1 signal知识 shell $?返回值大于128时，表示该脚本收到了signal 2 ftrace 2.1 Enable kill ftrace 2.1.1 Method 1 echo nop > /sys/kernel/debug/tracing/current_tracer echo 1 > /sys/kernel/debug/tracing/events/syscalls/sys_enter_kill/enable echo 1 > /sys/kernel/debug/tracing/events/syscalls/sys_exit_kill/enable echo 1 > /sys/kernel/debug/tracing/tracing_on cat /sys/kernel/debug/tracing/trace_pipe 2.1.2 Method 2 echo nop > /sys/kernel/debug/tracing/current_tracer echo syscalls:sys_enter_kill >> /sys/kernel/debug/tracing/set_event echo syscalls:sys_exit_kill >> /sys/kernel/debug/tracing/set_event echo 1 > /sys/kernel/debug/tracing/tracing_on cat /sys/kernel/debug/tracing/trace_pipe 2.2 Disable kill ftrace echo 0 > /sys/kernel/debug/tracing/tracing_on echo 0 > /sys/kernel/debug/tracing/events/syscalls/sys_exit_kill/enable echo 0 > /sys/kernel/debug/tracing/events/syscalls/sys_enter_kill/enable echo nop > /sys/kernel/debug/tracing/current_tracer 3 kernel netlink API netlink_kernel_create() netlink_unicast() netlink_broadcast() netlink_has_listeners() 4 Android auditd 4.1 kernel配置 关闭selinux audit log messages: BOARD_KERNEL_CMDLINE += audit=0 打开selinux audit log messages: BOARD_KERNEL_CMDLINE += audit=1 4.2 logd system/core/logd/libaudit.c system/core/logd/libaudit.h system/core/logd/main.cpp bool auditd = __android_logger_property_get_bool("ro.logd.auditd", BOOL_DEFAULT_TRUE); ro.logd.auditd=false，就可以禁止logd访问NETLINK_AUDIT了。 使能logd访问NETLINK_AUDIT ro.logd.auditd=true ro.logd.auditd.dmesg=true ro.logd.auditd.main=true ro.logd.auditd.events=true 5 Linux auditd 5.1 移植要点 audit log写到文件函数： src/auditd-event.c write_to_log() 5.2 auditctl简单使用 monitor who remove my file auditctl -w /data/mytest.txt auditctl -l auditctl -W data/mytest.txt auditctl -l monitor signal auditctl -a always,exit -F arch=b64 -S kill -k test_kill 5.3 监控文件读写 auditctl -w /etc/passwd -p war -k password_file -w 监控文件路径 /etc/passwd -p 监控文件筛选： r（读）、w（写）、x（执行）、a（属性改变） -k 筛选TAG，用于查询监控日志 5.4 URLs nwhusted/AuditdAndroid https://github.com/nwhusted/AuditdAndroid
