From mboxrd@z Thu Jan 1 00:00:00 1970 From: Joy Latten Subject: Re: [redhat-lspp] labeled ipsec auditing Date: Wed, 11 Oct 2006 13:07:26 -0500 Message-ID: <1160590046.17737.38.camel@faith.austin.ibm.com> References: <200610052123.k95LN0S9017784@faith.austin.ibm.com> <45258410.60302@hp.com> <20061009190949.GA28519@w-m-p.com> <452A9FBD.5060300@hp.com> <20061009193001.GB28519@w-m-p.com> <1160522701.17737.8.camel@faith.austin.ibm.com> <20061011133813.GA12491@sergelap.austin.ibm.com> Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20061011133813.GA12491@sergelap.austin.ibm.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "Serge E. Hallyn" Cc: redhat-lspp@redhat.com, linux-audit@redhat.com List-Id: linux-audit@redhat.com On Wed, 2006-10-11 at 08:38 -0500, Serge E. Hallyn wrote: > Quoting Joy Latten (latten@austin.ibm.com): > > On Mon, 2006-10-09 at 14:30 -0500, Klaus Weidner wrote: > > > On Mon, Oct 09, 2006 at 03:15:09PM -0400, Paul Moore wrote: > > > > Going back to Joy's original mail I think it was the establishing or deleting of > > > > an SA with SELinux context that we were concerned about (at least that is what I > > > > was concerned about) as that could generate quite a bit of traffic. Based on > > > > your comments above it looks like that is something we need to do. > > > > > > Here's what Joy wrote: > > > > > > > I am auditing when an ipsec policy is added and removed from the > > > > Security Policy Database. Should I also add audit when an SA is > > > > added and removed? > > > > > > If I understand it correctly, SAs can also be added and removed manually, > > > and unless we forbid that admins do that, it would need to be audited. > > > > > > > Then do I only want to audit when an SA or SPD is manually added or > > deleted? Or just audit them regardless? > > Hi Joy, > > you didn't quote the part of Klaus' email which I was hoping you'd > answer: > > > If the SPD completely determines the rules for ipsec related to MLS, it > > would not be necessary to audit the individual additions and deletions, > > but I'm not convinced that's the case. Does modifying the SPD > > automatically tear down any currently active SAs that do not match the > > updated policy? Sorry about that. :-) Ok, I used Eric's kernel and determined the following. First, it doesn't seem the SPD completely determines the rules for ipsec related to MLS. I set my spd to have "s2", and the SAs created by racoon all had "s0-s15:c0.c1023". In fact they get this no matter what. This does not seem correct behavior to me. I looked at the code and it seems we are tacking on the mls label of the flow's secid to our SA's security context. But I could not find where the flow's secid gets set on output anywhere in xfrm code. I do not understand this. Ok, next, I removed the policy in my spd, but SAs created by racoon stayed around. I had to manually flush them to remove them. Joy