RFC, aiding pid/network correlation

Hey all,

I'm interested in having a host-based monitoring mechanism in
place in the linux kernel. At this point I'm specifically looking
to tie any given packet seen on the network back to the process
that sent or received it. This is the sort of information our
incident responders are constantly asking for.

This patchset takes HONE [1], a kernel module originally written
by Brandon Carpenter and moves it to the security subdirectory
(Brandon isn't sending this upstream because of lack of funding
at work for his time to do so). Please excuse the mess; there are
lots of unfinished pieces because it seemed like a good idea to
get early feedback from the community on the general approach.

At a high level, HONE hooks process/socket creations/terminations
and inet/inet6 packets that are sent or received. A userspace
application can then correlate packet to process by reading the
events from the kernel. This patchset makes the events available
as text via debugfs in /sys/kernel/debug/hone/process or
/sys/kernel/debug/hone/packet while Brandon's version of HONE
combined the process/socket/packet events and made the events
available via /dev/hone in pcapng format (or as text via
/dev/honet).

This particular approach is all very experimental. We had a need
for this level of monitoring on some of our machines (did I
mention the incident responders?) and HONE had the best
features/efficiency.

So I'm humbly requesting comments.

 * Is there a better (more efficient/extensible) way to do this?
 * Is there already an existing mechanism to do this?
 * Is there any interest in something like this living in the
   kernel? Or is the dkms distributed path the way to go?

Finally, the linux-sensor project was released under the GPL but
I'm not sure if there are any copyright issues ... ? I've just
kept the copyright comments in any event.

This was tested against 3.15-rc8

[1] https://github.com/HoneProject/Linux-Sensor
      
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html