Re: [redhat-lspp] labeled ipsec auditing

[Klaus Weidner <klaus@atsec.com>]

On Mon, Oct 09, 2006 at 03:15:09PM -0400, Paul Moore wrote:
> Going back to Joy's original mail I think it was the establishing or deleting of
> an SA with SELinux context that we were concerned about (at least that is what I
> was concerned about) as that could generate quite a bit of traffic.  Based on
> your comments above it looks like that is something we need to do.

Here's what Joy wrote: 

> I am auditing when an ipsec policy is added and removed from the
> Security Policy Database. Should I also add audit when an SA is
> added and removed? 

If I understand it correctly, SAs can also be added and removed manually,
and unless we forbid that admins do that, it would need to be audited.

If the SPD completely determines the rules for ipsec related to MLS, it
would not be necessary to audit the individual additions and deletions,
but I'm not convinced that's the case. Does modifying the SPD
automatically tear down any currently active SAs that do not match the
updated policy?

As always, keep in mind that the system only needs to be capable of
auditing these events, not that these events always need to be
generating. It's fine to keep the audit events off by default.

-Klaus