audit by role testing

audit by role testing

[Darrel Goeddel]

Here:

http://dgoeddel.home.insightbb.com/audit/

are some patches that will enable users to test the selinux context audit
filters.  They are largely based on some previous work by Amy and Dustin
(some things are named differently, and some more stuff is filled out).
These patches are not meant for inclusion into the audit package - they are
probably not ready for that ;)  They were merely a way to test the new
functionality provided in the lspp kernel.  I can rework them if there are
suggestions that could make them acceptable for the real audit package.

I also stuck a source rpm there that has the two patches in there.  You can
just grab that, build it, and force upgrade ('-Uhv --force' is what I do)
the audit package that you have installed.

The first patch (audit-1.1.5-audit_rule_data-support.patch) basically mirrors
all calls that use an audit_rule struct with a similar call that uses an
audit_rule_data struct.  There are also a few bits that define things for
nice compilation with the current headers.  This patch should be completely
backwards compatible since it only introduces new things (which are unused).

The second patch (audit-1.1.5-audit_rule_data-use.patch) converts auditctl and
autrace to use the audit_rule_data struct instead of the audit_rule struct.
This patch will not work on kernels that do not support AUDIT_ADD_RULE,
AUDIT_DEL_RULE, and AUDIT_LIST_RULES (the lspp kernel is OK, but the regular
FC5 kernel is not).

Using this auditctl (and the lspp kernel), you should be able to use the new
field values of se_user, se_role, se_type, se_sen, and se_clr.  Note that the
se_sen and se_clr values will need to be in the "untranslated" form
(e.g. s5:c0).

--

Darrel

Re: audit by role testing

[Steve Grubb]

On Tuesday 04 April 2006 13:33, Darrel Goeddel wrote:
> The first patch (audit-1.1.5-audit_rule_data-support.patch) basically
> mirrors all calls that use an audit_rule struct with a similar call that
> uses an audit_rule_data struct.  There are also a few bits that define
> things for nice compilation with the current headers.  This patch should be
> completely backwards compatible since it only introduces new things (which
> are unused).

This was a big help. I'm merging most of this patch. This is along the lines 
of what I had envisioned: parallel functions that augment (not replace)  
current functions.

For auditctl, I'll just fix it to call the right function for the message 
being sent. Meaning it will still favor the old functions except in  
situations where it must use the new function.

Thanks,
-Steve