From owner-freebsd-security@FreeBSD.ORG Mon Jun 27 00:02:45 2011 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id D9F8B106564A; Mon, 27 Jun 2011 00:02:45 +0000 (UTC) (envelope-from jhellenthal@gmail.com) Received: from mail-iw0-f182.google.com (mail-iw0-f182.google.com [209.85.214.182]) by mx1.freebsd.org (Postfix) with ESMTP id 86BC08FC08; Mon, 27 Jun 2011 00:02:45 +0000 (UTC) Received: by iwr19 with SMTP id 19so5149319iwr.13 for ; Sun, 26 Jun 2011 17:02:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:sender:date:from:to:cc:subject:message-id :references:mime-version:content-type:content-disposition :in-reply-to; bh=bTjPiTFB5QVogB5+lKIf2ZROOIHx7/J7pFihkfP8neA=; b=aTh3zcNNko9nptX025+VNSqwsGVgW8RlInjvn4lpL4FVOerazgsvuqqnyprepD52/5 6ZncmCMNdssTd8T1YkXR2IgSS0kARgw7NqRXjapCUc9HaurOQ0v7fMEQwIlHQy38AaAF wE776KNVtTMMYUCi9ev0MpRXywrB8zQCSuFyY= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=sender:date:from:to:cc:subject:message-id:references:mime-version :content-type:content-disposition:in-reply-to; b=NILe7U/s1Ecswe+4kETR8A6Q8dt3u3lIo/Z46BXr0EtYMFG9u5yuj8i173pcvHeuCv 6nwTDDLcSOR7JDgeXhiw8qj5i4xLQa/pOpLvXNx5NDKAVSU5X+VTkY2pnrHtCqcFG0NU mwj7uRkDVFqBRhZ1Bhfvim/xHHa8IhqxmRFTw= Received: by 10.42.132.7 with SMTP id b7mr6773072ict.0.1309131491530; Sun, 26 Jun 2011 16:38:11 -0700 (PDT) Received: from disbatch.dataix.local (adsl-99-190-86-179.dsl.klmzmi.sbcglobal.net [99.190.86.179]) by mx.google.com with ESMTPS id a9sm4824345icy.6.2011.06.26.16.38.09 (version=TLSv1/SSLv3 cipher=OTHER); Sun, 26 Jun 2011 16:38:10 -0700 (PDT) Sender: "J. Hellenthal" Received: from disbatch.dataix.local (localhost [127.0.0.1]) by disbatch.dataix.local (8.14.5/8.14.5) with ESMTP id p5QNc7lO059414 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sun, 26 Jun 2011 19:38:07 -0400 (EDT) (envelope-from jhell@DataIX.net) Received: (from jhell@localhost) by disbatch.dataix.local (8.14.5/8.14.5/Submit) id p5QNc72S059413; Sun, 26 Jun 2011 19:38:07 -0400 (EDT) (envelope-from jhell@DataIX.net) Date: Sun, 26 Jun 2011 19:38:07 -0400 From: jhell To: Lev Serebryakov Message-ID: <20110626233807.GC38064@DataIX.net> References: <1307023935.20110626210326@serebryakov.spb.ru> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="PmA2V3Z32TCmWXqI" Content-Disposition: inline In-Reply-To: <1307023935.20110626210326@serebryakov.spb.ru> Cc: freebsd-security@freebsd.org Subject: Re: How to add new audit class? X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jun 2011 00:02:46 -0000 --PmA2V3Z32TCmWXqI Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sun, Jun 26, 2011 at 09:03:26PM +0400, Lev Serebryakov wrote: > Hello, Freebsd-security. >=20 > I want to create mixed audit class for ``security-sensible'' events. > For example, I need to audit: >=20 > exec*() syscalls from standard `pc' class, but not wait4() or > fork(), because fork() is not interesting (new process image is > security-sensible, not new process itself) and occurred too often > and create noise. >=20 > connect()/accept() from "nt", but not setsockopt(), for the same > reasons. >=20 > And so on. >=20 > How should I create new system class? What need to be putted into > "classmask" in audit_class(5)? How should I edit audit_event(5) file, > as it seems, that one event could belong only to one class, and I > don't want to remove these events from their natural classes. >=20 Giving some background here I had a similiar type thing I was going through with fcntl etc... for some remote diskless X machines that were logging 1000+ fcntl changes every 5 seconds! "I didn't going with auditing those machines ;) What it came down to though was making good use of auditreduce(1) to get the output you would like to investigate. Good thing the resulting storage files are compressed eh? ;) To sum it up simply it comes down to "...class mask size is fixed in the ABI and difficult to expand" http://lists.freebsd.org/pipermail/freebsd-bugs/2010-December/042542.html Hope this helps some. --PmA2V3Z32TCmWXqI Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.17 (FreeBSD) Comment: http://bit.ly/0x89D8547E iQEcBAEBAgAGBQJOB8LeAAoJEJBXh4mJ2FR+ROUH/RpiKllFIc3K6ezHsI01KXCx u/CrppxQJmVXsxzuNDqYsG442CqYng0Ngc6kE50dSpxv6qYJPFKxp/DWAMSeyw+N sQJLCclqse2ytTLqKGko+FbLrBFDztsiiGODMaZjuPrhagbhjPkwcgh8/k8bMHaT RmOilP8pVU1XWMSAIpWqJvDt1QQ9AdSg6e06wYkVY4vMKaL9t+14X+KX2RSljVU+ RIwLWnVqsqM+k2WD+HugkrUy3cgBkhEpD0axqQK6peOszA0reVyjXGX5vVr+kLob 5s9rAJ2Bvab6/k9gE+slfNJX3q9U37/J/se9XI2bZHISxN6Eh3TWBqq1Lgkv2DU= =1n+9 -----END PGP SIGNATURE----- --PmA2V3Z32TCmWXqI--