-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathindex.html
More file actions
1525 lines (1266 loc) · 71.2 KB
/
index.html
File metadata and controls
1525 lines (1266 loc) · 71.2 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-us" lang="en-us">
<head>
<script async src="https://www.googletagmanager.com/gtag/js?id=UA-83032453-1"></script>
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('js', new Date());
gtag('config', 'UA-83032453-1');
</script>
<meta name="generator" content="Hugo 0.78.2" />
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1">
<title>CamFlow: practical whole-system provenance for Linux</title>
<meta name="description" content="CamFlow is a practical whole-system provenance capture mechanism for the Linux operating system."/>
<meta property=og:site_name content="CamFlow">
<meta property=og:url content="http://camflow.org/">
<meta property=og:title content="CamFlow: practical whole-system provenance for Linux">
<meta property=og:description content="CamFlow is a practical whole-system provenance capture mechanism for the Linux operating system.">
<meta property=og:image content="http://camflow.org/images/ubc.jpg">
<meta property=og:locale content="en-us">
<meta property=twitter:site content="@tfjmp">
<meta property=twitter:creator content="@tfjmp">
<meta name="twitter:title" content="CamFlow: practical whole-system provenance for Linux">
<meta name="twitter:description" content="CamFlow is a practical whole-system provenance capture mechanism for the Linux operating system.">
<meta name="twitter:image" content="http://camflow.org/images/ubc.jpg">
<meta name="twitter:card" content="summary">
<link rel="shortcut icon" href="favicon.ico" type="image/x-icon">
<link href="https://fonts.googleapis.com/css?family=Open+Sans" rel="stylesheet">
<link rel="stylesheet" href="https://camflow.org/css/styles.css">
<link href="https://camflow.org/index.xml" rel="alternate" type="application/rss+xml" title="CamFlow" />
</head>
<body>
<div class="sidebar sidebar-blue">
<div class="navigation">
<div>
</div>
<h1 class="site-title"><a href="https://camflow.org/">CamFlow</a></h1>
<nav class="internal">
<ul>
<li>
<a href="#about">CamFlow project</a>
<ul>
<li><a href="#support">Support</a></li>
<li><a href="#contributing">Contributing</a></li>
</ul>
</li>
<li>
<a href="#installation">Installation</a>
<ul>
<li><a href="#package">Package manager</a></li>
<li><a href="#source">From source</a></li>
<li><a href="#vagrant">Vagrant</a></li>
<li><a href="#reboot">Reboot and GRUB</a></li>
</ul>
</li>
<li>
<a href="#tutorial">Quick start</a>
<ul>
<li><a href="#graph">Provenance graph</a></li>
<li><a href="#overview">Architecture overview</a></li>
<li><a href="#walk">Walk-through</a></li>
</ul>
</li>
<li>
<a href="#configuration">Configuration</a>
<ul>
<li><a href="#capture">Capture configuration</a></li>
<li><a href="#recording">Recording configuration</a></li>
</ul>
</li>
<li>
<a href="#output_format">Output format</a>
<ul>
<li><a href="#examples">Examples</a></li>
<li><a href="#attributes">Attributes</a></li>
<li><a href="#formal">Formal modelling</a></li>
</ul>
</li>
<li>
<a href="#query">CamQuery</a>
</li>
<li>
<a href="#publications">Publications</a>
<ul>
<li><a href="#publications_capture">Capture</a></li>
<li><a href="#publications_usecases">Applications</a></li>
</ul>
</li>
</ul>
</nav>
<nav class="external">
<div class="external-title">Learn more</div>
<ul id="shortcuts">
<li>
<a href="https://github.com/CamFlow" target="_blank" rel="noopener">CamFlow on Github</a>
</li>
<li>
<a href="https://github.com/CamFlow/website/issues" target="_blank" rel="noopener">Create issue regarding the documentation</a>
</li>
</ul>
</nav>
</div>
<div class="version">
generated on Sep 5, 2023
</div>
</div>
<div class="content">
<section class="page" id="about">
<h1>
<a href="#about">CamFlow project</a>
</h1>
<div class="content">
<p>CamFlow stands for <strong>Cam</strong>bridge information <strong>Flow</strong> architecture, the Cam is also the river that flows through Cambridge, UK.
CamFlow is a <a href="https://www.kernel.org/doc/Documentation/security/LSM.txt">Linux Security Module</a> (LSM) designed to capture data provenance for the purpose of system audit.
The whole-system provenance capture mechanism is highly configurable, and can fit the needs of many different type of applications.
CamFlow can stack with existing security modules such as <a href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/5/html/deployment_guide/ch-selinux">SELinux</a>.</p>
<!-- raw HTML omitted -->
<p>To get in touch about the project, please contact <a href="https://tfjmp.org">Thomas Pasquier</a>.</p>
<!-- raw HTML omitted -->
</div>
</section>
<section class="page" id="support">
<h1>
<a href="#support">Support</a>
</h1>
<div class="content">
<p>CamFlow development started in 2014 at the University of Cambridge’s <a href="https://www.cl.cam.ac.uk/research/srg/opera/">Opera Research Group</a> (grant <a href="http://gow.epsrc.ac.uk/NGBOViewGrant.aspx?GrantRef=EP/K011510/1">EPSRC EP/K011510/1</a>).
Further development has been supported by Harvard University’s <a href="https://crcs.seas.harvard.edu/">Center for Research on Computation and Society</a> as part of the <a href="https://projects.iq.harvard.edu/provenance-at-harvard">Provenance@Harvard</a> project (NSF grant <a href="https://nsf.gov/awardsearch/showAward?AWD_ID=1450277">SSI-1450277</a>) and the University of Cambridge’s <a href="https://www.cl.cam.ac.uk/research/dtg/www/">Digital Technology Group</a>.
Development is currently being supported by the <a href="https://systopia.cs.ubc.ca/">University of British Columbia</a>.</p>
<!-- raw HTML omitted -->
<!-- raw HTML omitted -->
<!-- raw HTML omitted -->
<p>Thanks to <a href="https://cloudsmith.com/">Cloudsmith</a> for hosting our packages.</p>
</div>
</section>
<section class="page" id="contributing">
<h1>
<a href="#contributing">Contributing</a>
</h1>
<div class="content">
<p>The easiest way to contribute to CamFlow is by submitting issues to suggest improvements or report bugs. When reporting a bug, please specify the version of CamFlow you are running and your Linux distribution. To contribute a new feature, please fork the repository of the component you wish to improve, and submit a pull request against the dev branch. The pull request must pass the continuous integration test before it can be merged.</p>
</div>
</section>
<section class="page" id="installation">
<h1>
<a href="#installation">Installation</a>
</h1>
<div class="content">
<p>There are three main options covered below for how to install CamFlow:</p>
<ol>
<li>using the package manager on Fedora <strong>this is the recommended route</strong>;</li>
<li>building the kernel on the local machine; or</li>
<li>using <a href="https://www.vagrantup.com/">vagrant</a> to set up a virtual machine.
The installation process can take a significant amount of time depending on your
machine/network configuration.
If you plan to use VM we suggest to use a recent machine with at least 16GB of RAM
and 20GB of disk space.</li>
</ol>
<!-- raw HTML omitted -->
<p>CamFlow is an academic project. While CamFlow is actively maintained, an operating system
is a complex environment with a multitude of moving parts and our resources are limited.
CamFlow is mostly tested in virtualized environment and we do not have the resources
for extensive test.
Please, get in touch with
<a href="https://tfjmp.org/">Thomas Pasquier</a>
if you encounter any issue.</p>
<!-- raw HTML omitted -->
</div>
</section>
<section class="page" id="package">
<h1>
<a href="#package">Package manager</a>
</h1>
<div class="content">
<p>The quickest way to install CamFlow is through the packages hosted on <strong><a href="https://cloudsmith.io/~camflow/repos/camflow/packages/">cloudsmith</a></strong>. For now, only Fedora is supported (please, click on this <a href="https://cloudsmith.io/~camflow/repos/camflow/packages/">link</a> and check which release(s) is/are currently supported).</p>
<h3 id="fedora">Fedora</h3>
<div class="highlight"><pre style="color:#272822;background-color:#fafafa;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-BASH" data-lang="BASH">curl -1sLf <span style="color:#d88200">'https://dl.cloudsmith.io/public/camflow/camflow/cfg/setup/bash.rpm.sh'</span> <span style="color:#111">|</span> sudo -E bash
sudo dnf -y install camflow
</code></pre></div><h3 id="after-installing-packages">After installing packages</h3>
<p>Next we need to activate the two CamFlow services:</p>
<div class="highlight"><pre style="color:#272822;background-color:#fafafa;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-BASH" data-lang="BASH">sudo systemctl <span style="color:#111">enable</span> camconfd.service
sudo systemctl <span style="color:#111">enable</span> camflowd.service
</code></pre></div><p>After reboot we should be ready to use CamFlow.</p>
<div class="highlight"><pre style="color:#272822;background-color:#fafafa;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-BASH" data-lang="BASH">sudo reboot now
</code></pre></div><!-- raw HTML omitted -->
<p>Packages are tested in virtual environment with a limited set of configurations.
In most cases things work fine.
However, if you encounter any issue, please do look at how to build the project from source.</p>
<!-- raw HTML omitted -->
</div>
</section>
<section class="page" id="source">
<h1>
<a href="#source">From source</a>
</h1>
<div class="content">
<h3 id="dependencies">Dependencies</h3>
<p>First we need to install the dependencies required to build our kernel.</p>
<p>Depending on how recent your OS version is, you should install <code>libelf-dev</code>, <code>libelf-devel</code>, or <code>elfutils-libelf-devel</code>.
See this <a href="https://github.com/CamFlow/documentation/issues/3">issue</a> for details.</p>
<h4 id="fedora">Fedora</h4>
<div class="highlight"><pre style="color:#272822;background-color:#fafafa;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-BASH" data-lang="BASH">sudo dnf groupinstall <span style="color:#d88200">'Development Tools'</span>
sudo dnf install ncurses-devel cmake clang gcc-c++ wget git openssl-devel zlib
sudo dnf install patch mosquitto bison flex ruby dwarves elfutils-libelf-devel
sudo dnf install uthash-devel inih-devel paho-c-devel
</code></pre></div><h3 id="building-and-installing-the-kernel">Building and Installing the kernel</h3>
<p>We first need to clone the <code>camflow-install</code> repository:</p>
<div class="highlight"><pre style="color:#272822;background-color:#fafafa;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-BASH" data-lang="BASH">git clone https://github.com/CamFlow/camflow-install
</code></pre></div><p>We then get the installation started:</p>
<div class="highlight"><pre style="color:#272822;background-color:#fafafa;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-BASH" data-lang="BASH"><span style="color:#111">cd</span> camflow-install
make all
</code></pre></div><p>This will build and install the CamFlow Linux Security Module as well as the userspace tools. The whole installation procedure may take a significant amount of time. The installation process may ask for the root password, so may not complete in an unattended manner.</p>
<p>Early in the build process you will be presented with a GUI to customise the kernel configuration. If you are not sure what to do, do not modify the configuration.
Through this GUI, in addition to enabling provenance capture, you can: 1) set persistence of provenance state on/off (off by default)
and 2) whole-system capture from boot on/off (off by default).
The kernel configuration derives from the configuration currently presents on the system where you run the build, consequently in most cases you should not need to modify anything not relating to provenance capture.</p>
<!-- raw HTML omitted -->
<p>Configuration options need to be carefully considered in resource-constrained environment.</p>
<!-- raw HTML omitted -->
<!-- raw HTML omitted -->
<p>Kernel version 5.1.x saw the modification of Linux Security Module stacking.
It is important to ensure that CamFlow is properly loaded and is processed last.</p>
<p>During the configuration stage, select the <code>Security options</code>:</p>
<p><img src="./images/security_options.png" alt="Select “Security options”."></p>
<p>Then select the list at the bottom of the menu:</p>
<p><img src="./images/list.png" alt="Select the list at the bottom of the menu."></p>
<p><code>provenance</code> <strong>must</strong> be listed and <strong>should</strong> appear last (i.e. you should add it to the list):</p>
<p><img src="./images/last.png" alt="provenance should be listed and appear last."></p>
<p>If <code>provenance</code> is not listed, CamFlow module will simply not be loaded.</p>
<!-- raw HTML omitted -->
<p>For the installation process to take effect you need to reboot the machine.</p>
<div class="highlight"><pre style="color:#272822;background-color:#fafafa;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-BASH" data-lang="BASH">sudo reboot now
</code></pre></div>
</div>
</section>
<section class="page" id="vagrant">
<h1>
<a href="#vagrant">Vagrant</a>
</h1>
<div class="content">
<p>Using a vagrant virtual machine is much simpler. First you need to install <a href="https://www.vagrantup.com/docs/installation/">vagrant</a> and <a href="https://www.virtualbox.org/manual/ch02.html">virtualbox</a>.</p>
<p>On Ubuntu, for example, that can be done as follows:</p>
<div class="highlight"><pre style="color:#272822;background-color:#fafafa;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-BASH" data-lang="BASH">sudo apt-get install virtualbox
sudo apt-get install vagrant
</code></pre></div><!-- raw HTML omitted -->
<p>Some Linux distributions ship very outdated version of VirtualBox or Vagrant.
Outdated versions, and host/guest version mismatch are known to cause all sorts of troubles during provisioning.</p>
<p>Please check <a href="https://www.vagrantup.com/downloads.html">Vagrant</a> and <a href="https://www.virtualbox.org/wiki/Downloads">VirtualBox</a> for details on how to install the latest version.</p>
<!-- raw HTML omitted -->
<p>Once vagrant and virtualbox are installed, you need to obtain CamFlow vagrant provision script:</p>
<div class="highlight"><pre style="color:#272822;background-color:#fafafa;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-BASH" data-lang="BASH">git clone https://github.com/CamFlow/vagrant.git
<span style="color:#111">cd</span> ./vagrant
</code></pre></div><p>There are different provisioning scripts available within the <code>CamFlow/vagrant.git</code> repository: please see in the <a href="https://github.com/CamFlow/vagrant">camflow/vagrant</a> for details on what they do. We will use the <code>rpm</code> provisioning script as an example:</p>
<div class="highlight"><pre style="color:#272822;background-color:#fafafa;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-BASH" data-lang="BASH"><span style="color:#111">cd</span> ./rpm
vagrant plugin install vagrant-vbguest
vagrant up
<span style="color:#75715e"># we reboot after the provisioning</span>
vagrant reload
</code></pre></div><p>You can customize the <code>Vagrantfile</code> to personalize your experience.</p>
<!-- raw HTML omitted -->
<p>Running virtual machines is resource consuming. Please, make sure the host has sufficient resource to do so (disk space, RAM, CPU etc.).</p>
<!-- raw HTML omitted -->
</div>
</section>
<section class="page" id="reboot">
<h1>
<a href="#reboot">Reboot and GRUB</a>
</h1>
<div class="content">
<p>When booting a VM after successful provisioning, ensure that the CamFlow kernel
is chosen in the <a href="https://www.gnu.org/software/grub/">GRUB</a> menu, as illustrated
bellow:</p>
<p><img src="./images/grub.png" alt="Select CamFlow kernel in the GRUB menu."></p>
</div>
</section>
<section class="page" id="tutorial">
<h1>
<a href="#tutorial">Quick start</a>
</h1>
<div class="content">
</div>
</section>
<section class="page" id="graph">
<h1>
<a href="#graph">Provenance graph</a>
</h1>
<div class="content">
<p>CamFlow represents the execution of a system as a directed acyclic graph.
Vertices in the graph represent states of kernel objects (e.g. threads, files, sockets etc…) and relations represent flow of information between those states.</p>
<p><a href="./images/graph.pdf"><img src="./images/graph.png" alt="CamFlow graph overview" title="CamFlow graph overview"></a></p>
<p>In the above example <code>process 1</code> clone <code>process 2</code>.
<code>process 2</code> write to a <code>pipe</code>.
<code>process 1</code> read from the same <code>pipe</code>.
Version are created to guarantees acyclicity and to represent proper odering of information (see our <a href="http://camflow.org/publications/ccs-2018.pdf">CCS'18 paper</a> for details).</p>
<!-- raw HTML omitted -->
<p>Further description of the provenance are discussed in the <a href="#output_format">output section</a>.</p>
<!-- raw HTML omitted -->
</div>
</section>
<section class="page" id="overview">
<h1>
<a href="#overview">Architecture overview</a>
</h1>
<div class="content">
<p><a href="./images/arch.pdf"><img src="./images/arch.png" alt="CamFlow architecture overview" title="CamFlow architecture overview"></a></p>
<p><strong>CamFlow capture mechanism:</strong> CamFlow is an implementation of the <a href="http://patrickmcdaniel.org/pubs/acsac12.pdf">whole-system provenance concept</a>.
The idea is to perform provenance capture from the OS perspective, while providing guarantees about its completeness.
This is achieved by relying on the OS <a href="https://en.wikipedia.org/wiki/Reference_monitor">reference monitor</a> that capture interactions between user level applications and kernel objects.
CamFlow is implemented in the Linux kernel and relies on the <a href="https://www.kernel.org/doc/Documentation/security/LSM.txt">Linux Security Module framework</a> and the <a href="https://en.wikipedia.org/wiki/Netfilter">NetFilter framework</a> to effect the capture.
<a href="https://github.com/CamFlow/camflow-dev">source code</a></p>
<p><strong>camflowd:</strong> <code>camflowd</code> is a daemon charged of recording the provenance captured in the kernel by CamFlow.
The provenance records are published by CamFlow to <a href="https://lwn.net/Articles/174669/">relayfs</a> pseudo files.
The daemons retrieve those records, serialise them to a configuration-specified format and write them to a configuration-specified output.
<a href="https://github.com/CamFlow/camflowd">source code</a></p>
<!-- raw HTML omitted -->
<p>Configuration details are discussed in the <a href="#recording">recording configuration section</a>.</p>
<!-- raw HTML omitted -->
<p><strong>camconfd:</strong> <code>camconfd</code> is a daemon charged with configuring the in-kernel capture mechanism.
The configuration daemon reads from <code>/etc/camflow.ini</code> and load the specified configuration into the kernel via a <a href="https://lwn.net/Articles/153366/">securityfs</a> interface.
<a href="https://github.com/CamFlow/camconfd">source code</a></p>
<!-- raw HTML omitted -->
<p>Configuration details are discussed in the <a href="#capture">capture configuration section</a>.</p>
<!-- raw HTML omitted -->
<p><strong>camflow-cli:</strong> CamFlow CLI (<code>camflow</code>) allows to dynamically modify the capture configuration through the command line. Further details are given in <a href="#walk">our walk through tutorial</a>.
<a href="https://github.com/CamFlow/camflow-cli">source code</a></p>
<p><strong>libprovenance:</strong> is a C library implementing userspace utility functions to interact with CamFlow <a href="https://lwn.net/Articles/174669/">relayfs</a> and <a href="https://lwn.net/Articles/153366/">securityfs</a> interfaces.
<a href="https://github.com/CamFlow/libprovenance">source code</a></p>
</div>
</section>
<section class="page" id="walk">
<h1>
<a href="#walk">Walk-through</a>
</h1>
<div class="content">
<p>In this walk-through we explore how to capture and look at the provenance generated by <code>wget</code>. The tutorial assumes that CamFlow has been installed and is running on a Fedora machine, and that the reader has some familiarity with <a href="./publications/socc-2017.pdf">our paper describing linux provenance capture (ACM SoCC'17)</a>.</p>
<!-- raw HTML omitted -->
<p>You can install <code>nano</code> to easily edit files from the command line:</p>
<pre><code>$ sudo dnf install nano
</code></pre><!-- raw HTML omitted -->
<p>First we should verify that our kernel indeed contains CamFlow:</p>
<pre><code>$ uname -r
X.X.Xcamflow_Y.Y.Y
</code></pre><p>X.X.X corresponds to the kernel version, and Y.Y.Y to CamFlow version.</p>
<p>You can check system events relating to CamFlow as follows:</p>
<pre><code>$ journalctl -b -0 | grep camflow
</code></pre><p>We next check the configuration options that are available to us:</p>
<pre><code>$ camflow -h
-h
usage.
-v
version.
-s
print provenance capture state.
-c
print out current configuration (can copy content in /etc/camflow.ini).
-e <bool>
enable/disable provenance capture.
-a <bool>
activate/deactivate whole-system provenance capture.
--compress-node <bool>
activate/deactivate node compression.
--compress-edge <bool>
activate/deactivate edge compression.
--duplicate <bool>
activate/deactivate duplication.
--file <filename>
display provenance info of a file.
--track-file <filename> <false/true/propagate>
set tracking.
--label-file <filename> <string>
applies label to the file.
--opaque-file <filename> <bool>
mark/unmark the file as opaque.
--process <pid>
display provenance info of a process.
--track-process <pid> <false/true/propagate>
set tracking.
--label-process <pid> <string>
applies label to the process.
--opaque-process <pid> <bool>
mark/unmark the process as opaque.
--track-ipv4-ingress <ip/mask:port> <track/propagate/record/delete>
track/propagate on bind.
--track-ipv4-egress <ip/mask:port> <track/propagate/record/delete>
track/propagate on connect.
--track-secctx <security context> <track/propagate/opaque/delete>
track/propagate based on security context.
--track-cgroup <cgroup ino> <track/propagate/delete>
track/propagate based on cgroup.
--track-user <user name> <track/propagate/opaque/delete>
track/propagate based on user.
--track-group <group name> <track/propagate/opaque/delete>
track/propagate based on group.
--node-filter <type> <bool>
set node filter.
--edge-filter <type> <bool>
set edge filter.
--node-propagate-filter <type> <bool>
set propagate node filter.
--edge-propagate-filter <type> <bool>
set propagate edge filter.
--reset-filter
reset filters.
--channel <string>
create a new relay channel (in /sys/kernel/debug/<string>).
--change-epoch
change epoch.
</code></pre><p>We should check the current configuration state:</p>
<pre><code>$ camflow -s
Machine id: 1491436164
Policy hash: A49BD19BB2C51FF5C19CF4C3878531C59DFCA6956334620E537B978498625
Provenance capture:
- capture enabled;
- all disabled;
- provenance was captured;
- node compression enabled;
- edge compression enabled;
- duplication disabled;
Node filter (4000c80):
inode_unknown
directory
char
envp
Derived filter (0):
Generated filter (0):
Used filter (0):
Informed filter (0):
Propagate node filter (0):
Propagate derived filter (0):
Propagate generated filter (0):
Propagate used filter (0):
Propagate informed filter (0):
IPv4 ingress filter (0).
IPv4 egress filter (0).
Security context filter (0).
Namespace filter (0).
User filter (0).
Group filter (0).
</code></pre><p>The policy hash is based on the CamFlow version and the currently loaded capture policy. It can be used to quickly verify that two machines are running the same capture policy. It can also be obtained with <code>camflow -p</code>.</p>
<p>Let’s try to capture the provenance generated by the well known tool <code>wget</code>. We want to track and propagate provenance from its executable. We can do so as follows:</p>
<pre><code>$ sudo camflow --track-file /bin/wget true
</code></pre><p>If we run <code>wget</code>, we should be able to obtain some provenance data:</p>
<pre><code>$ wget www.google.com
$ tail /tmp/audit.log
{"prefix":{"prov" : "http://www.w3.org/ns/prov", "cf":"http://www.camflow.org"}, "activity":{"cf:AQAAAAAAAEBW5AEAAAAAABwAAAAHfl4eEAAAAAAAAAA=":{"cf:id":"123990","prov:type":"task","cf:boot_id":28,"cf:machine_id":"cf:509509127","cf:version":16,"cf:date":"2017:09:25T21:11:46","cf:jiffies":"4296340808","cf:uid":1000,"cf:gid":1000,"cf:pid":2578,"cf:vpid":2578,"cf:utsns":4026531838,"cf:ipcns":4026531839,"cf:mntns":4026531840,"cf:pidns":4026531836,"cf:netns":4026531993,"cf:cgroupns":4026531835,"cf:secctx":"unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023","cf:utime":"2329176","cf:stime":"5129935","cf:vm":"1839908","cf:rss":"150492","cf:hw_vm":"1841252","cf:hw_rss":"222676","cf:rbytes":"6860800","cf:wbytes":"0","cf:cancel_wbytes":"0","prov:label":"[task] 16"}}, "entity":{"cf:AAAIAAAAACCrXAMAAAAAABwAAAAHfl4eAAAAAAAAAAA=":{"cf:id":"220331","prov:type":"file_name","cf:boot_id":28,"cf:machine_id":"cf:509509127","cf:version":0,"cf:date":"2017:09:25T21:11:46","cf:jiffies":"4296339739","cf:pathname":"/usr/share/atom/atom","prov:label":"[path] /usr/share/atom/atom"},"cf:AAAIAAAAACCkXAMAAAAAABwAAAAHfl4eAAAAAAAAAAA=":{"cf:id":"220324","prov:type":"file_name","cf:boot_id":28,"cf:machine_id":"cf:509509127","cf:version":0,"cf:date":"2017:09:25T21:11:46","cf:jiffies":"4296339724","cf:pathname":"/usr/share/publicsuffix/public_suffix_list.dafsa","prov:label":"[path] /usr/share/publicsuffix/public_suffix_list.dafsa"},"cf:AACAAAAAACCmXAMAAAAAABwAAAAHfl4eAAAAAAAAAAA=":{"cf:id":"220326","prov:type":"xattr","cf:boot_id":28,"cf:machine_id":"cf:509509127","cf:version":0,"cf:date":"2017:09:25T21:11:46","cf:jiffies":"4296339736","cf:name":"user.xdg.origin.url","cf:size":22,"cf:flags":"0x0","prov:label":"[xattr] user.xdg.origin.url"},"cf:AAAIAAAAACCnXAMAAAAAABwAAAAHfl4eAAAAAAAAAAA=":{"cf:id":"220327","prov:type":"file_name","cf:boot_id":28,"cf:machine_id":"cf:509509127","cf:version":0,"cf:date":"2017:09:25T21:11:46","cf:jiffies":"4296339736","cf:pathname":"/home/vagrant/workspace/camflow-dev/build/camflow-cli/index.html","prov:label":"[path] /home/vagrant/workspace/camflow-dev/build/camflow-cli/index.html"},"cf:ABAAAAAAACBq5AEAAAAAABwAAAAHfl4eCwAAAAAAAAA=":{"cf:id":"124010","prov:type":"fifo","cf:boot_id":28,"cf:machine_id":"cf:509509127","cf:version":11,"cf:date":"2017:09:25T21:11:46","cf:jiffies":"4296340808","cf:uid":1000,"cf:gid":1000,"cf:mode":"0x1180","cf:secctx":"unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023","cf:ino":39081,"cf:uuid":"e2392e0f-dab3-94bc-feb1-d1975fb2ea3e","prov:label":"[fifo] 11"}}, "used":{"cf:AAAAAgAAIID+AgAAAAAAABwAAAAHfl4eAAAAAAAAAAA=":{"cf:id":"766","prov:type":"read","cf:boot_id":28,"cf:machine_id":"cf:509509127","cf:date":"2017:09:25T21:11:46","cf:jiffies":"4296340808","prov:label":"read","cf:allowed":"true","prov:entity":"cf:ABAAAAAAACBq5AEAAAAAABwAAAAHfl4eCwAAAAAAAAA=","prov:activity":"cf:AQAAAAAAAEBW5AEAAAAAABwAAAAHfl4eEAAAAAAAAAA="}}, "wasGeneratedBy":{"cf:ACAAAAAAQID8AgAAAAAAABwAAAAHfl4eAAAAAAAAAAA=":{"cf:id":"764","prov:type":"write","cf:boot_id":28,"cf:machine_id":"cf:509509127","cf:date":"2017:09:25T21:11:46","cf:jiffies":"4296340808","prov:label":"write","cf:allowed":"true","prov:activity":"cf:AQAAAAAAAEBW5AEAAAAAABwAAAAHfl4eDwAAAAAAAAA=","prov:entity":"cf:ABAAAAAAACBq5AEAAAAAABwAAAAHfl4eCwAAAAAAAAA="}}, "wasInformedBy":{"cf:AAAAAACAEID9AgAAAAAAABwAAAAHfl4eAAAAAAAAAAA=":{"cf:id":"765","prov:type":"version_activity","cf:boot_id":28,"cf:machine_id":"cf:509509127","cf:date":"2017:09:25T21:11:46","cf:jiffies":"4296340808","prov:label":"version_activity","cf:allowed":"true","prov:informant":"cf:AQAAAAAAAEBW5AEAAAAAABwAAAAHfl4eDwAAAAAAAAA=","prov:informed":"cf:AQAAAAAAAEBW5AEAAAAAABwAAAAHfl4eEAAAAAAAAAA="}}, "wasDerivedFrom":{"cf:AgAAAAAAgID7AgAAAAAAABwAAAAHfl4eAAAAAAAAAAA=":{"cf:id":"763","prov:type":"version_entity","cf:boot_id":28,"cf:machine_id":"cf:509509127","cf:date":"2017:09:25T21:11:46","cf:jiffies":"4296340808","prov:label":"version_entity","cf:allowed":"true","prov:usedEntity":"cf:ABAAAAAAACBq5AEAAAAAABwAAAAHfl4eCgAAAAAAAAA=","prov:generatedEntity":"cf:ABAAAAAAACBq5AEAAAAAABwAAAAHfl4eCwAAAAAAAAA="}}}
</code></pre><p>We can see that some provenance JSON has indeed been generated. You can check <a href="#output_format">here</a> to see what this data means. Publishing the provenance is the job of <code>camflowd</code>, let’s look at its configuration to understand what it is doing:</p>
<pre><code>$ cat /etc/camflowd.ini
[general]
; output=null
; output=mqtt
; output=unix_socket
; output=fifo
output=log
format=w3c
;format=spade_json
[log]
path=/tmp/audit.log
[mqtt]
address=m12.cloudmqtt.com:17065
username=camflow
password=test
; message delivered: 0 at most once, 1 at least once, 2 exactly once
qos=2
[unix]
address=/tmp/camflowd.sock
[fifo]
path=/tmp/camflowd-pipe
</code></pre><p>The system is clearly configured to publish the provenance to a log file, and this file has been specified to be <code>/tmp/audit.log</code>. If we were to publish our provenance to MQTT, we could visualise it in real time on our <a href="http://camflow.org/demo">demo website</a>. Note that changes to <code>camflowd</code> configuration require the system or the service to be restarted.</p>
<p>We have seen that we can edit the capture configuration via the command line. If we want something a bit more permanent and practical, we can edit <code>/etc/camflow.ini</code>. This file is read during the boot process by the <code>camconfd</code> service, and is used to set the capture policy. Let’s have a look at this configuration file:</p>
<pre><code>$ cat /etc/camflow.ini
[provenance]
;unique identifier for the machine, use hostid if set to 0
machine_id=0
;enable provenance capture
enabled=true
;record provenance of all kernel object
all=false
node_filter=directory
node_filter=inode_unknown
node_filter=char
node_filter=envp
; propagate_node_filter=directory
; relation_filter=sh_read
; relation_filter=sh_write
; propagate_relation_filter=write
[compression]
; enable node compression
node=true
edge=true
duplicate=false
[file]
;set opaque file
opaque=/usr/bin/bash
;set tracked file
;track=/home/thomas/test.o
;propagate=/home/thomas/test.o
[ipv4−egress]
;propagate=0.0.0.0/0:80
;propagate=0.0.0.0/0:404
;record exchanged with local server
;record=127.0.0.1/32:80
[ipv4−ingress]
;propagate=0.0.0.0/0:80
;propagate=0.0.0.0/0:404
;record exchanged with local server
;record=127.0.0.1/32:80
[user]
;track=vagrant
;propagate=vagrant
;opaque=vagrant
[group]
;track=vagrant
;propagate=vagrant
;opaque=vagrant
[secctx]
;track=system_u:object_r:bin_t:s0
;propagate=system_u:object_r:bin_t:s0
;opaque=system_u:object_r:bin_t:s0
</code></pre>
</div>
</section>
<section class="page" id="configuration">
<h1>
<a href="#configuration">Configuration</a>
</h1>
<div class="content">
</div>
</section>
<section class="page" id="capture">
<h1>
<a href="#capture">Capture configuration</a>
</h1>
<div class="content">
<h2 id="sample-configuration">Sample configuration</h2>
<p>One of the strengths of CamFlow is the ability to fine-tune the provenance information it captures.
Edit <code>/etc/camflow.ini</code> to modify the capture configuration.
To apply a new configuration, reboot the machine.</p>
<!-- raw HTML omitted -->
<p>Alternatively when developing policy you can experiment using <code>camflow</code> CLI (see <code>camflow -h</code>).
Policies defined through the CLI are not persisted in current release.</p>
<!-- raw HTML omitted -->
<p>Follows a sample <code>/etc/camflow.ini</code> configuration:</p>
<div class="highlight"><pre style="color:#272822;background-color:#fafafa;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-INI" data-lang="INI"><span style="color:#00a8c8">[provenance]</span>
<span style="color:#75715e">;unique identifier for the machine, use hostid if set to 0</span>
<span style="color:#75af00">machine_id</span><span style="color:#f92672">=</span><span style="color:#d88200">0</span>
<span style="color:#75715e">;enable provenance capture</span>
<span style="color:#75af00">enabled</span><span style="color:#f92672">=</span><span style="color:#d88200">true</span>
<span style="color:#75715e">;record provenance of all kernel object</span>
<span style="color:#75af00">all</span><span style="color:#f92672">=</span><span style="color:#d88200">false</span>
<span style="color:#75af00">node_filter</span><span style="color:#f92672">=</span><span style="color:#d88200">directory</span>
<span style="color:#75af00">node_filter</span><span style="color:#f92672">=</span><span style="color:#d88200">inode_unknown</span>
<span style="color:#75af00">node_filter</span><span style="color:#f92672">=</span><span style="color:#d88200">char</span>
<span style="color:#75af00">node_filter</span><span style="color:#f92672">=</span><span style="color:#d88200">envp</span>
<span style="color:#75715e">; propagate_node_filter=directory</span>
<span style="color:#75715e">; relation_filter=sh_read</span>
<span style="color:#75715e">; relation_filter=sh_write</span>
<span style="color:#75715e">; propagate_relation_filter=write</span>
<span style="color:#00a8c8">[compression]</span>
<span style="color:#75715e">; enable/disable versioning</span>
<span style="color:#75af00">version</span><span style="color:#f92672">=</span><span style="color:#d88200">true</span>
<span style="color:#75715e">; enable node compression</span>
<span style="color:#75af00">node</span><span style="color:#f92672">=</span><span style="color:#d88200">true</span>
<span style="color:#75715e">; enable edge compression</span>
<span style="color:#75af00">edge</span><span style="color:#f92672">=</span><span style="color:#d88200">true</span>
<span style="color:#75af00">duplicate</span><span style="color:#f92672">=</span><span style="color:#d88200">false</span>
<span style="color:#00a8c8">[file]</span>
<span style="color:#75715e">;set opaque file</span>
<span style="color:#75af00">opaque</span><span style="color:#f92672">=</span><span style="color:#d88200">/usr/bin/bash</span>
<span style="color:#75715e">;set tracked file</span>
<span style="color:#75715e">;track=/home/thomas/test.o</span>
<span style="color:#75715e">;propagate=/home/thomas/test.o</span>
<span style="color:#00a8c8">[ipv4−egress]</span>
<span style="color:#75715e">;propagate=0.0.0.0/0:80</span>
<span style="color:#75715e">;propagate=0.0.0.0/0:404</span>
<span style="color:#75715e">;record exchanged with local server</span>
<span style="color:#75715e">;record=127.0.0.1/32:80</span>
<span style="color:#00a8c8">[ipv4−ingress]</span>
<span style="color:#75715e">;propagate=0.0.0.0/0:80</span>
<span style="color:#75715e">;propagate=0.0.0.0/0:404</span>
<span style="color:#75715e">;record exchanged with local server</span>
<span style="color:#75715e">;record=127.0.0.1/32:80</span>
<span style="color:#00a8c8">[user]</span>
<span style="color:#75715e">;track=vagrant</span>
<span style="color:#75715e">;propagate=vagrant</span>
<span style="color:#75715e">;opaque=vagrant</span>
<span style="color:#00a8c8">[group]</span>
<span style="color:#75715e">;track=vagrant</span>
<span style="color:#75715e">;propagate=vagrant</span>
<span style="color:#75715e">;opaque=vagrant</span>
<span style="color:#00a8c8">[secctx]</span>
<span style="color:#75715e">;track=system_u:object_r:bin_t:s0</span>
<span style="color:#75715e">;propagate=system_u:object_r:bin_t:s0</span>
<span style="color:#75715e">;opaque=system_u:object_r:bin_t:s0</span>
<span style="color:#00a8c8">[relay]</span>
<span style="color:#75715e">; those parameters set the size of the kernel relay buffer</span>
<span style="color:#75715e">; more info about relay here:</span>
<span style="color:#75715e">; https://www.kernel.org/doc/html/latest/filesystems/relay.html</span>
<span style="color:#75715e">; size of relay buffer is equal to (1 << buff_exp) * subuf_nb</span>
<span style="color:#75715e">; you may want to change this value if you observe event drops</span>
<span style="color:#75715e">; (i.e. graph with missing edges and nodes), you can check drops</span>
<span style="color:#75715e">; through the command:</span>
<span style="color:#75715e">; camflow --drop</span>
<span style="color:#75715e">; be careful when changing those values.</span>
<span style="color:#75af00">buff_exp</span><span style="color:#f92672">=</span><span style="color:#d88200">20</span>
<span style="color:#75af00">subuf_nb</span><span style="color:#f92672">=</span><span style="color:#d88200">8</span>
</code></pre></div><h2 id="configuration-parameters">Configuration parameters</h2>
<p>Following is a list of the parameters and their effects, broken down by section.
A “boolean” parameter accepts values “true” or “false”.</p>
<h3 id="provenance">provenance</h3>
<table>
<thead>
<tr>
<th>parameter</th>
<th>description</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>machine_id</code></td>
<td>unique identifier for the machine in provenance records, use hostid if set to 0</td>
</tr>
<tr>
<td><code>enabled</code></td>
<td>boolean; enable provenance capture? if false, the rest of the parameters do not matter</td>
</tr>
<tr>
<td><code>all</code></td>
<td>boolean; capture provenance of all kernel objects?</td>
</tr>
<tr>
<td><code>node_filter</code></td>
<td>do not capture this kind of node (i.e. vertex)</td>
</tr>
<tr>
<td><code>relation_filter</code></td>
<td>do not capture this kind of relation (i.e. edge)</td>
</tr>
<tr>
<td><code>propagate_node_filter</code></td>
<td>do not propagate tracking through this kind of node (i.e. vertex)</td>
</tr>
<tr>
<td><code>propagate_relation_filter</code></td>
<td>do not propagate tracking through this kind of relation (i.e. edge)</td>
</tr>
</tbody>
</table>
<h4 id="all">all</h4>
<table>
<thead>
<tr>
<th>value</th>
<th>effect</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>true</code></td>
<td>capture provenance for all objects</td>
</tr>
<tr>
<td><code>false</code></td>
<td>capture no provenance except for indicated objects (specified via <code>file</code>, <code>ipv4-ingress</code>, etc.)</td>
</tr>
</tbody>
</table>
<p>In either case the provenance record is affected by:</p>
<ul>
<li>graph filters (<code>node_filter</code>, <code>propagate_node_filter</code>, etc.)</li>
<li>any object marked <code>opaque</code></li>
</ul>
<h4 id="node_filter">node_filter</h4>
<p>You can specify the node_filter parameter multiple times, with a different node type each time.
See <a href="https://github.com/CamFlow/camflow-dev/blob/master/docs/VERTICES.md">here</a> for the list of supported node types.</p>
<h4 id="relation_filter">relation_filter</h4>
<p>You can specify the relation_filter parameter multiple times, with a different relation type each time.
See <a href="https://github.com/CamFlow/camflow-dev/blob/master/docs/RELATIONS.md">here</a> for the list of supported relation types.</p>
<h4 id="propagate_node_filter">propagate_node_filter</h4>
<p>As with node_filter, you can specify this parameter multiple times for various node types.</p>
<h4 id="propagate_relation_filter">propagate_relation_filter</h4>
<p>As with relation_filter, you can specify this parameter multiple times for various relation types.</p>
<!-- raw HTML omitted -->
<p>No provenance records are emitted for nodes (relations) indicated by <code>X_filter=Y</code>.
For nodes (relations) indicated by <code>propagate_X_filter=Y</code>, records will be emitted but tracking will not be propagated through them.</p>
<!-- raw HTML omitted -->
<h3 id="compression">compression</h3>
<p>“Compressing” provenance means emitting as few provenance records as possible to capture an interaction.
For example, if a process reads a file three times, then a compressed provenance record would contain only one read relation while a complete provenance record would contain three relations.</p>
<p>This is desirable if the goal of provenance collection is to build a provenance graph.
However, if you are trying to perform a security audit, then the fact and timing of multiple accesses may be of interest.
In this example compression may be undesirable.</p>
<table>
<thead>
<tr>
<th>parameter</th>
<th>description</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>node</code></td>
<td>boolean; if true only create a new version of an object to avoid a cycle, if false create a new version on any object state change (i.e. when receiving information from other objects)</td>
</tr>
<tr>
<td><code>edge</code></td>
<td>boolean; if true do not repeat multiple consecutive edges of the same type</td>
</tr>
<tr>
<td><code>duplicate</code></td>
<td>boolean; if true publish the vertex pair associated with a relation when publishing that relation, if false omit any previously-published vertices</td>
</tr>
</tbody>
</table>
<h3 id="file">file</h3>
<p>This describes provenance capture behavior for files.</p>
<table>
<thead>
<tr>
<th>parameter</th>
<th>description</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>opaque</code></td>
<td>provenance is not captured for any interactions with this file</td>
</tr>
<tr>
<td><code>track</code></td>
<td>directly track any information flow to/from this file and any process resulting from its execution</td>
</tr>
<tr>
<td><code>propagate</code></td>
<td>transitively track any information flow to/from this file</td>
</tr>
</tbody>
</table>
<h4 id="track">track</h4>
<p>Use <code>track</code> if you want the provenance information to include every time this file is read or written.</p>
<h4 id="propagate">propagate</h4>
<p>Use <code>propagate</code> if you want the provenance information to track the flow of data out of this file, through other processes, into other files, etc.</p>
<h3 id="ipv4-egress">ipv4-egress</h3>
<p>Track information leaving the system being monitored (<code>connect</code>).</p>
<table>
<thead>
<tr>
<th>parameter</th>
<th>description</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>propagate</code></td>
<td>similar to file, but for data sent to this IPv4 address</td>
</tr>
<tr>
<td><code>record</code></td>
<td>like <code>propagate</code>, but also capture packet content</td>
</tr>
</tbody>
</table>
<p>Specify an IPv4 address using the format <code><ip>/<mask>:<port></code>.</p>
<h3 id="ipv4-ingress">ipv4-ingress</h3>
<p>Track information entering the system being monitored (<code>bind</code>).</p>
<table>
<thead>
<tr>
<th>parameter</th>
<th>description</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>propagate</code></td>
<td>see ipv4-egress</td>
</tr>
<tr>
<td><code>record</code></td>
<td>see ipv4-egress</td>
</tr>
</tbody>
</table>
<h3 id="user">user</h3>
<p>Like <code>file</code>, but for users.</p>
<table>
<thead>
<tr>
<th>parameter</th>
<th>description</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>opaque</code></td>
<td>similar to file, but for this username</td>
</tr>
<tr>