Re: [PATCH 4/5] audit: add netlink multicast group for log read

[Eric Paris <eparis@redhat.com>]

On Wed, 2014-03-12 at 08:55 -0400, Steve Grubb wrote:
> On Wednesday, February 19, 2014 01:08:22 PM Richard Guy Briggs wrote:
> > Add a netlink multicast socket with one group to kaudit for "best-effort"
> > delivery to read-only userspace clients such as systemd, in addition to the
> > existing bidirectional unicast auditd userspace client.
> 
> One question...we do have to have the ability to separate of secadm_r and 
> sysadm_r. By allowing this we will leak to a sysadmin that he is being audited 
> by the security officer. In a lot of cases, they are one in the same person. But 
> for others, they are not. I have a feeling this will cause problems for MLS 
> systems.

A good question.  But easily solved in policy.  Don't give
CAP_AUDIT_READ to sysadm_t if you don't want sysadm_t to be able to read
from the multicast socket.

As to what others who read from the journal I guess we can just make
sure it is a config option whether to collect or not.  Most everyone
would want to collect, but some configs might obviously not.

I'll roll around in the back of my head the ability for auditctl to
disable the multicasting, but CAP_AUDIT_READ takes care of that a whole
lot more nicely...