Re: Hooks, authority, MAC, the future and proposol

offerat_private

* frm gregat_private "07/09/01 08:56:01 -0700" | sed '1,$s/^/* /'
*
* On Sun, Jul 08, 2001 at 04:29:07PM -0700, LA Walsh wrote:
*> 
*> Given that audit requires more hooks than are currently
*> present and making audit a stage II goal, when will that be
*> addressed?  What is the time frame for allowing audit hooks into
*> LSM?
* 
* What is needed for "audit"?  The ability to log every syscall entry and
* exit with a timestamp, userid, parameters and return value?  Or do you
* mean something else?  

Basically, to log every security relevent event (normally, but not limited
too, an access control decision). If a system call performs two distinctly
different checks but returns the same errno, then system call interposition
isn't going to work.

An example would be open(). EACCESS is returned for both DAC and MAC
(IS_IMMUTABLE) checks. We need to be able to distinguish between them to
fulfill the needs of a complient audit system.

In general, we don't need to record the parsing of parameters, which means
that ideally the audit entry point should be after the user-space object
has been converted into kernel space. Doing this twice by forcing the use
of interposition is going to make the general perception of audit being a
system hog self-fullfilling.

* Do you have a pointer to the actual requirement?

CAPP Requirements (Section 5.1)

http://www.radium.ncsc.mil/tpep/library/protection_profiles/CAPP-1.d.pdf

LSPP Requirements (Section 5.1)

http://www.radium.ncsc.mil/tpep/library/protection_profiles/LSPP-1.b.pdf

Posix 1e

http://www.tlinx.org/security/

* thanks,
* 
* greg k-h
* 

richard.

-----------------------------------------------------------------------
Richard Offer                          Technical Lead, Trust Technology
"Specialization is for insects"                                     SGI
_______________________________________________________________________

_______________________________________________
linux-security-module mailing list
linux-security-moduleat_private
http://mail.wirex.com/mailman/listinfo/linux-security-module