Messages in this thread | | | From | (David Wagner) | Subject | Re: RFC - Kernel Process Firewall | Date | Tue, 30 Dec 2003 23:49:58 +0000 (UTC) |
| |
raj wrote: >I have been working on a project called "Kernel Process Firewall (KPF)" >that is nearing completion. The goal of the project is to provide users >the ability to trace, monitor and control the system calls made by any >process.
Some comments:
1) There's a great deal of related and prior work in this area. Take a look, for instance, at Janus, consh, MapBox, SubDomain, Ostia, ... http://www.cs.berkeley.edu/~daw/janus/ 2) There are some real problems with using system call interception for this purpose. There are TOCTTOU races, synchronization issues, ... http://www.stanford.edu/~talg/papers/pubs.html 3) Have you looked at the LSM (Linux Security Modules) project? It looks to me like this is what you want to be using, and it avoids the problems with system call interposition. http://lsm.immunix.org/ - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |