From mboxrd@z Thu Jan  1 00:00:00 1970
From: "Serge E. Hallyn" <serue@us.ibm.com>
Subject: Re: labeled ipsec auditing
Date: Wed, 11 Oct 2006 08:38:13 -0500
Message-ID: <20061011133813.GA12491@sergelap.austin.ibm.com>
References: <200610052123.k95LN0S9017784@faith.austin.ibm.com>
	<45258410.60302@hp.com> <20061009190949.GA28519@w-m-p.com>
	<452A9FBD.5060300@hp.com> <20061009193001.GB28519@w-m-p.com>
	<1160522701.17737.8.camel@faith.austin.ibm.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Return-path: <redhat-lspp-bounces@redhat.com>
Content-Disposition: inline
In-Reply-To: <1160522701.17737.8.camel@faith.austin.ibm.com>
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/redhat-lspp>,
	<mailto:redhat-lspp-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/redhat-lspp>
List-Post: <mailto:redhat-lspp@redhat.com>
List-Help: <mailto:redhat-lspp-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/redhat-lspp>,
	<mailto:redhat-lspp-request@redhat.com?subject=subscribe>
Sender: redhat-lspp-bounces@redhat.com
Errors-To: redhat-lspp-bounces@redhat.com
To: Joy Latten <latten@austin.ibm.com>
Cc: redhat-lspp@redhat.com, Klaus Weidner <klaus@atsec.com>, linux-audit@redhat.com
List-Id: linux-audit@redhat.com

Quoting Joy Latten (latten@austin.ibm.com):
> On Mon, 2006-10-09 at 14:30 -0500, Klaus Weidner wrote:
> > On Mon, Oct 09, 2006 at 03:15:09PM -0400, Paul Moore wrote:
> > > Going back to Joy's original mail I think it was the establishing or deleting of
> > > an SA with SELinux context that we were concerned about (at least that is what I
> > > was concerned about) as that could generate quite a bit of traffic.  Based on
> > > your comments above it looks like that is something we need to do.
> > 
> > Here's what Joy wrote: 
> > 
> > > I am auditing when an ipsec policy is added and removed from the
> > > Security Policy Database. Should I also add audit when an SA is
> > > added and removed? 
> > 
> > If I understand it correctly, SAs can also be added and removed manually,
> > and unless we forbid that admins do that, it would need to be audited.
> > 
> 
> Then do I only want to audit when an SA or SPD is manually added or
> deleted? Or just audit them regardless?

Hi Joy,

you didn't quote the part of Klaus' email which I was hoping you'd
answer:

> If the SPD completely determines the rules for ipsec related to MLS, it
> would not be necessary to audit the individual additions and deletions,
> but I'm not convinced that's the case. Does modifying the SPD
> automatically tear down any currently active SAs that do not match the
> updated policy?

-serge