Automated Response
Programming Guidelines
int pid;
/* Turn off root privilege but save euid */ if(
perror(“setresuid”);
exit(1);
}
/* Determine if a file modification alert */ if (atoi(argv[1]) == 2) {
/* Determine if the target of the attack is /etc/passwd */ if (strcmp(argv[17],”/etc/passwd”) == 0) {
/* Obtain process id */ pid = atoi(argv[11]); if (pid < 0) {
fprintf(stderr,”Unknown process modified /etc/passwd\n”,pid); | exit(1) |
;
}
fprintf(stderr,”Process %d running %s modified /etc/passwd\n”,pid,ar gv[24]);
/* Turn on root privilege */
if(
exit(1);
}
/* Kill offending process */
if (kill((pid_t)pid,SIGKILL) ==
exit(1);
}
fprintf(stderr,”Killed offending process %d\n”,pid);
/* Turn off root privilege */
if(
exit(1);
}
}
}
exit(0);
}
Solution C
/opt/ids/response/privC
A
/opt/ids/response/misc
Appendix B | 193 |