OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Core Dump as an Intrusion Event
From: Kev (klmitchMIT.EDU)
Date: Fri Oct 06 2000 - 09:08:15 CDT

> A better solution would be a kernel patch that hooks into the SIGSEGV
> signal handler and logs all segmentation faults. A predefined list of
> programs can be monitored. Maybe it's fesable to log segfaults of all
> root processes.

Only if you combine the latter with the former; many daemons setuid(),
say to user nobody, but you still want to be able to detect intrusion
attempts. 

--
Kevin L. Mitchell <klmitchmit.edu>