanism to perform a simple task.

[Wajih Ul Hassan]

Thanks for your replies. However, I am now thinking of another solution.
Let's say I can capture write() in the userspace by either instrumenting
the LibC or LD_PRELOAD wrapper and store the string buffer passed to
write().
Can I call/generate *some other non-instrusive* syscall which can take that
string buffer that I stored earlier and that syscall with the buffer will
be visible in the audit.log? I am not worried about performance hit right
now.

Post by Casey Schaufler

Post by Casey Schaufler

Post by Steve Grubb
On Thu, 26 Apr 2018 20:34:57 +0000

Post by Wajih Ul Hassan
Hi all,
.....

You could write a Linux Security Module (LSM) to monitor the
content of writes. The performance impact would be rather
amazing.

I would recommend using BPF + kprobes + perf_event buffers for this
purpose. There are enough places you can probe to grab these strings
in the kernel, and if you do your filtering in BPF, you can then push
it into kernel space based on filtering. Although, AFAIK, the BPF JITs
don't do vectorization of instructions, but it's still not too bad. If
you put your kprobe on the syscall itself, and probe the userspace
addr, remember you're going to be open to a time-of-use, time-of-check
style attack.

That looks like a whole lot of mechanism to perform a simple task.

[Casey Schaufler]

Post by Wajih Ul Hassan
Thanks for your replies. However, I am now thinking of another solution.
Let's say I can capture write() in the userspace by either instrumenting the LibC or LD_PRELOAD wrapper and store the string buffer passed to write().
Can I call/generate *some other non-instrusive* syscall which can take that string buffer that I stored earlier and that syscall with the buffer will be visible in the audit.log? I am not worried about performance hit right now.

I'm not 100% sure, but you might be able to do this with LandLock.

Post by Wajih Ul Hassan

Post by Casey Schaufler

Post by Steve Grubb
On Thu, 26 Apr 2018 20:34:57 +0000

Post by Wajih Ul Hassan
Hi all,
  .....

You could write a Linux Security Module (LSM) to monitor the
content of writes. The performance impact would be rather
amazing.

I would recommend using BPF + kprobes + perf_event buffers for this
purpose. There are enough places you can probe to grab these strings
in the kernel, and if you do your filtering in BPF, you can then push
it into kernel space based on filtering. Although, AFAIK, the BPF JITs
don't do vectorization of instructions, but it's still not too bad. If
you put your kprobe on the syscall itself, and probe the userspace
addr, remember you're going to be open to a time-of-use, time-of-check
style attack.

That looks like a whole lot of mechanism to perform a simple task.

[Richard Guy Briggs]

Post by Wajih Ul Hassan
Thanks for your replies. However, I am now thinking of another solution.
Let's say I can capture write() in the userspace by either instrumenting
the LibC or LD_PRELOAD wrapper and store the string buffer passed to
write().
Can I call/generate *some other non-instrusive* syscall which can take that
string buffer that I stored earlier and that syscall with the buffer will
be visible in the audit.log? I am not worried about performance hit right
now.

Use an AUDIT_USER message with the text and some identifier that links
it with a particular write call?

Post by Wajih Ul Hassan

Post by Casey Schaufler

Post by Casey Schaufler

Post by Steve Grubb
On Thu, 26 Apr 2018 20:34:57 +0000

Post by Wajih Ul Hassan
Hi all,
.....

You could write a Linux Security Module (LSM) to monitor the
content of writes. The performance impact would be rather
amazing.

I would recommend using BPF + kprobes + perf_event buffers for this
purpose. There are enough places you can probe to grab these strings
in the kernel, and if you do your filtering in BPF, you can then push
it into kernel space based on filtering. Although, AFAIK, the BPF JITs
don't do vectorization of instructions, but it's still not too bad. If
you put your kprobe on the syscall itself, and probe the userspace
addr, remember you're going to be open to a time-of-use, time-of-check
style attack.

That looks like a whole lot of mechanism to perform a simple task.

- RGB

--
Richard Guy Briggs <***@redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635