What is the modern way to develop a Linux auditing kernel module?
Clash Royale CLAN TAG#URR8PPP
up vote
4
down vote
favorite
I'm new to Linux Kernel development, and I am now assigned a task to develop a Linux kernel module, which can monitor the network, filesystem, USB and serial ports.
I am aware of the things like netfilter/iptables, libpcap, inotify and lse (linux security modules). I know there is always more than one way to skin a cat, especially in Linux world.
I am still wondering, what the proper way to do auditing things in Linux kernel nowadays is.
Any suggestion is appreciated.
security linux-kernel linux-audit
asked Dec 25 '17 at 11:48
haohaolee
1212
add a comment |Â
up vote
4
down vote
favorite
I'm new to Linux Kernel development, and I am now assigned a task to develop a Linux kernel module, which can monitor the network, filesystem, USB and serial ports.
I am aware of the things like netfilter/iptables, libpcap, inotify and lse (linux security modules). I know there is always more than one way to skin a cat, especially in Linux world.
I am still wondering, what the proper way to do auditing things in Linux kernel nowadays is.
Any suggestion is appreciated.
security linux-kernel linux-audit
asked Dec 25 '17 at 11:48
haohaolee
1212
auditdis a popular+modern approach to auditing such things. wiki.archlinux.org/index.php/Audit_framework
– steve
Dec 25 '17 at 12:14
@steve thanks will take a look at
– haohaolee
Dec 25 '17 at 14:48
add a comment |Â
up vote
4
down vote
favorite
up vote
4
down vote
favorite
I'm new to Linux Kernel development, and I am now assigned a task to develop a Linux kernel module, which can monitor the network, filesystem, USB and serial ports.
I am aware of the things like netfilter/iptables, libpcap, inotify and lse (linux security modules). I know there is always more than one way to skin a cat, especially in Linux world.
I am still wondering, what the proper way to do auditing things in Linux kernel nowadays is.
Any suggestion is appreciated.
security linux-kernel linux-audit
asked Dec 25 '17 at 11:48
haohaolee
1212
I'm new to Linux Kernel development, and I am now assigned a task to develop a Linux kernel module, which can monitor the network, filesystem, USB and serial ports.
I am aware of the things like netfilter/iptables, libpcap, inotify and lse (linux security modules). I know there is always more than one way to skin a cat, especially in Linux world.
I am still wondering, what the proper way to do auditing things in Linux kernel nowadays is.
Any suggestion is appreciated.
security linux-kernel linux-audit
asked Dec 25 '17 at 11:48
haohaolee
1212
asked Dec 25 '17 at 11:48
haohaolee
1212
asked Dec 25 '17 at 11:48
haohaolee
1212
asked Dec 25 '17 at 11:48
haohaolee
1212
1212
auditdis a popular+modern approach to auditing such things. wiki.archlinux.org/index.php/Audit_framework
– steve
Dec 25 '17 at 12:14
@steve thanks will take a look at
– haohaolee
Dec 25 '17 at 14:48
add a comment |Â
auditdis a popular+modern approach to auditing such things. wiki.archlinux.org/index.php/Audit_framework
– steve
Dec 25 '17 at 12:14
@steve thanks will take a look at
– haohaolee
Dec 25 '17 at 14:48
auditd is a popular+modern approach to auditing such things. wiki.archlinux.org/index.php/Audit_framework– steve
Dec 25 '17 at 12:14
auditd is a popular+modern approach to auditing such things. wiki.archlinux.org/index.php/Audit_framework– steve
Dec 25 '17 at 12:14
@steve thanks will take a look at
– haohaolee
Dec 25 '17 at 14:48
@steve thanks will take a look at
– haohaolee
Dec 25 '17 at 14:48
add a comment |Â
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f412944%2fwhat-is-the-modern-way-to-develop-a-linux-auditing-kernel-module%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
auditdis a popular+modern approach to auditing such things. wiki.archlinux.org/index.php/Audit_framework– steve
Dec 25 '17 at 12:14
@steve thanks will take a look at
– haohaolee
Dec 25 '17 at 14:48