SKTRC: Rastreamento Direcionado e Persistente de Eventos do Kernel Linux para Análise de Vulnerabilidades - Pinto, Sidney P. J. S.; V. Junior, Ivanilson F.; Sousa, Galileu B.; Silva, Felipe S. Dantas (Anais Estendidos do Simpósio Brasileiro de Cibersegurança (SBSeg); 2026: Anais Estendidos do XXVI Simpósio Brasileiro de Cibersegurança, 2026)
Vulnerabilities in Linux Kernel components may involve internal states that are difficult to observe and transient events that are relevant for security analysis. Although there are well-established tracing mechanisms, these approaches do not always combine targeted collection, contextualization, persistence, and low instrumentation effort. This work introduces the Simple Kernel Trace (SKTRC), a Kernel module aimed at targeted and persistent tracing of internal system events. SKTRC was evaluated in a Proof of Concept (PoC) executed on a native bare metal Linux installation and compared with the native event tracing mechanism. The evaluation used components associated with the Copy Fail vulnerability, which was recently disclosed after remaining present for years in the Linux Kernel. The results indicate that SKTRC makes it possible to collect contextualized logs during the controlled execution of a vulnerability PoC, reduces the instrumentation effort, and facilitates subsequent analysis of security-relevant events.