<!DOCTYPE html><html><head>
<style type="text/css">body { font-family:'Times New Roman'; font-size:13px}</style>
</head>
<body><div>Wouldn't x86 simply be a filter with 2 comparisons : one on a0 to filter only connect, and one on a3 for the sockaddr size ?</div><div><br></div><div>Basically, on x86 you have one rule : the one with 2 comparisons</div><div>On x64 you have 2 rules : one on the connect syscall, and one on the socketcall syscall with 2 comparisons</div><div><br></div><div>Thanks,</div><div><br></div><div>Hassan</div><div><br></div><div>On Thu, 05 Feb 2015 11:06:03 -0800, F Rafi <farhanible@gmail.com> wrote:<br></div><br><blockquote style="margin: 0 0 0.80ex; border-left: #0000FF 2px solid; padding-left: 1ex"><div dir="ltr">I did some digging and now I understand the different size variations of sockaddr_storage. I guess I can just filter on a2!=6e then.<div><br></div><div>And we'd have to keep an eye out for x86 systems. I understand that x86_64 does not use socketcall() but, do you know if multiarch support somehow allows 32bit apps on x86_64 to use / translate these calls?</div><div><br></div><div>Thanks again!</div><div>Farhan</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Feb 5, 2015 at 10:38 AM, Paul Moore <span dir="ltr"><<a href="mailto:paul@paul-moore.com" target="_blank">paul@paul-moore.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Thu, Feb 5, 2015 at 10:31 AM, F Rafi <<a href="mailto:farhanible@gmail.com">farhanible@gmail.com</a>> wrote:<br>
> Ahh..thanks Paul!<br>
><br>
> Is there a better way to intercept outbound network access calls while<br>
> avoiding af_unix?<br>
<br>
</span>I'm not sure, I'm not overly familiar with the auditd/auditctl<br>
filtering capabilities. There are several people on this list that<br>
are far more knowledgeable about that than me.<br>
<span class=""><br>
> I assume sockaddr_storage is just a different size (I think 128?)<br>
<br>
</span>The idea behind the sockaddr_storage struct was to create a structure<br>
that could be used to represent any address family that the system<br>
supports. I don't believe there is a standard size across OSes due to<br>
different level of support, padding, etc; in other words, it's<br>
probably best not to rely on a specific size of sockaddr_storage.<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
paul moore<br>
<a href="http://www.paul-moore.com" target="_blank">www.paul-moore.com</a><br>
</font></span></blockquote></div><br></div>
</blockquote><br><br><br></body></html>