The Audit Subsystem

The purpose of this BOF is to discuss the current implementation of the audit subsystem. Based on the audit infrastructure developed by Rick Faith, the current implementation added several functions to make the audit compliant with the Common Criteria Controlled Access Protection Profile (CAPP). For example, file system auditing was added, the audit context structure was expanded, uid inheritance was fixed, and so on. In addition, user-space programs and libraries have been re-written, completing the CAPP requirements as well as providing ease of use to the administrator. I will give a general description of the audit subsystem, followed by how to configure the daemon, set the filtering rules, and use the search utilities. Time permitting, I will share some experience and open the discussion for future development suggestions.