Re: labeled ipsec auditing

[Klaus Weidner <klaus@atsec.com>]

On Tue, Oct 10, 2006 at 06:25:01PM -0500, Joy Latten wrote:
> On Mon, 2006-10-09 at 14:30 -0500, Klaus Weidner wrote:
> > On Mon, Oct 09, 2006 at 03:15:09PM -0400, Paul Moore wrote:
> > > Going back to Joy's original mail I think it was the establishing or deleting of
> > > an SA with SELinux context that we were concerned about (at least that is what I
> > > was concerned about) as that could generate quite a bit of traffic.  Based on
> > > your comments above it looks like that is something we need to do.
> > 
> > Here's what Joy wrote: 
> > 
> > > I am auditing when an ipsec policy is added and removed from the
> > > Security Policy Database. Should I also add audit when an SA is
> > > added and removed? 
> > 
> > If I understand it correctly, SAs can also be added and removed manually,
> > and unless we forbid that admins do that, it would need to be audited.
> > 
> 
> Then do I only want to audit when an SA or SPD is manually added or
> deleted? Or just audit them regardless?

I don't really know the logic well enough to give a definitive answer.
The point is that the audit trail should provide enough information to
see changes to the IPSec state that affect MLS.

If you can make a clear distinction between manually and automatically
created ones in the code, it would be okay to have no audit record for
changes to an SA that was added or removed automatically based on the
SPD, as long as changes to the SPD are audited. If it's not clear how to
distinguish them, it's safest to have audit capability for all SA events.

-Klaus