Skip to content

System calls underlying CDM events

Jump to bottom
Ashish Gehani edited this page Feb 28, 2018 · 15 revisions

SPADE's CDM Storage translates OPM relations from the Audit Reporter into CDM events. The table below summarizes the audited system calls and corresponding CDM events emitted.

System call CDM event
clone() EVENT_CLONE
or
EVENT_FORK
fork()
vfork()		 EVENT_FORK
setuid()
setreuid()
setresuid()
setfsuid()
setgid()
setregid()
setresgid()
setfsgid()		 EVENT_CHANGE_PRINCIPAL
exit()
exit_group()		 EVENT_EXIT
accept()
accept4()		 EVENT_ACCEPT
pread()
preadv()
read()
readv()		 EVENT_READ
recvfrom()
recvmsg()		 EVENT_RECVMSG
chmod()
fchmod()
fchmodat()		 EVENT_MODIFY_FILE_ATTRIBUTES
connect() EVENT_CONNECT
ftruncate()
truncate()		 EVENT_TRUNCATE
mprotect() EVENT_MPROTECT
sendto()
sendmsg()		 EVENT_SENDMSG
unlink()
unlinkat()		 EVENT_UNLINK
close() EVENT_CLOSE
execve() EVENT_EXECUTE
and
EVENT_LOADLIBRARY
link()
linkat()
symlink()
symlinkat()		 EVENT_LINK
mmap() EVENT_MMAP
open()
openat()		 EVENT_OPEN
or
EVENT_CREATE_OBJECT
creat() EVENT_CREATE_OBJECT
pwrite()
pwritev()
write()
writev()		 EVENT_WRITE
and
EVENT_UPDATE
rename()
renameat()		 EVENT_RENAME
tee()
splice()
vmsplice()
init_module()
finit_module()		 EVENT_OTHER***
bind()
dup()
dup2()
dup3()
mknod()
mknodat()
pipe()
pipe2()
socket()
fcntl()		 None*
kill()** EVENT_UNIT

*Interpretation has indirect effect.

**Only BEEP events, not signals, are reported.

***No matching event in CDM18.

This material is based upon work supported by the National Science Foundation under Grants OCI-0722068, IIS-1116414, and ACI-1547467. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the National Science Foundation.

Clone this wiki locally