[lkml]   [2003]   [May]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: SNARE and C2 auditing under 2.5.x
    On Wed, May 21, 2003 at 09:26:15PM +0200, Bernd Eckenfels wrote:
    > In article <> you wrote:
    > > Nah, auditing isn't needed to run a secure system. ;)
    > Besides C2 is totally anachronistical, anyway.

    Logging is *not* anachronistical.

    From C2: " Audit"

    "The TCP shall be able to create, maintain, and protect from
    modification or unauthorized access. The audit data shall be protected
    by the TCB so that read access to it is limited to those who are
    authorized for audit data. The TCB shall be able to record the following
    types of events: use of identification and authentication mechanisms,
    introduction of objects into a user's address space (e.g., fileopen,
    program initiation), deletion of objects, actions taken by computer
    operators and system administrators and/or system security officers, and
    other security relevant events. For each recorded event, the audit reord
    shall identify: date and time of the event, user, type of event, and
    success or failure of that event. For identification/authentication
    events the origin of request (e.g., terminal ID) shall be included in
    the audit record. For events that introduce an object into a user's
    address space and for object deletion events the audit record shall
    include the name of the object. The ADP system administrator shall be
    able to selectively audit the actions of any one or more users based on
    individual identity."

    > Even Windows 2000 now offers some Protection Profiles from the Common
    > Criteria EAL4+FLR für ControledAccessProtectionProfile(CAPP).

    EAL4 means "we're pretty sure the system does X"

    It does not say that X is anything remotely related to security. The
    "AL" in EAL is for "Assurance Level", how certain you are that the
    system behaves according to specification. It's not about the security
    features of your specification.

    Ever wondered why Solaris 8 and Trusted Solaris 8 both have EAL4 ?

    You say C2 auditing is anachronistical - but NOT EVEN having THAT is
    most certainly not a mark of distinction.

    And in fact, your average syslog setup is NOT guaranteed to store the
    log events as required by C2. Some information is missing, and you do
    not have guarantees that events that *are* generated by the system,
    actually reach the log.

    This is very very far from being impressive. C2 is not the end all and
    be all, but it's auditing requirements are pretty good (for systems that
    only have discretionary access controls) and efforts to bring this kind
    of auditing to Linux should certainly not be frowned upon.

    That's my 0.02 Euro at least

    : : And I see the elder races, :
    :.........................: putrid forms of man :
    : Jakob Østergaard : See him rise and claim the earth, :
    : OZ9ABN : his downfall is at hand. :
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:35    [W:0.026 / U:27.036 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site