Security/Mentorships/MWoS/2014/Linux Audit heka plugin (Go)

Team

Introduction

We are a team of undergraduate students from Jaypee Institute of Information Technology who are passionate about Open Source and love developing something that can be useful to the community. We all are active member of Open Source Developers Club of our university. We got really excited when we first heard about MWOS, as it’s a great chance for us to work with such an amazing community. Having being contributed to open source organisation we know how it feels to develop software that will be used by the thousands of people and that is what motivates us towards MWOS.

Members

• Hardik Juneja
• Arun Sori
• Aalekh Nigam
• Professor: Sanjay Goel
• Mozilla Advisor: Guillaume Destuynder

Project

Heka is a Mozilla project for logs routing, analysis, etc. (see http://hekad.readthedocs.org/en/latest/). Linux Audit logs are collecting various system calls and events in order to send them to a C user space program (auditd) over the netlink protocol. A Mozilla C plugin (https://github.com/gdestuynder/audisp-cef and https://github.com/gdestuynder/audisp-json) currently correlate, transforms, and send these events back to our logging architecture.

Description

This project aims to deliver the same functionality as Linux Audit (auditd, audispd) + audisp-cef/json but in native Go as a plugin to Heka.

This means it will listen for events from the kernel via the Netlink protocol, parse the messages, convert them (to JSON using MozDef's native format), and pass them over to Heka.

Success Criteria

• Ability to process and forward audit events in pure Go from the kernel to Heka, as they would come out of audisp-json.

Updates

2014-08-11

Kick off meeting. (Etherpad Index) : https://etherpad.mozilla.org/YnR9hhqutn

Task for 2 weeks :

• Get familiar with GO (first week)
• explore Netlink protocol, play with it and see how we can use it.

<date>

• current work
• blocking points
• discussion points
• upcoming work