2

auditctl is a great utility for monitoring many things, such as executed system calls.

I would ideally like to know either the CPU or the POSIX thread that instantiated each recorded system call. In the log, I see:

type=SYSCALL msg=audit(1561851079.335:286): arch=c000003e syscall=9 success=yes exit=140507297914880 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=22818 pid=24283 auid=1005 uid=1005 gid=1005 euid=1005 suid=1005 fsuid=1005 egid=1005 sgid=1005 fsgid=1005 tty=pts0 ses=89 comm="my_benchmark" exe="my_benchmark" key=(null)

I don't think any of these do the trick, unless I'm missing something. Does anyone know if what I want is possible? Thanks.

  • Depending on what you are trying to do, you might try systemtap as in this example to find what killed a process. – meuh Jun 30 at 8:39
1

Piping your audit line through ausearch -i at least gets the most information out of it:

» echo "type=SYSCALL msg=audit(1561851079.335:286): arch=c000003e syscall=9 success=yes exit=140507297914880 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=22818 pid=24283 auid=1005 uid=1005 gid=1005 euid=1005 suid=1005 fsuid=1005 egid=1005 sgid=1005 fsgid=1005 tty=pts0 ses=89 comm="my_benchmark" exe="my_benchmark" key=(null)" | ausearch -i
----
type=SYSCALL msg=audit(06/30/2019 01:31:19.335:286) : arch=x86_64 syscall=mmap success=yes exit=140507297914880 a0=0x0 a1=0x1000 a2=PROT_READ|PROT_WRITE a3=MAP_PRIVATE|MAP_ANONYMOUS items=0 ppid=22818 pid=24283 auid=unknown(1005) uid=unknown(1005) gid=dovenull euid=unknown(1005) suid=unknown(1005) fsuid=unknown(1005) egid=dovenull sgid=dovenull fsgid=dovenull tty=pts0 ses=89 comm=my_benchmark exe=my_benchmark key=(null)

AFAIK, the thread ID is only recorded for kernel-generated syscalls and is then placed in the pid field. Reference: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/app-audit_reference under pid:

The pid field semantics depend on the origin of the value in this field. In fields generated from user-space, this field holds a process ID. In fields generated by the kernel, this field holds a thread ID. The thread ID is equal to process ID for single-threaded processes. Note that the value of this thread ID is different from the values of pthread_t IDs used in user-space. For more information, see the gettid(2) man page.

I know no way of auditing thread ID's for user generated syscalls.

  • 1
    Thanks for your response. I ended up modifying the kernel source file auditsc.c, building and installing, simply to provide a TID in the log, as audit_log_format(ab, "arch=%x syscall=%d tid=%d"...) where the tid is given by an internal call to task_pid_vnr(current). This does exactly what I need! – ricky116 Jun 30 at 21:33
  • Wonderful! Isn't that just what we all love so much about open source software. – Edward Jul 1 at 5:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.