From owner-freebsd-hackers@FreeBSD.ORG Mon Oct 30 06:31:18 2006 Return-Path: X-Original-To: freebsd-hackers@freebsd.org Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 441F916A412 for ; Mon, 30 Oct 2006 06:31:18 +0000 (UTC) (envelope-from ganbold@micom.mng.net) Received: from publicd.ub.mng.net (publicd.ub.mng.net [202.179.0.88]) by mx1.FreeBSD.org (Postfix) with ESMTP id 41C7743D7B for ; Mon, 30 Oct 2006 06:31:11 +0000 (GMT) (envelope-from ganbold@micom.mng.net) Received: from [202.179.0.164] (helo=[192.168.0.18]) by publicd.ub.mng.net with esmtpa (Exim 4.63 (FreeBSD)) (envelope-from ) id 1GeQfl-0009LR-Sr; Mon, 30 Oct 2006 14:31:01 +0800 Message-ID: <45459C25.1060909@micom.mng.net> Date: Mon, 30 Oct 2006 14:31:01 +0800 From: Ganbold User-Agent: Thunderbird 1.5.0.4 (X11/20060612) MIME-Version: 1.0 To: Dave Clausen References: <45458BBE.6030103@endlessdream.org> In-Reply-To: <45458BBE.6030103@endlessdream.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: freebsd-hackers@freebsd.org Subject: Re: Process arguments X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Oct 2006 06:31:18 -0000 Dave Clausen wrote: > Hello list, > > I'm a n00b to the FreeBSD kernel and I'm trying to log all commands > run on the command line from within the kernel for security purposes > by loading a kernel module which redefines execve(). I've > successfully created the KLD and have it working, but am having > problems saving the command's arguments. > Could anyone point me to where in the kernel I should be looking for > the arguments sent to the process? p->p_args gives me the parent > process's cmdname only (sh, in this case), and uap->argv is just the > relative pathname of uap->fname. Ideally, I'd like the user, full > command line, and cwd logged for each command entered. > > Here's an example of what I've been working away on: > > int > new_execve (struct thread *td, struct execve_args *uap) > { > char *user; > struct proc *p = td->td_proc; > > user = p->p_pgrp->pg_session->s_login; > if (p->p_ucred->cr_ruid == 1001) { > printf("%s %d %s\n", user, p->p_pid, uap->fname); > } > return (execve(td,uap)); > } > > Running 'ls -al' with the above, I get the username, pid, and absolute > filename printed such as, but can't find the actual arguments: > dave 6689 /bin/ls If I'm not mistaken pjd@ has written similar module which is called lrexec for RELENG_4 and RELENG_5. See his web site. Also recently rwatson@ enabled audit support in RELENG_6 and CURRENT, though I don't know yet whether it can log arguments. hth, Ganbold > > Any help would be appreciated. > > > _______________________________________________ > freebsd-hackers@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-hackers > To unsubscribe, send any mail to > "freebsd-hackers-unsubscribe@freebsd.org" > > >