Re: [selinux] Re: identity

[Joshua Brindle <jbrindle@snu.edu>]

Stephen Smalley wrote:
> On Tue, 2004-02-24 at 15:03, Magosányi Árpád wrote:
> 
>>I tend to view "auditing framework" as a subset of "security framework",
>>and think that separating access control and audit is either unfeasible
>>or impossible, given that most of the stuff to be audited is access
>>control decision. Plus the access control logic can benefit from the
>>additional data which should be available for auditing purposes.
>>First it is a PITA that one have to dig out file name or IP address,
>>but you will soon realise that you can do access control decisions
>>based the data just mined out if you want.
>>
>>On the other hand, there are some data (those which have to be used
>>for access control decisions) which should be dug out twice if you
>>want to separate auditing from access control.
>>
>>And on the third hand:
>>Just tell me that FAU_GEN is not an aim of SELinux, and I will forget
>>the project forever.
> 
> 
> An aim of SELinux itself?  No.  See the overview
> (http://www.nsa.gov/selinux/), FAQ  
> (http://www.nsa.gov/selinux/faq.cfm#I12), and prior postings to this
> list on the topic of auditing, e.g.
> http://marc.theaimsgroup.com/?l=selinux&m=97907408104978&w=2.  We agree
> that auditing is important, and would encourage integration of SELinux
> with an auditing framework (which can benefit both SELinux and the
> auditing framework), but SELinux itself is not intended to meet auditing
> requirements.  Note that LSM cannot meet auditing requirements, and the
> right solution is not to bloat LSM into a universal hook framework but
> instead to provide a separate framework for auditing.  The additional
> state requested by Russell (including an immutable user identity for
> audit records) belongs in an audit context, not the SELinux context.
> 

On this note, are any of the selinux distro guys looking at integrating 
any specific auditing framework with selinux? We've looked at SAL a 
while back but it was very unsuitable at the time, and have plans to 
look at snare, are there others? If someone is alreay working on this 
let me know as I'd like to help.

Joshua Brindle

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.