{"action":"created","issue":{"url":"https://api.github.com/repos/linux-audit/audit-kernel/issues/77","repository_url":"https://api.github.com/repos/linux-audit/audit-kernel","labels_url":"https://api.github.com/repos/linux-audit/audit-kernel/issues/77/labels{/name}","comments_url":"https://api.github.com/repos/linux-audit/audit-kernel/issues/77/comments","events_url":"https://api.github.com/repos/linux-audit/audit-kernel/issues/77/events","html_url":"https://github.com/linux-audit/audit-kernel/issues/77","id":300800744,"number":77,"title":"RFE: UUID For Parent/Child PID's","user":{"login":"aconite33","id":3675886,"avatar_url":"https://avatars2.githubusercontent.com/u/3675886?v=4","gravatar_id":"","url":"https://api.github.com/users/aconite33","html_url":"https://github.com/aconite33","followers_url":"https://api.github.com/users/aconite33/followers","following_url":"https://api.github.com/users/aconite33/following{/other_user}","gists_url":"https://api.github.com/users/aconite33/gists{/gist_id}","starred_url":"https://api.github.com/users/aconite33/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aconite33/subscriptions","organizations_url":"https://api.github.com/users/aconite33/orgs","repos_url":"https://api.github.com/users/aconite33/repos","events_url":"https://api.github.com/users/aconite33/events{/privacy}","received_events_url":"https://api.github.com/users/aconite33/received_events","type":"User","site_admin":false},"labels":[{"id":331379351,"url":"https://api.github.com/repos/linux-audit/audit-kernel/labels/enhancement","name":"enhancement","color":"84b6eb","default":true},{"id":386134194,"url":"https://api.github.com/repos/linux-audit/audit-kernel/labels/priority/low","name":"priority/low","color":"fbe68e","default":false},{"id":331379354,"url":"https://api.github.com/repos/linux-audit/audit-kernel/labels/question","name":"question","color":"cc317c","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2018-02-27T21:32:23Z","updated_at":"2018-02-28T15:07:34Z","closed_at":null,"author_association":"NONE","body":"# Universally Unique Identifier for PIDS and child PIDS\r\n\r\nHello, hopefully I can dictate my issue I'm running into with Auditd.\r\nIf there is a solution to this that I'm not aware of, I'd be very interested in it.\r\n\r\n### Problem Statement:\r\n**Inability to uniquely trace a process's parent/child relationship.**\r\n\r\nCompared to other logging mechanisms on Windows/AIX you can walk the chain uniquely on a mountain of log data.\r\n\r\n#### TL;DR\r\n\r\nAdd a parent UUID to audit message logs (Potentially audit ID) in the process creation (e.g., EXECVE, 59) so that a user can uniquely track the parent/child relationship of process creating/execution.\r\n\r\n_Example Walkthrough:_\r\n\r\nUsing a combination of auditd, syslog, rsyslog, and Elastic Stack, admins can log a variety of information. One example is tracing the \"chain\" of a parent/children relationship of a process. If an admin wants to trace a process's life from the last child to the first parent, you can trace it through PID/PPID relationship. This can be done using auditd with rules like this:\r\n\r\n```\r\n-a always,exit -F arch=b64 -S execve\r\n-a always,exit -F arch=b32 -S execve\r\n```\r\n\r\nThis will record every SYSCALL for a creation of a new process (EXECVE, 59).\r\nSample output:\r\n```\r\ntype=SYSCALL msg=audit(1519764807.147:9736): arch=c000003e syscall=59 success=yes exit=0 a0=91d048 a1=91d548 a2=81c008 a3=598 items=2 ppid=3380 pid=7158 auid=4294967295 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts18 ses=4294967295 comm=\"id\" exe=\"/usr/bin/id\" key=(null)\r\n```\r\n\r\nTracing this can be done using the PID/PPID values to look for its parent. In this simple case, you would be looking for a process created with PID=3380 with syscall 59 (EXECVE).\r\n\r\n```\r\nausearch -p 3380 -sc 59\r\n```\r\n\r\nWhich will pull information regarding the creation of this particular process and its parent:\r\n\r\n```\r\ntime->Tue Feb 27 14:17:16 2018\r\ntype=PROCTITLE msg=audit(1519759036.158:2738): proctitle=\"/bin/bash\"\r\ntype=PATH msg=audit(1519759036.158:2738): item=1 name=\"/lib64/ld-linux-x86-64.so.2\" inode=137575 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL\r\ntype=PATH msg=audit(1519759036.158:2738): item=0 name=\"/bin/bash\" inode=568565 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL\r\ntype=CWD msg=audit(1519759036.158:2738):  cwd=\"/home/user1\"\r\ntype=EXECVE msg=audit(1519759036.158:2738): argc=1 a0=\"/bin/bash\"\r\ntype=SYSCALL msg=audit(1519759036.158:2738): arch=c000003e syscall=59 success=yes exit=0 a0=1355d40 a1=1349ce8 a2=1359c90 a3=7ffff787cef0 items=2 ppid=3202 pid=3380 auid=4294967295 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts18 ses=4294967295 comm=\"bash\" exe=\"/bin/bash\" key=(null)\r\n```\r\n\r\n### Problem\r\nWhen there are multiple logs to dig through, the PID/PPID could have been cycled over the uptime of the server/system. \r\nE.g., a system with uptime over a week, trying to track down the parent process of a process may overlap with other PIDs. \r\nSSH daemon process is a good example of a long running process that may cycle it's PID's when trying to see all what a user did when they logged in to the system.\r\n\r\n\r\nIf a user is nefarious and tries compromise the system, tracking the user from exploit process to originating process can become cumbersome and guess work at times.\r\n\r\n\r\n### Solution?\r\n\r\nCreating a UUID that can be associated with both the child and the parent can allow admins/DFIR to look into following the chain of events uniquely through the different process chains to discover the originating \"entry\" point of the process tree. (If enough log data, tracing it back to the root process).\r\n\r\n\r\n\r\n### Comparison\r\n\r\n**Windows**\r\nWindows OS, when using sysmon, can uniquely trace each process creation from the parent to the child. They use this by having a ProcessGUID associated with the [Process Create event](https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-1-process-creation).\r\n\r\n**AIX**\r\nAIX does this with a [PROC_CREATE](https://www-01.ibm.com/support/docview.wss?uid=isg3T1000212#4) message that is generated when a new process is launched.\r\n\r\n\r\nI think it would be useful to have this type of logging mechanism so Linux users can benefit from tracking the chain of processes uniquely, instead of what I've experienced as guesswork at times to follow a process chain to its originating source.\r\n"},"comment":{"url":"https://api.github.com/repos/linux-audit/audit-kernel/issues/comments/369268373","html_url":"https://github.com/linux-audit/audit-kernel/issues/77#issuecomment-369268373","issue_url":"https://api.github.com/repos/linux-audit/audit-kernel/issues/77","id":369268373,"user":{"login":"rgbriggs","id":2224635,"avatar_url":"https://avatars3.githubusercontent.com/u/2224635?v=4","gravatar_id":"","url":"https://api.github.com/users/rgbriggs","html_url":"https://github.com/rgbriggs","followers_url":"https://api.github.com/users/rgbriggs/followers","following_url":"https://api.github.com/users/rgbriggs/following{/other_user}","gists_url":"https://api.github.com/users/rgbriggs/gists{/gist_id}","starred_url":"https://api.github.com/users/rgbriggs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rgbriggs/subscriptions","organizations_url":"https://api.github.com/users/rgbriggs/orgs","repos_url":"https://api.github.com/users/rgbriggs/repos","events_url":"https://api.github.com/users/rgbriggs/events{/privacy}","received_events_url":"https://api.github.com/users/rgbriggs/received_events","type":"User","site_admin":false},"created_at":"2018-02-28T15:07:34Z","updated_at":"2018-02-28T15:07:34Z","author_association":"CONTRIBUTOR","body":"On 2018-02-28 03:23, aconite33 wrote:\n> By having a UUID/Hash of the Parent & Child processes and including it\n> in the 59 (EXECVE) syscall would solve this issue, as then I can track\n> each process from it's parent/child relationship. I don't think you\n> would need auditd to keep track of the processes over time, just\n> having a hash value that can be calculated every time a new process is\n> spawned would be sufficient. Though I'm not sure of the overhead that\n> would be to calculate it every time a process is launched.\n\nSince it doesn't have to be cryptographically strong, it need not be a\ncomputationally expensive hash function.  Such values could be exposed\nin an auxiliary audit record that can be filtered or ignored for those\nwho don't need it, or even use the feature enable/disable switch to shut\nit off.\n"}}
{"actor":{"display_login":"rgbriggs"}}