I know that MAC isn't really the right place to do this, but I'm investigating all possibilities. Is it possible to have tomoyo log more information about binaries that are exec'd? I know that it tracks the execution chain for all process starting with init, but is it possible to attach more information to the log tomoyo stores about each execve like the time and uid that executed it? Actually, does tomoyo already log the uid? The other question is would it be possible/easy to extract this information with user-land tools? Cheers, peter
TOMOYO
Fork