While talking to Tomas about measuring the impact of auditing, he gave me a nice call flow tree which I thought I'd share.
This is how it syscall auditing looks (for intel):
+ dosyscall()
|
+ syscall_entry()
| |
| + pre_syscall() (if t_pre_sys set)
| |
| + audit_start() (if audit_active set)
| |
| + au_init
| | |
| | + aui_*()
| + auditme() (to audit or not to audit)
| + au_start
| |
| + aus_*()
|
...
|
|
+ syscall_exit()
| |
| + post_syscall()
| |
| + audit_finish() (if audit_active set)
| |
| + au_finish
| |
| + auf_*()
...
Update: the ASCII graph was hand crafted
[Technorati Tags: OpenSolaris Security ]
Did you use a script to create the ASCII art ? If "yes" ... is there a way to get the script ?
Posted by Roland Mainz on August 24, 2007 at 07:35 PM PDT #