Re: [PATCH][RFC] Light-weight Auditing Framework

[Rik Faith <faith@redhat.com>]

On Mon  1 Mar 2004 19:45:01 +0000,
   Christoph Hellwig <hch@infradead.org> wrote:
> On Mon, Mar 01, 2004 at 11:28:45AM -0500, Rik Faith wrote:
> > This note describes a patch against 2.6.4-rc1-bk2 that provides a
> > low-overhead system-call auditing framework for Linux that is usable by
> > LSM components (e.g., SELinux).  Comments will be appreciated.
> 
> I haven't actually looked at the code, but why don't you use Olaf Kirch's
> auditing framework that's used in production and already has gotten the
> wizzbang certification you seem to be aiming at.

Different goals.  My goals are to provide a generic very-low-overhead
auditing framework that can be used as a service by more complex systems
(e.g., SELinux).  In contrast to Olaf's work, for example, my patch does
not have intimate knowledge of system call parameters and semantics.
This decreases the invasiveness of the patch and the work required for
long-term maintainability.

The price for this simplicity is that the "language" for describing
which system calls to audit is also very simple (and is, therefore, not
independently sufficient for certifications).  However, I assume that a
system undergoing certification will be using SELinux or another
security infrastructure that will make auditing _and_ other decisions
-- adding sophistication to the auditing infrastructure only duplicates
the work that the security module will provide.

> Whether we want syscall auditing in mainline is a completely different
> question..

I believe we need a light-weight, maintainable framework that is
versatile enough to be used for non-security purposes (e.g., debugging).
In general, my patch meets these requirements since it provides very
little that helps specifically with security (failure modes, loginuid,
and small helper functions).