anti
4596c1d69a
New decnet/templates/_shared/sessrec/ — a small C program installed as the login shell in SSH / Telnet deckies. Forkpty-relays /bin/bash, records each chunk as an asciinema v2 event into a shared JSONL day-shard keyed by sid, and emits one RFC 5424 session_recorded line on exit (direct to PID 1's stdout, same pattern syslog_bridge.py uses). Storage: one shard per (decky, UTC day) at /var/lib/systemd/coredump/transcripts/sessions-YYYY-MM-DD.jsonl. Concurrent appends are lock-free: each write is chunked below PIPE_BUF so O_APPEND interleaves atomically. Per-session cap 10 MB with a trunc sentinel; disk- free precheck (<200 MB) falls through to plain bash with a session_skipped log event. Attacker src_ip resolves from \$SSH_CONNECTION, getpeername(0), or utmp in that order. SIGWINCH appends a 'r' resize event so ncurses replays stay aligned. Stealth for v1: /etc/passwd shell-swap to /usr/libexec/login-session (plausible login-machinery path) + prctl comm disguise. Full LD_PRELOAD argv-zap is deferred — sshd strips LD_PRELOAD from the session env, so wiring the existing argv_zap.so into this path needs a separate wrapper. DEBT-033 opened for size-based day-shard rotation; v1's disk-free precheck covers the worst case but can be blinded by a one-shot disk fill.
29 lines
784 B
Makefile
29 lines
784 B
Makefile
# Build sessrec, a tiny pty relay + transcript recorder installed as the
|
|
# login shell inside SSH / Telnet decky containers. Built per-image during
|
|
# the template Dockerfile's build stage; gcc + libc6-dev are installed only
|
|
# for this step and purged in the same layer.
|
|
#
|
|
# Output: /usr/libexec/login-session (plausible login-machinery name)
|
|
|
|
CC ?= gcc
|
|
CFLAGS ?= -O2 -Wall -Wextra -D_FORTIFY_SOURCE=2 -fstack-protector-strong -fPIE
|
|
LDFLAGS ?= -pie -Wl,-z,relro,-z,now
|
|
LIBS := -lutil
|
|
|
|
PREFIX ?= /usr/libexec
|
|
TARGET := login-session
|
|
|
|
all: $(TARGET)
|
|
|
|
$(TARGET): sessrec.c
|
|
$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $< $(LIBS)
|
|
strip --strip-unneeded $@
|
|
|
|
install: $(TARGET)
|
|
install -D -m 0755 $(TARGET) $(DESTDIR)$(PREFIX)/$(TARGET)
|
|
|
|
clean:
|
|
rm -f $(TARGET)
|
|
|
|
.PHONY: all install clean
|