Re: Core Dump as an Intrusion Event

[Daniel Roesen <droesen () ENTIRE-SYSTEMS COM>]

On Sun, Oct 08, 2000 at 10:41:05PM +0300, Jarno Huuskonen wrote:
> What about adding some code so it can be controlled thru the proc filesystem ?
> Like enabling/disabling logging, log only certain programs etc.
> (echo 1 > /proc/sys/kernel/core-logging)
> Does this sound feasible/sensible ?

I'm working on this. Logging of coredumps (names core.<processname>.<pid>)
to syslog (via klogd) is already in place, it just needs the sysctl
interface.


Best regards,
Daniel

--
----------------------------------------------------------------------
entire systems GmbH         | droesen () entire-systems com
Internet Services           | Phone: +49 2624 9550-55
Ferbachstrasse 12           | Fax:   +49 2624 9550-20
D-56203 Hoehr-Grenzhausen   | http://www.entire-systems.com/
----------------------------------------------------------------------