Feature Updates
15
TTY Input Auditing
TTY input auditing
is now supported. If a process is marked for TTY input auditing, the data it
reads from TTYs is audited; this will show up on audit records with type
TTY
.
You can use the
pam_tty_audit
module to mark a process (and its child processes) for TTY
input auditing. For instructions on how to do this, refer to
man pam_tty_audit(8)
.
The TTY audit records contain the exact keystrokes read by the audited process. To make data
decoding easier,
bash
audits the exact command line using the record type
USER_TTY
.
The "TTY" audit records contain all data read by audited processes from the TTY. This includes
data inserted into the input stream by the
TIOCSTI ioctl
system call.
SystemTap Re-base
SystemTap has been re-based to version 0.7.2. This update of SystemTap introduces several
minor improvements, along with a few major features. These new features include:
• SystemTap now supports symbolic probing on x86, x86-64 and PowerPC architectures. This
enables SystemTap scripts to place probes into user-space applications and shared libraries. As
a result, SystemTap can now provide the same level of debugger probing on some user-space
applications as kernel probing.
For example, if
coreutils-debuginfo
is installed, you can print a callgraph of the
ls
command using
/usr/share/doc/systemtap-
version
/examples/general/
callgraph.stp
, as in:
stap para-callgraph.stp 'process("ls").function("*")' -c 'ls -l'
In order to reduce the likelihood of an undetected version mismatch between the binary
and its debuginfo RPMs, Red Hat advises that you set the
SYSTEMTAP_DEBUGINFO_PATH
environment variable to the value
+:.debug:/usr/lib/debug:build
.
SystemTap's support for symbolic probes also extends to markers placed into the kernel of this
release. To use these markers, load the
kernel-trace
kernel module in
/etc/rc.local
(using
modprobe kernel-trace
).
• SystemTap also supports remote compilation services. This enables a single computer on
the network to act as a debuginfo/compiler server for local SystemTap clients. The clients
auto-locate the server using mDNS (
avahi
), and only need the
systemtap-client
and
systemtap-runtime
packages to work.
At present, this feature does not use security mechanisms like encryption. As such, it is
advisable to use remote compilation services only within trusted networks. For more information,
refer to
man stap-server
.
• The kernel update for this release includes a kernel API extension that significantly improves
shutdown of SystemTap scripts. This added kernel API extension eliminates unnecessary
synchronization between individual probe removal operations. As a result, SystemTap scripts
that have hundreds of kernel probes are processed much faster.
This is especially useful for administrators that use scripts with probes containing wildcards that
capture numerous kernel events, such as
probe syscall.* {}
.
For a complete list of SystemTap updates included in this release, refer to the following URL:
Содержание ENTERPRISE LINUX 5.3 - RELEASE MANIFEST
Страница 240: ...240 ...
