Method of generating and presenting kernel data
View Patent ↗IDDS is implemented as a kernel resident data source which provides per-system call audit records into user space in a timely manner. Each invocation of a system call is audited and a record of the activity is placed into a circular buffer in the kernel. A user-space process reads the data from the buffer via a device driver interface. A device driver provides a clean interface between the kernel and the IDS. The semantics of device drivers are familiar to most UNIX programmers, following the standard file-based open-read-write-close paradigm.
1. A method of generating kernel audit data comprising:
storing system call parameters or data that the system call parameters point to at the beginning of a system call;
and triggering data delivery at the end of a system call path and generating an audit record and depositing the audit record in a circular buffer, wherein the audit record is a tokenized audit record and tokens of the tokenized audit record are either primitive or composed.
2. The method of claim 1 , wherein for each system call that accesses files, storing related file information.
3. The method of claim 2 , wherein related file information includes file owner or group and the file information is stored before any modifications occur that might affect the file information.
4. The method of claim 1 , wherein system call parameters that include path name parameters are stored with full path name information.
5. A method of generating kernel audit data comprising:
storing system call parameters or data that the system call parameters point to at the beginning of a system call; and
triggering data delivery at the end of the system call and generating an audit record and depositing the audit record in a circular buffer if, based on the success or failure of the system call, auditing of the system call should continue as specified in a post-call selection flag.
6. The method of claim 5 , wherein for each system call that accesses files, storing related file information.
7. The method of claim 6 , wherein related file information includes file owner or group and the file information is stored before any modifications occur that might affect the file information.
8. The method of claim 5 , wherein system call parameters that include path name parameters are stored with full path name information.
9. The method of claim 8 , comprising maintaining root and current directories while threads are in the middle of system call processing.
10. The method of claim 5 , further comprising reading audit records from the circular buffer.
11. The method of claim 10 , wherein the reading is triggered using a device read call.
12. The method of claim 5 , comprising maintaining system wide configuration related data structures and setting selection masks based on such structures for specifying data to be delivered.
13. The method of claim 5 , comprising collecting data in the system call path and formatting the collected data into an audit record.
14. The method of claim 13 , wherein the collected data is a token stream.
15. The method of claim 13 , comprising selecting which data to collect before said collecting step.
16. The method of claim 15 , wherein said selecting step can be based on process, user, group, filename information and/or time intervals.
17. The method of claim 15 , wherein said selecting step can be based on an outcome of system calls including pass, failure or both.
18. The method of claim 15 , comprising configuring which system calls are audited by making ioct1( ) (control) calls on a device driver.
19. The method of claim 5 , comprising if the circular buffer is full, then either reading some of the audit records from the circular buffer or dropping new records until space becomes available in the circular buffer.
20. The method of claim 5 , further comprising detecting hard link accesses to a critical file.
21. The method of claim 20 , comprising maintaining a critical file list for monitoring hard links.
22. The method of claim 5 , further comprising presenting delivered data to a user space via a device driver in the kernel.