Linux: How to get notified of newly created sockets? -
i'm looking way notified immediately, in userspace, when new socket has been created. our existing implementation polling read on /proc/net/tcp , /proc/net/udp, not work short-lived sockets (e.g. send datagram , close).
you try:
- auditing
socket
orsocketcall
syscalls. if not usingaudit
daemon, requires writing netlink code. if want coexist other userspace trying access audit system, you'll need 3.15 kernel multicast netlink sockets. - writing custom linux security module uses favourite event mechanism notify userspace of new socket.
- doing system call or library call tracing, recursively, using
strace
orltrace
, if don't mind hackiness, raciness, , overhead. - replacing socket system calls shim layer. requires writing own kernel module.
- ftracing
function
tracer, , limiting functions trace either socket syscall, or type-specific initialization functions delegates to. - kprobing mentioned kernel functions of interest, , using favourite mechanism of notifying userspace.
Comments
Post a Comment