3811l1.orig100664 777 330 301 7104373133 12101 0ustar ljeditorljeditListing 1. Controlling unlink for unlink "/tmp/delme" { log "User " uid " tried to delete file " data; log "Process information :"; log_proc; answer = SKIP; } 3811l2.orig100664 777 330 212 7104373223 12103 0ustar ljeditorljeditListing 2. Booby Trap (redirecting) for exec "/sbin/ifconfig" { if (euid != 0) { redirect "/bin/date"; } 3811l3.orig100664 777 330 1472 7104373243 12137 0ustar ljeditorljeditListing 3. Virtual Spaces Example // Whole file system is in virtual space 2 (10 // binary) recursive for set "/" vs=0b10; // but /tmp is changed to be in VS 1 (01 binary) recursive for set "/tmp" vs=0b01; // for deletion of /tmp/delme for unlink "/tmp/delme" { // Log process info for this attempt log_proc; // Apply next setting to this process (rm) parent // (it's your shell) apply = A_FOR_PARENT; // or apply it for all processes with your login // id (uid) apply = A_FOR_LOGIN; // Put parent/all processes to virtual space 2 vs=0b10; // they can see (vss) just the second virtual // space, that means not the first vss=0b10; // return success to calling process (rm), but do // do not allow this operation. We are faking // success, so attacker can think he is // successful. To return error, use NO. answer = SKIP; } 3811l4.orig100664 777 330 576 7104373305 12123 0ustar ljeditorljeditListing 4. Disallowing Execution of suid Programs for exec "/usr/sbin/in.telnetd" { // Indicator, this process can't run suid // program flags = 1; // monitor, when he tries to run suid program procact = P_SEXEC; } // when sexec event appears on sexec { // is it disallowed process ? if (flags == 1) { // do not allow to run set uid program answer = NO; } 3811l5.orig100664 777 330 1430 7104373357 12141 0ustar ljeditorljeditListing 5. Network Monitoring // This defines subroutine (function) named doit function doit { // Log PID of process which is using network log "Process pid is using network "; // Here you can (dis)allow network connection, // change capabilities .... } // when syscall event raised on syscall { if (action == 102) { // If it's // socketcall, see man 2 // socketcall if ( trace1 == 1 /* SYS_SOCKET */ and lpeek trace2 $x /* verify_area() */ and $x == 2 /* PF_INET */ ) { // It's opening inet socket => call function doit doit; } else // Other syscalls are not interesting => // switch off tracing for them trace_off action; } 3811l6.orig100664 777 330 223 7104373402 12110 0ustar ljeditorljeditListing 6. Using Mlibc (Constable configuration) for unlink "/tmp/delme" { force "/home/robo/devel/medusa/exitme"; answer = NO; } 3811l7.orig100664 777 330 203 7104373426 12115 0ustar ljeditorljeditListing 7. Using Mlibc (force code source) #include "fc_std.h" #include "mlibc.h" void main(int argc, int *argv) { exit (0); }