Enabling OpenSolaris Auditing without Device Allocation

Today I needed to enable auditing on my OpenSolaris system to check some audit behaviour. However I didn't want device allocation enabled, I do want mass storage devices to still be automatically mounted particularly since I was doing this on my laptop, and also because I wasn't interested in anything other than the events in the 'lo' or 'ss' class (login/logout and system state change).

When bsmconv is run it turns on auditing (on next reboot) and disables the automatic mounting of mass storage devices. The later it does by updating the HAL configuration. I creates /etc/hal/fdi/policy/30user/90-solaris-device-allocation.fdi, this is an XML format file that HAL reads when it starts up.

So the simple fix to have auditing but not device allocation is this:

islay$ pfexec bsmconv   # Answer y
islay$ pfexec rm etc/hal/fdi/policy/30user/90-solaris-device-allocation.fdi

We really should split these things a part like we have been planning to do for quite some time.

Comments:

Why would automatic mounting of mass storage devices have been disabled when auditing is enabled anyway? What would have been the original reason?
Was it assumed that the admin would want that type of 'hardening' at the same time as enabling auditing?

Posted by Paul Smart on July 24, 2008 at 01:28 PM BST #

Good question Paul! The reason is that mounting removable media is an auditable action. This was created before the old vold and long before the use of HAL. Even with vold and now HAL the auditing is not correctly attributed to the logged in user it the automatic mounting happens. There is work in process to make that happen though. The is also that added twist of Trusted Extensions, in a multi level desktop the user really needs to explicitly choose which label the media is mounted at (assuming they are authorised to do so at that label).

Posted by Darren Moffat on July 25, 2008 at 03:33 AM BST #

Post a Comment:
  • HTML Syntax: NOT allowed
About

DarrenMoffat

Search

Categories
Archives
« April 2014
MonTueWedThuFriSatSun
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
17
18
19
20
21
22
23
24
25
26
27
28
29
30
    
       
Today