Nathan N

When the database is updated, SIGRTMIN+n is sent to the `login` process from the kernel to update its cache. Even though the signal handler is registered and the signal is...

Linux LD_PRELOAD/LD_AUDIT library: Resolve stability workarounds

5

The following code block should be deleted by troubleshooting inconsistent behavior or glibc's linker profiling mode: https://github.com/WhiteBeamSec/WhiteBeam/blob/93d956c68fdc711c7813e58a28d68171d45bcfcf/src/library/platforms/linux/mod.rs#L273-L300 This issue can be broken down into three hooks: 1. *dlopen*: (as called...

Move WB_AUTH into session keyring on Linux

1

Currently the console secret is an environment variable that is inherited by process children. On Linux, the kernel's key management facility can store the secret so it can not be...

Packaging through WhiteBeam installer produces incorrect hash file

1

The resulting .SHA256 file produced by `cargo run package` contains a relative path to the WhiteBeam package, which will produce an error when run through `sha256sum -c` (or equivalent command)....

Tracking issue for an exhaustive test suite in WhiteBeam via `cargo run test`, supporting: 1. Compatibility tests (libc hook positive and negative tests with Prevention disabled and enabled respectively) 2....

Extend whitelist to include parent process path alongside current process path

2

There are scenarios where the child runs programs and/or writes files which wouldn't be desirable under most conditions. For example, the development version of WhiteBeam allows [36 programs](https://github.com/WhiteBeamSec/SQL/blob/e56ea0299c6e3003c9387c9caa9b788471464aa1/sql/platforms/linux/base/ubuntu_20.04.sql#L94-L130) to be...

Linux LD_PRELOAD/LD_AUDIT library: Missing program name

1

Some executables are missing a name in log files and baselines (missing `WB_PROG` environment variable?). Erroneous output: ``` | Detection: executed /usr/lib/ubuntu-advantage/apt-esm-hook (VerifyCanExecute) | 3 | | Detection: accessed file...

Linux LD_PRELOAD/LD_AUDIT library: Permission denied with path in Detection mode

1

Files that do not exist are improperly returning "Permission denied" instead of "No such file or directory". Erroneous output: ``` root@host:~# /example WhiteBeam: /example: Permission denied root@host:~# ./example WhiteBeam: ./example:...

The [WhiteBeam Wiki](https://github.com/WhiteBeamSec/WhiteBeam/wiki) needs the following pages: - Design: https://github.com/WhiteBeamSec/WhiteBeam/wiki/Design - Clarify Actions - Compatibility guide - Manual (PDF)

Certain processes lag, which may related to syslog: https://github.com/WhiteBeamSec/WhiteBeam/blob/93d956c68fdc711c7813e58a28d68171d45bcfcf/src/library/common/event.rs#L66-L67 Examples include: - `Uninitialized urandom read` from udevd - Random services hung on boot - `locale-check` zombie process - Random lag...