From mboxrd@z Thu Jan 1 00:00:00 1970 From: LC Bruzenak Subject: reactive audit question Date: Fri, 12 Nov 2010 11:24:43 -0600 Message-ID: <1289582683.2136.36.camel@lcb> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx07.extmail.prod.ext.phx2.redhat.com [10.5.110.11]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id oACHP0pl025855 for ; Fri, 12 Nov 2010 12:25:00 -0500 Received: from mail.magitekltd.com (rrcs-24-242-137-197.sw.biz.rr.com [24.242.137.197]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id oACHOkUY020889 for ; Fri, 12 Nov 2010 12:24:46 -0500 Received: from [24.242.137.194] (helo=[192.168.30.40]) by mail.magitekltd.com with esmtpsa (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.63) (envelope-from ) id 1PGxLW-0005Jj-9z for linux-audit@redhat.com; Fri, 12 Nov 2010 11:23:30 -0600 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Linux Audit List-Id: linux-audit@redhat.com Steve, others, I may have asked this before, but it is becoming an issue so I thought I'd check again anyway. In our systems there are occasionally AVC "storms" which happen as a result of some unforeseen (and often unknown) issue tickled by various reasons. At fielded sites, we are unable to fix this easily. Since we have to keep all the audit data, this leads to many problems on a system running over a weekend, for example, with no administrators around. I probably need to add in either some rate-limiting code or possibly kill off the process generating the AVCs. Rate-limiting I'd guess could go into the auditd. If I wanted to be more brutal and kill the process, I'd think maybe a modification to the setroubleshoot code would be workable. I don't think that a reactive rule is an option - 1) We have our rules locked into the kernel on startup and I'm against changing that, and 2) maybe "normal" avc counts, under a threshold, we'd still want to see, from that same process. Besides, 3) unless the rules have been changed, we cannot exclude AVCs from a particular type/process anyway. Got any thoughts/ideas/advice? Thx, LCB -- LC (Lenny) Bruzenak lenny@magitekltd.com