Join Log in
Score:1
avatar Server

Log execve's, along with parent process argv?

us flag
d33tah

I'm trying to figure out if I can decomission an old server. I need the information about automated processes running there. So far I tried the following:

auditctl -a exit,always -F arch=b64  -S execve -k any-commands

At log analysis stage, I discovered two pieces of context missing:

  1. How did those programs get executed? What process was their parent and what was its argv?
  2. Where did the stdin/stdout go? Ideally I'd love to see the shell command reconstructed, but I know I'm probably asking for too much, so at least having pipe descriptor ID would do (so that I can try to re-construct it with my own scripts).

How can I approach such a problem?

48
1 + 1
Michael Hampton avatar
cz flag
Michael Hampton
That information isn't available in the execve system call. Perhaps you should be tracking other syscalls, like clone or open.
0
Reply
Score:1
avatar Server
br flag
Simon Richter

The execve system call replaces the current process. If a program wants to retain control after starting another program, it needs to create a new process first (using fork or vfork) that then calls execve.

The open file descriptors and permissions are taken over when the program image is replaced in execve (except those marked with the CLOEXEC flag), so open files are inherited from the parent process during fork, then modified between fork and execve (e.g. using dup2), and then finally filtered during the execve call.

So getting a complete picture from audit data will be difficult.

0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.