Audit for live supervision
John Dennis
jdennis at redhat.com
Tue Aug 19 14:14:54 UTC 2008
Kay Hayen wrote:
> No, when opening the socket the to the sub deamon audisp. I couldn't convice
> myself how the API would work with a socket. Does it?
>
The auparse library can read a stream by opening the parser with
AUSOURCE_FEED, you set a callback, then feed arbitrary number of bytes
into the parser by calling auparse_feed(), you'll be called back when a
complete event is found, at that point just use the normal auparse
functions.
You can read off of this unix socket (/var/run/audispd_events) but this
is deprecated. It is now preferred is now to use a audispd plugin and
read from stdin. See the audit src package and look in audisp/plugins
for examples. FWIW I noticed that code was calling fgets to get data to
feed to auparse_feed() but it seems inefficient to buffer lines twice,
auparse_feed will do the line protocol.
> I read that as that we can use the netlink socket with the libaudit directly,
> which sort of could be exactly what we want. That would mean we wouldn't use
> audit user space (processes) at all, right?
>
>
No, you really want to use the user space interface (see above).
>
>> You have 4 points to get the audit stream, in order of distance from the
>> event generation: the audit netlink socket, auditd realtime interface,
>> audisp plugin interface, and the af_unix socket created by the af_unix
>> plugin from audispd. For higher reliability where you don't want of need
>> any other audit processing interfering, I would say use either of the first
>> 2.
>>
>
> The latency is getting higher with each step. For optimal performance we would
> listen to the netlink socket and duplicate only the code essential to process
> what we are interested it.
>
> For extra points and hurt, we would do it in Ada and inside the target
> process, really achieving the low latency. It may be the only realistic
> option, but it also feels like duplication of effort. We have done netlink
> interfaces in Ada before, but also have on our mind that it was said that the
> netlink interface was said (not by you) to be still in flux. Is that still
> true?
>
> It certainly would be nice if the audisp had some form of output that can be
> fed directly into libaudit parsing as it comes in. But that may be an
> unrealistic expectation, is it?
>
>
It does, see above comment.
--
John Dennis <jdennis at redhat.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20080819/d41c3e1e/attachment.htm>
More information about the Linux-audit
mailing list