[sct-hackers] Fwd: [PATCH] Light-weight Auditing Framework

[Muli Ben-Y. <mu...@mu...>]

The Light-weight auditing framewrk patch has been applied to the
kernel, and will show up in 2.6.6. Getting syscalltrack to work with
it is probably the way to go, even though it doesn't support the
entire syscalltrack functionality.=20

----- Forwarded message from Linux Kernel Mailing List <linux-kernel@vger.k=
ernel.org> -----

Date: 	Mon, 12 Apr 2004 20:29:12 +0000
=46rom: Linux Kernel Mailing List <lin...@vg...>
To: bk-...@vg...
Subject: [PATCH] Light-weight Auditing Framework

ChangeSet 1.2012, 2004/04/12 13:29:12-07:00, ak...@os...

	[PATCH] Light-weight Auditing Framework
=09
	From: Rik Faith <fa...@re...>
=09
	This patch provides a low-overhead system-call auditing framework for Linux
	that is usable by LSM components (e.g., SELinux).  This is an update of the
	patch discussed in this thread:
=09
	    http://marc.theaimsgroup.com/?t=3D107815888100001&r=3D1&w=3D2
=09
	In brief, it provides for netlink-based logging of audit records that have
	been generated in other parts of the kernel (e.g., SELinux) as well as the
	ability to audit system calls, either independently (using simple
	filtering) or as a compliment to the audit record that another part of the
	kernel generated.
=09
	The main goals were to provide system call auditing with 1) as low overhead
	as possible, and 2) without duplicating functionality that is already
	provided by SELinux (and/or other security infrastructures).  This
	framework will work "stand-alone", but is not designed to provide, e.g.,
	CAPP functionality without another security component in place.
=09
	This updated patch includes changes from feedback I have received,
	including the ability to compile without CONFIG_NET (and better use of
	tabs, so use -w if you diff against the older patch).
=09
	Please see http://people.redhat.com/faith/audit/ for an early example
	user-space client (auditd-0.4.tar.gz) and instructions on how to try it.
=09
	My future intentions at the kernel level include improving filtering (e.g.,
	syscall personality/exit codes) and syscall support for more architectures.
	 First, though, I'm going to work on documentation, a (real) audit daemon,
	and patches for other user-space tools so that people can play with the
	framework and understand how it can be used with and without SELinux.
=09
=09
	Update:
=09
	Light-weight Auditing Framework receive filter fixes
	From: Rik Faith <fa...@re...>
=09
	Since audit_receive_filter() is only called with audit_netlink_sem held, it
	cannot race with either audit_del_rule() or audit_add_rule(), so the
	list_for_each_entry_rcu()s may be replaced by list_for_each_entry()s, and
	the rcu_read_{un,}lock()s removed.  A fix for this is part of the attached
	patch.
=09
	Other features of the attached patch are:
=09
	1) generalized the ability to test for inequality
=09
	2) added syscall exit status reporting and testing
=09
	3) added ability to report and test first 4 syscall arguments (this adds
	   a large amount of flexibility for little cost; not implemented or tested
	   on ppc64)
=09
	4) added ability to report and test personality
=09
	User-space demo program enhanced for new fields and inequality testing:
	http://people.redhat.com/faith/audit/auditd-0.5.tar.gz


# This patch includes the following deltas:
#	           ChangeSet	1.2011  -> 1.2012=20
#	arch/ppc64/kernel/entry.S	1.35    -> 1.36  =20
#	       kernel/fork.c	1.164   -> 1.165 =20
#	include/linux/sched.h	1.191   -> 1.192 =20
#	include/asm-ppc64/thread_info.h	1.10    -> 1.11  =20
#	include/asm-i386/thread_info.h	1.17    -> 1.18  =20
#	security/selinux/include/avc.h	1.5     -> 1.6   =20
#	     kernel/Makefile	1.38    -> 1.39  =20
#	  include/linux/fs.h	1.306   -> 1.307 =20
#	arch/i386/kernel/entry.S	1.73    -> 1.74  =20
#	arch/i386/kernel/ptrace.c	1.20    -> 1.21  =20
#	arch/x86_64/kernel/ptrace.c	1.13    -> 1.14  =20
#	          fs/namei.c	1.93    -> 1.94  =20
#	arch/x86_64/kernel/entry.S	1.20    -> 1.21  =20
#	arch/x86_64/ia32/ia32entry.S	1.30    -> 1.31  =20
#	include/asm-x86_64/thread_info.h	1.15    -> 1.16  =20
#	security/selinux/avc.c	1.8     -> 1.9   =20
#	        init/Kconfig	1.35    -> 1.36  =20
#	arch/ppc64/kernel/ptrace.c	1.8     -> 1.9   =20
#	include/linux/netlink.h	1.14    -> 1.15  =20
#	security/selinux/ss/services.c	1.8     -> 1.9   =20
#	               (new)	        -> 1.1     include/linux/audit.h
#	               (new)	        -> 1.1     kernel/auditsc.c
#	               (new)	        -> 1.1     kernel/audit.c=20
#

 arch/i386/kernel/entry.S         |    6=20
 arch/i386/kernel/ptrace.c        |   10=20
 arch/ppc64/kernel/entry.S        |   15=20
 arch/ppc64/kernel/ptrace.c       |   29 +
 arch/x86_64/ia32/ia32entry.S     |   18=20
 arch/x86_64/kernel/entry.S       |   21=20
 arch/x86_64/kernel/ptrace.c      |   30 +
 fs/namei.c                       |   15=20
 include/asm-i386/thread_info.h   |    6=20
 include/asm-ppc64/thread_info.h  |    3=20
 include/asm-x86_64/thread_info.h |    5=20
 include/linux/audit.h            |  211 ++++++++
 include/linux/fs.h               |   14=20
 include/linux/netlink.h          |    1=20
 include/linux/sched.h            |    3=20
 init/Kconfig                     |   20=20
 kernel/Makefile                  |    2=20
 kernel/audit.c                   |  825 ++++++++++++++++++++++++++++++++++
 kernel/auditsc.c                 |  922 ++++++++++++++++++++++++++++++++++=
+++++
 kernel/fork.c                    |   10=20
 security/selinux/avc.c           |  168 +++----
 security/selinux/include/avc.h   |    7=20
 security/selinux/ss/services.c   |    2=20
 23 files changed, 2199 insertions(+), 144 deletions(-)



--=20
Muli Ben-Yehuda
http://www.mulix.org | http://mulix.livejournal.com/