From: Steve Grubb <sgrubb@redhat.com>
To: Tyler Hicks <tyhicks@canonical.com>
Cc: linux-audit@redhat.com
Subject: Re: [PATCH 0/5] Build time disabling of auditd network listener
Date: Tue, 11 Sep 2012 09:12:25 -0400 [thread overview]
Message-ID: <22090059.gJVcnCRO2b@x2> (raw)
In-Reply-To: <20120910183910.GB3873@boyd>
On Monday, September 10, 2012 11:39:10 AM Tyler Hicks wrote:
> On 2012-08-01 00:00:19, Tyler Hicks wrote:
> > Hello Steve - This is a patch set that allows --disable-listener to be
> > passed to the configure script to disable the auditd network listener
> > code at build time. The reasoning is that a large number of users do not
> > need centralized audit logging and removing the network listening code
> > from a root-owned auditd process is appealing from a security
> > perspective.
My thoughts are that if tcp_listen_port is not set up, the callback is not
registered and none of the networking code comes into play. By configuration,
admins are able to reduce the attack surface. The real effect of the patch is
that it reduces binary image size.
> > The existing implementation clearly does not initialize the listener when
> > tcp_listen_port is undefined in auditd.conf, but I still think there is
> > value in not having the listening code present in all auditd
> > installations.
> Hi Steve - Do you have any thoughts on this idea? Thanks!
I was getting to this patch set. Are you planning to turn off networking for
Ubuntu? Just curious if the patch is going to be used rather than just be an
academic exercise. :-) I don't see us turning it off any time soon.
Thanks,
-Steve
> > The first three patches in the set are refactoring patches to move nearly
> > all of the listening code into auditd-listen.c in order to minimize the
> > number of ifdefs that would need to be scattered throughout C source
> > files. The fourth patch is an optional cleanup patch. The last patch
> > introduces the
> > --disable-listener option.
> >
> > The auditd listener code is still enabled by default so that existing
> > distro packaging recipes will not need to be updated.
> >
> > I look forward to your feedback. Thanks!
> >
> > Tyler
> >
> > --
> > Linux-audit mailing list
> > Linux-audit@redhat.com
> > https://www.redhat.com/mailman/listinfo/linux-audit
next prev parent reply other threads:[~2012-09-11 13:12 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-08-01 7:00 [PATCH 0/5] Build time disabling of auditd network listener Tyler Hicks
2012-08-01 7:00 ` [PATCH 1/5] Move auditd listener reconfigure code into auditd-listen.c Tyler Hicks
2012-08-01 7:00 ` [PATCH 2/5] Store daemon config pointer in the periodic watcher's private data Tyler Hicks
2012-08-01 7:00 ` [PATCH 3/5] Move periodic watcher into auditd-listen.c Tyler Hicks
2012-08-01 7:00 ` [PATCH 4/5] Consolidate periodic handler code Tyler Hicks
2012-08-01 7:00 ` [PATCH 5/5] Conditionally build auditd network listener support Tyler Hicks
2012-09-10 18:39 ` [PATCH 0/5] Build time disabling of auditd network listener Tyler Hicks
2012-09-11 13:12 ` Steve Grubb [this message]
2012-09-11 17:10 ` Tyler Hicks
2012-10-26 17:09 ` Tyler Hicks
2012-10-26 17:14 ` Steve Grubb
2012-11-05 14:17 ` Steve Grubb
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=22090059.gJVcnCRO2b@x2 \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
--cc=tyhicks@canonical.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox