Slashdot Mirror

← Back to Stories (view on slashdot.org)

Sebek2 - A Kernel-based Data Capture Tool

Posted by michael on from the i-spy-with-my-little-eye dept.

LogError writes "Sebek is a piece of code the lives entirely in kernel space and records either some or all data accessed by users on the system. This paper is a detailed discussion of Sebek, how it works and its value."

6 of 74 comments (clear)

  1. Mirror by Magus311X · · Score: 3, Informative

    Mirrored here: Sebek.pdf

    -----

  2. Re:Why the hell is this on Slashdot now? by Karamchand · · Score: 2, Informative

    IIRC the paper was last changed on 13th Sept 2003. So it is quite new. Not the tool itself (as the version number - remember, it was 2 - implies), but this paper about it.

  3. Re:re-incorporation? by Anonymous Coward · · Score: 3, Informative

    SELinux security modules are already in the vanilla 2.6-test kernels. The issuse of including all parts of SELinux has more to do with how well the code works with the rest of the kernel code. A good example of this is the current decision to use CryptoAPI instead of the long-standing kerneli patches. SELinux some code is already in the kernel without such a drastic rewrite, so more of it will likely find its way into the vanilla branch.

  4. Re:re-incorporation? by plcurechax · · Score: 2, Informative

    Why not just merge SELinux with Linux?

    SELinux is about mandatory access controls and control policy enforcement. See the SELinux FAQ for more info about SE Linux.

    Sebek (now version 2) is an kernel level logger. It does not stop users from doing anything. In fact if it did, that would make it useless for its primary job, as a tool for building HoneyNets, an controlled network of systems designed to be compromised by attackers, and the methods (and related) studied by security geeks.

  5. Probable origin of name? by deltagreen · · Score: 5, Informative

    I couldn't see it mentioned anywhere, but I found this on www.kemet.org, a site about the religious tradition of Ancient Egypt:

    Sebek (Sobek; G/R Suchos) - "Watching over You" Son of Nit (and also, according to some myths, Set), Sebek is either depicted as a full crocodile, or, less often, as a crocodile-headed man. He is often given the epithets of Heru-sa-Aset as a Netjer [manifestation of god] of protection, healing and vengeance over the wrongdoer. In some mythologies Sebek is a powerful and awe-inspiring denizen of the underworld, and was invoked to do away with annoyances and negative situations, in the phrase "to Sebek with it(him)!," much as modern-day slang consigns bothersome things and persons "to Hell."

  6. Re: SELinux by Anonymous Coward · · Score: 1, Informative

    "If SELinux merges with Linux, them I'm off to BSD, or somewhere where big brother is not."

    That was a really dumb statement.

    SELinux is merging with Linux, but it is an optional component, like ALSA or a NIC driver. It's a tool, and a useful one. Get over it.

    BTW, FreeBSD (arguably the most advanced BSD) already has a very similar framework, the "TrustedBSD Mandatory Access Control Framework." It does similar things as SELinux, and in fact has an optional port of the SELinux stuff in development. (I for one can't wait for it ;)

    SELinux and TrustedBSD are good things, and are also entirely optional. Get with the program.