Re: [PATCH ghak124 v3] audit: log nftables configuration change events
Hi,
On Thu, Feb 11, 2021 at 04:02:55PM -0500, Steve Grubb wrote:
On Thursday, February 11, 2021 11:29:34 AM EST Paul Moore wrote:
> > If I'm not mistaken, iptables emits a single audit log per table, ipset
> > doesn't support audit at all. So I wonder how much audit logging is
> > required at all (for certification or whatever reason). How much
> > granularity is desired?
<snip>
> I believe the netfilter auditing was mostly a nice-to-have bit of
> functionality to help add to the completeness of the audit logs, but I
> could very easily be mistaken. Richard put together those patches, he
> can probably provide the background/motivation for the effort.
There are certifications which levy requirements on information flow control.
The firewall can decide if information should flow or be blocked. Information
flow decisions need to be auditable - which we have with the audit target.
In nftables, this is realized via 'log level audit' statement.
Functionality should by all means be identical to that of xtables' AUDIT
target.
That then swings in requirements on the configuration of the
information flow
policy.
The requirements state a need to audit any management activity - meaning the
creation, modification, and/or deletion of a "firewall ruleset". Because it
talks constantly about a ruleset and then individual rules, I suspect only 1
summary event is needed to say something happened, who did it, and the
outcome. This would be in line with how selinux is treated: we have 1 summary
event for loading/modifying/unloading selinux policy.
So the central element are firewall rules for audit purposes and
NETFILTER_CFG notifications merely serve asserting changes to those
rules are noticed by the auditing system. Looking at xtables again, this
seems coherent: Any change causes the whole table blob to be replaced
(while others stay in place). So table replace/create is the most common
place for a change notification. In nftables, the most common one is
generation dump - all tables are treated as elements of the same
ruleset, not individually like in xtables.
Richard, assuming the above is correct, are you fine with reducing
nftables auditing to a single notification per transaction then? I guess
Florian sufficiently illustrated how this would be implemented.
Hope this helps...
It does, thanks a lot for the information!
Thanks, Phil