Re: Core Dump as an Intrusion Event

[Kev <klmitch () MIT EDU>]

> A better solution would be a kernel patch that hooks into the SIGSEGV
> signal handler and logs all segmentation faults. A predefined list of
> programs can be monitored. Maybe it's fesable to log segfaults of all
> root processes.

Only if you combine the latter with the former; many daemons setuid(),
say to user nobody, but you still want to be able to detect intrusion
attempts.
--
Kevin L. Mitchell <klmitch () mit edu>