Re: [RFC][PATCH] (#3) file system auditing

["Timothy R. Chavez" <tinytim@us.ibm.com>]

On Wed, 2005-04-27 at 00:28 +0100, Christoph Hellwig wrote:
> On Tue, Apr 26, 2005 at 04:04:46PM -0500, Timothy R. Chavez wrote:
> > Hello,
> > 
> > The audit subsystem is currently incapable of auditing a file system
> > object based on its location and name.
> 

Hello Christoph,

I apologize for the delay in my response.  Thank you for your response.
I'll try to be succinct.

> Which doesn't make sense in our world of per-process namespaces.  

The audit subsystem is responsible for generating accounts of activity
in the kernel for the purposes of examination and verification.  Thus,
in terms of audit, how we capture becomes less important than what we
capture, as long as it remains consistent, right?  Given A, B follows.

The syscall filtering on (inode,device)-pairs is not enough to construct
complete accounts of activity across transactions in which an underlying
inode is subject to change.  Once that inode changes, we've lost audit.
So, we've introduced an abstract methodology by which the administrator
is able to "watch" by location and name.  This allows us to ultimately
examine and verify actions taken against, say, "/etc/shadow", and not
simply the inode currently associated with it.

> Unless this is not just a silly checkbox item for government certification
> please add it only to your favourite vendor tree.

I think that certs are a perfectly legitimate use-case for a kernel's
_audit_ subsystem.  

I'd like to maintain a relative focus here on linux-fsdevel.  When I RFC
on LKML, we can argue the virtues of audit and certifications there.

-tim