A modular auditd

Matthew Booth
2008-10-15T17:38:21Z

I was going over the reasons recently why I changed austream from being
an auditd dispatcher to being a replacement audit daemon. They amounted to:

1. No nice way to prevent a dispatcher from generating audit events
2. Additional context switching becomes significant under load
3. Not possible to run auditd at real time priority
4. The config file is ugly if you don't want to write to disk

(1) is very bad, as it can cause a feedback loop which will eventually
kill the machine. If you stare at it hard enough there are ways round
it, but they're not pretty.

(2) When you really hammer it, the dispatcher interface overhead becomes
significant. In addition to the context switching you're also losing
message separation, so you need to do your own buffering.

(3) This is a problem if an application running at high priority
generates a significant burst of audited events. No matter how big you
make your buffers, if you produce faster than you consume you will
eventually run out of space. In my testing the performance of the system
when this happened was exceptionally poor (to the point of requiring a
hard reset).

(4) is not a strong reason in itself, but it highlights that auditd was
designed for writing to disk above all other use cases.

A while back I looked at Solaris's BSM, initially with a view to porting
austream to Solaris. I noted that BSM has 'plugins' which are
implemented as loadable modules[1]. It occurs to me that if auditd had
the same, this would address points (1) and (2). (3) also becomes
simpler and more robust once implemented, because you only have a single
real time process.

Point (4) can be addressed by refactoring existing output methods into
plugins. I believe this would currently amount to a 'file' plugin and a
'dispatcher' plugin. If they aren't loaded, they wouldn't need to be
unconfigured.

Thoughts?

Matt

[1] See man audit_control(4) and audit_syslog(5) on a Solaris system.
--
Matthew Booth, RHCA, RHCSS
Red Hat, Global Professional Services

M: +44 (0)7977 267231
GPG ID: D33C3490
GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490