Skip to content

Commit

Permalink
whitelist -> allowlist
Browse files Browse the repository at this point in the history
  • Loading branch information
chenyue.will committed Dec 25, 2020
1 parent d6522ad commit 911d946
Show file tree
Hide file tree
Showing 6 changed files with 152 additions and 152 deletions.
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ Now we are more than happy to announce the open-source of AgentSmith-HIDS Agent

* **Better performance** Data/Information are collected in kernel space to avoid additional supplement actions such as traversal of '/proc' directory or collecting from other audition processes such as "auditd".
* **Hard to be bypassed** A specifically designed kernel driver powers data/Information collection, making it virtually impossible for malicious software, like rootkit, to evade detection or audition. The Driver could capture even evasion behavior itself.
* **Kernel + User Space** AgentSmith-HIDS Agent provides User Space detection abilities, including file audition, in-house rule detection, and primary whitelists.
* **Kernel + User Space** AgentSmith-HIDS Agent provides User Space detection abilities, including file audition, in-house rule detection, and primary allowlists.
* **Easy to be integrated** AgentSmith-HIDS could empower any User Space agents far beyond Host Intrusion usages with the detailed and reliable data flow. A wide user action audition could benefit both Behavior Analysis and Compliance requests. When integrated with NIDS, security analyzers could build a comprehensive Provenance Graph from the network connections, along with high traceable process trees and file auditions.


Expand Down
6 changes: 3 additions & 3 deletions driver/LKM/include/filter.h
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,8 @@
#include <linux/string.h>
#include <linux/rbtree.h>

#define FILTER_DEVICE_NAME "hids_driver_whitelist"
#define FILTER_CLASS_NAME "hids_driver_whitelist"
#define FILTER_DEVICE_NAME "hids_driver_allowlist"
#define FILTER_CLASS_NAME "hids_driver_allowlist"

#define SHMEM_MAX_SIZE 8192

Expand All @@ -27,4 +27,4 @@ int execve_exe_check(char *data);

int execve_argv_check(char *data);

#endif /* FILTER_H */
#endif /* FILTER_H */
Loading

0 comments on commit 911d946

Please sign in to comment.