Re: best way to audit in vfs

On Tue, 2004-12-14 at 14:31 -0600, Klaus Weidner wrote: There are advantages and disadvantages to both approaches. If you store audit attributes as a real file-system attribute: * You're unlikely to be able to audit files on non-native filesystems (eg: VFAT, CDROM, or USBKeys) - one audit objective that is very popular in intelligence circles, for example, is "What has been copied out to removable media?" * Audit object inheritance can become VERY complex: - When a new file is created in an audited directory, we have to ensure that the parent directories audit attributes are applied immediately, and the actual 'create/open' audit events associated with the created file are also retrospectively created. (Windows NT had real problems with this. Windows 2000 seems to have come up with something relatively reasonable). * Wildcard matching of file accesses becomes pretty-much impossible. - A sample objective might be "Tell me whenever someone accesses a file within a directory called 'SECRET_FILES'" * On the positive side, your CPU usage is likely to be significantly less, as the audit layer just needs to check for an 'auditing enabled' flag before deciding whether to exit, or continue processing. If you retain a 'virtual' attribute within the audit subsystem: * Your CPU usage increases, as you have to go through the full inode -> real path chain to form a full directory path, before comparing the directory path against the user's filters. (eg: "Tell me whenever someone writes a file to /media/usbkey/.*") * You can do wildcard (or regular expression) matching on target files, which is VERY useful. * File system type is pretty-much irrelevant. * Object inheritance in the file system is not a concern. Summary of operating system implementations: Windows NT / 2000 / XP / 2003: On-file-system attribute. Solaris / AIX / Irix / Snare: Virtual. Regards, Leigh. -- Leigh Purdie, Director - InterSect Alliance Pty Ltd http://www.intersectalliance.com/