search

samuraictf / gatekeeper

GATEKEEPER: Inline and on-target defense
119 stars 15 forks source link

inotify completion #11

Closed bool101 closed 9 years ago

bool101 commented 9 years ago

finish inotify detection, the processes when our flags are read.

bool101 commented 9 years ago

What are your thoughts on basically doing a kill -9 -1 for all process owned by the service user when inotify event is detected?

bool101 commented 9 years ago

Moving this out of gatekeeper "core" and into a bit of code that we can run once per service as the service user.

bool101 commented 9 years ago

Need to do kill -9 -1 on everything except our own inotify watcher pid.

bool101 commented 9 years ago

Complete, documented, will not kill self pid or ppid.