11:49 a.m.
Hi,
The attached patch updates various items for the new user space messages.
Please apply.
-Steve
1:21 p.m.
Hi Steve,
+ * 1500 - 1599 kernel LSPP events
+ * 1600 - 1699 kernel crypto events
+ * 1700 - 1999 future kernel use (maybe integrity labels and related events)
+ * 2000 is for otherwise unclassified kernel audit messages (legacy)
+ * 2001 - 2099 unused (kernel)
+ * 2100 - 2199 user space anomaly records
+ * 2200 - 2299 user space actions taken in response to anomalies
+ * 2300 - 2399 user space generated LSPP events
+ * 2400 - 2499 user space crypto events
+ * 2500 - 2999 future user space (maybe integrity labels and related events)
Can you describe what types of messages you'd expect to be in each
range? I'm unclear on what's an LSPP event and when a trusted program
would be expected to use the LSPP range vs. the 1100-1199 "user space
trusted application messages", especially if the trusted program is
part of the CAPP ST, the LSPP ST and also generally interesting.
I'm also not unclear on what the anomoly related records would be.
Thanks,
-- ljk
1:35 p.m.
On Thursday 20 October 2005 14:21, Linda Knippers wrote:
Can you describe what types of messages you'd expect to be in
each
range?
I thought this was already discussed a while back.
I'm unclear on what's an LSPP event and when a trusted
program
would be expected to use the LSPP range vs. the 1100-1199 "user space
trusted application messages",
For example, new role changing roles. Or assigning a user to a se linux user.
especially if the trusted program is part of the CAPP ST, the LSPP ST
and
also generally interesting.
If its in CAPP, its a CAPP message.
I'm also not unclear on what the anomoly related records would
be.
This is related to the intrusion detection/prevention module.
-Steve
2:11 p.m.
Hi Steve,
> Can you describe what types of messages you'd expect to be in
each
> range?
I thought this was already discussed a while back.
Yeah, I asked some questions back then too.
> I'm unclear on what's an LSPP event and when a trusted
program
> would be expected to use the LSPP range vs. the 1100-1199 "user space
> trusted application messages",
For example, new role changing roles. Or assigning a user to a se linux user.
Would non-LSPP customers also care about these events? If so, then I
think calling these LSPP events is too narrow.
> especially if the trusted program is part of the CAPP ST, the
LSPP ST and
> also generally interesting.
If its in CAPP, its a CAPP message.
If CUPS is part of the CAPP evaluated configuration, and CUPs is being
modified to meet LSPP audit requirements, should its events be in the
trusted program range or the LSPP range? What about audit events
that are specific to RBAC? To me its confusing to categorize events
by the protection profile that caused the code to be added, especially
if we think audit will be used by customers who might not know or
care what a PP is. I think it would be better to group them by the
types of things an admin might be interested in. I guess it doesn't
matter if the ranges aren't exposed to the administrator but it
seems like they will be.
> I'm also not unclear on what the anomoly related records
would be.
This is related to the intrusion detection/prevention module.
Ok, from the description it sounded like anything abnormal (is a
authentication failure an anomaly?) could fit that range. Maybe
having IDS in the description would help.
-- ljk
7003
days inactive
7003
days old
linux-audit@lists.linux-audit.osci.io
3 comments
2 participants
participants (2)
-
Linda Knippers -
Steve Grubb