Linux netlink

1 kernel netlink
1.1 nlmon
nlmon.ko: CONFIG_NLMON=m
ip link add dev nlmon0 type nlmon
ip link set dev nlmon0 up
tcpdump -i nlmon0 -w nlmsg.pcap

In netlink_filter_tap() add the protocol NETLINK_KOBJECT_UEVENT, then nlmon can catch USB uevent.

1.2 API
netlink_kernel_create()
netlink_unicast()
netlink_broadcast()
netlink_has_listeners()

1.3 control buffer
struct sk_buff {
    [...]
    // NETLINK_CB control buffer
    char cb[48];
    [...]
    // nlmsghdr
    unsigned char *data;
    [...]
}

1.4 Port ID
struct sockaddr_nl.nl_pid
if nl_pid = 0, kernel will assign it.
struct nlmsghdr.nlmsg_pid
1) to kernel, nlmsg_pid = 0
2) to user space, nlmsg_pid = VALID Port ID
netlink select(): datagram_poll()

2 Android auditd
2.1 kernel配置
关闭selinux audit log messages:
BOARD_KERNEL_CMDLINE += audit=0

打开selinux audit log messages:
BOARD_KERNEL_CMDLINE += audit=1

2.2 logd
system/core/logd/libaudit.c
system/core/logd/libaudit.h

system/core/logd/main.cpp
bool auditd =
    __android_logger_property_get_bool(
        "ro.logd.auditd",
        BOOL_DEFAULT_TRUE);
ro.logd.auditd=false，就可以禁止logd访问NETLINK_AUDIT了。

使能logd访问NETLINK_AUDIT
ro.logd.auditd=true
ro.logd.auditd.dmesg=true
ro.logd.auditd.main=true
ro.logd.auditd.events=true

3 Linux auditd
3.1 移植要点
audit log写到文件函数：
src/auditd-event.c
write_to_log()

3.2 auditctl简单使用
monitor who remove my file
auditctl -w /data/mytest.txt
auditctl -l
auditctl -W data/mytest.txt
auditctl -l

monitor signal
auditctl -a always,exit -F arch=b64 -S kill -k test_kill

Which process sent SIGKILL (exe=) to the process being audited (opid= and ocomm=).

3.3 监控文件读写
auditctl -w /etc/passwd -p war -k password_file
-w 监控文件路径 /etc/passwd
-p 监控文件筛选： r（读）、w（写）、x（执行）、a（属性改变）
-k 筛选TAG，用于查询监控日志

3.4 URLs
nwhusted/AuditdAndroid
https://github.com/nwhusted/AuditdAndroid