Re: [Announce] Non Invasive Kernel Monitor for threads/processes

[Chris Wright <chrisw@osdl.org>]

* Sabharwal, Atul (atul.sabharwal@intel.com) wrote:
> 
> How does auditing work in the event of a process failure ? There would
> be
> no system call triggered in that case.  Also, my initial thoughts are 

Correct.  Currently the main audit user is selinux, which gets
indication of the process death from LSM.

> that the non-invasive Kmonitor is lesser performance impact when
> compared
> to auditing. I would spend some time developing sample code to confirm
> it.

Yes it's possible, but the audit context is per task, and can be
filtered per task, so overhead should only effect the tasks you care
about.

> I have not looked at the task ornament patch. If you could send me a
> link.

I have nothing more recent than you'll find in google, sorry.

thanks,
-chris
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net