Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

New event: kext load #16

Open
droe opened this issue Jun 16, 2018 · 2 comments
Open

New event: kext load #16

droe opened this issue Jun 16, 2018 · 2 comments
Labels
status:blocked depends on other unresolved issue, github or external type:feature request for additional functionality

Comments

@droe
Copy link
Owner

droe commented Jun 16, 2018 •
edited
Loading

Add new event for kext loads. Not covered by audit(4), need to identify a good method to acquire this event. Analysis of kextd source might reveal some insights.
@droe droe added status:analysis-needed solution unclear, needs analysis by a developer type:feature request for additional functionality labels Jun 16, 2018
@droe droe mentioned this issue Jul 5, 2018
Open
@droe droe changed the title New event for kext load New event: kext load Jul 23, 2018
@droe
Copy link
Owner Author

droe commented Jul 29, 2018

A file-based solution can detect properly installed kexts, but uid 0 can load kexts from anywhere if the bundle is owned by root on disk, those are not captured. Watching kextstat would give us loaded kexts, but not which process loaded it. Ideal would be an audit(4) event reporting kext loads (filed as radar 42712435).

@droe droe added status:blocked depends on other unresolved issue, github or external labels Jul 29, 2018
@droe
Copy link
Owner Author

droe commented Aug 1, 2018

File-based partial solution depends on #26.

@droe droe removed the status:analysis-needed solution unclear, needs analysis by a developer label Aug 1, 2018
@droe droe removed the label Sep 21, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
status:blocked depends on other unresolved issue, github or external type:feature request for additional functionality
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@droe