Re: [RFC] Tamper Evident Logging on Linux Audit
On Thu, Aug 27, 2020 at 12:25 PM Paccagnella, Riccardo <rp8(a)illinois.edu> wrote:
Dear Linux Audit Team,
My team and I would like to share with you some recent research results that we hope
will be interesting to you. In a nutshell, we designed a kernel-based tamper-evident
logging system and implemented a proof of concept of it on top of Linux Audit. Would you
be interested in the possibility of incorporating our system in the upstream version of
Linux Audit? We envision a small extension to Linux Audit that would allow users to enable
integrity protection for the logs if desired. For reference, this is our paper and this is
our proof-of-concept implementation.
Thanks very much in advance and best regards,
Riccardo
Hi Riccardo,
Often it helps to discuss new features in the context of a patch
submission; it helps remove ambiguity and is an easy way to offer
feedback. It would appear that you already have patches so I would
suggest you prepare those for posting on-list, complete with an
in-depth commit description, so we can discuss further.
If you are unfamiliar with submitting Linux kernel patches, the link
below may be helpful:
* https://www.kernel.org/doc/html/latest/process/submitting-patches.html
--
paul moore
www.paul-moore.com