Catching process termination on SIGKILL
Steve Grubb
sgrubb at redhat.com
Tue Jan 27 00:41:18 UTC 2015
On Monday, January 26, 2015 03:14:20 PM hsultan at thefroid.net wrote:
> So I'm curious, auditd catches abnormal process termination (SIGSEGV,
> ...) with a 1701 audit message, can catch 'clean' termination by
> monitoring syscall (exit, exitgroup), however I don't see anything to
> catch process termination by a SIGKILL.
> if I audit the kill() system call then I see the call to send the
> signal, but I would have expected the system to offer auditing of an
> actual SIGKILL *reception* (because you can pass -1 as target PID to
> sigkill, which kills all processes reachable by the caller and will make
> auditing by syscall very hard to do), am I missing something ?
I don't think so.
> Is there a parameter to set somehow that I'm missing ?
No. This would probably need some kind of kernel patch to enable. Its never
really come up that anyone would want to monitor for this. Typically the
monitoring is on the sending side rather than the receiving side.
We collect anything that leads to a core dump because that is an anomally. No
one should have segfaulting code on a production system. However, the kernel
does not allow a SIGKILL to be delivered to processes the user has no rights
to send it to, so its not really an abnormal event. I could see someone maybe
wanting to monitor this, but its never been a priority to solve this problem.
-Steve
More information about the Linux-audit
mailing list