{"id":366,"date":"2010-07-01T14:24:41","date_gmt":"2010-07-01T22:24:41","guid":{"rendered":"http:\/\/www.outflux.net\/blog\/?p=366"},"modified":"2010-07-01T14:24:41","modified_gmt":"2010-07-01T22:24:41","slug":"reporting-all-execs","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2010\/07\/01\/reporting-all-execs\/","title":{"rendered":"reporting all execs"},"content":{"rendered":"<p>I recently learned about the <a href=\"http:\/\/lwn.net\/Articles\/157150\/\">process event connector<\/a>, and went looking for an <a href=\"http:\/\/lkml.org\/lkml\/2005\/9\/28\/347\">example program<\/a> that could report all the exec()s that happen on my system to help with debugging things like AC plug\/unplug scripts, etc.<\/p>\n<p>After cleaning it up and adding some features to do a simple best-effort cmdline reporting, I&#8217;ve now got a <a href=\"http:\/\/bazaar.launchpad.net\/~kees\/+junk\/cn_proc\/annotate\/head:\/cn_proc.c\">tool<\/a> that will report every program run on a system:<\/p>\n<pre class=\"brush:shell\">\r\n$ sudo .\/cn_proc \r\nsending proc connector: PROC_CN_MCAST_LISTEN... sent\r\nReading process events from proc connector.\r\nHit Ctrl-C to exit\r\nevent: exec 17514 17514: ls -AF --color=auto (unconfined)\r\nevent: exec 17516 17516: date +%H:%M (unconfined)\r\nevent: exec 17518 17518: whoami (unconfined)\r\n<\/pre>\n<p>Change the values <code>show_event<\/code>, <code>show_seq<\/code>, <code>show_cpu<\/code>, <code>show_security_context<\/code> to set the reporting defaults.  Or, if someone is feeling bored, it would rock to add getopt support instead.<\/p>\n<p>It seems strange to me that only CAP_NET_ADMIN is needed to get access to this information.<\/p>\n<p style='text-align:left'>&copy; 2010, <a href=\"https:\/\/outflux.net\/blog\/\">Kees Cook<\/a>. This work is licensed under a <a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\">Creative Commons Attribution-ShareAlike 4.0 License<\/a>.<br \/><a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\"><img decoding=\"async\" alt=\"CC BY-SA 4.0\" style=\"border-width:0\" src=\"https:\/\/i.creativecommons.org\/l\/by-sa\/4.0\/88x31.png\" \/><\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"<p>I recently learned about the process event connector, and went looking for an example program that could report all the exec()s that happen on my system to help with debugging things like AC plug\/unplug scripts, etc. After cleaning it up and adding some features to do a simple best-effort cmdline reporting, I&#8217;ve now got a [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,18,14,19],"tags":[],"_links":{"self":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/366"}],"collection":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/comments?post=366"}],"version-history":[{"count":2,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/366\/revisions"}],"predecessor-version":[{"id":368,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/366\/revisions\/368"}],"wp:attachment":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/media?parent=366"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/categories?post=366"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/tags?post=366"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}