linux/net
Miloslav Trmac 522ed7767e Audit: add TTY input auditing
Add TTY input auditing, used to audit system administrator's actions.  This is
required by various security standards such as DCID 6/3 and PCI to provide
non-repudiation of administrator's actions and to allow a review of past
actions if the administrator seems to overstep their duties or if the system
becomes misconfigured for unknown reasons.  These requirements do not make it
necessary to audit TTY output as well.

Compared to an user-space keylogger, this approach records TTY input using the
audit subsystem, correlated with other audit events, and it is completely
transparent to the user-space application (e.g.  the console ioctls still
work).

TTY input auditing works on a higher level than auditing all system calls
within the session, which would produce an overwhelming amount of mostly
useless audit events.

Add an "audit_tty" attribute, inherited across fork ().  Data read from TTYs
by process with the attribute is sent to the audit subsystem by the kernel.
The audit netlink interface is extended to allow modifying the audit_tty
attribute, and to allow sending explanatory audit events from user-space (for
example, a shell might send an event containing the final command, after the
interactive command-line editing and history expansion is performed, which
might be difficult to decipher from the TTY input alone).

Because the "audit_tty" attribute is inherited across fork (), it would be set
e.g.  for sshd restarted within an audited session.  To prevent this, the
audit_tty attribute is cleared when a process with no open TTY file
descriptors (e.g.  after daemon startup) opens a TTY.

See https://www.redhat.com/archives/linux-audit/2007-June/msg00000.html for a
more detailed rationale document for an older version of this patch.

[akpm@linux-foundation.org: build fix]
Signed-off-by: Miloslav Trmac <mitr@redhat.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Paul Fulghum <paulkf@microgate.com>
Cc: Casey Schaufler <casey@schaufler-ca.com>
Cc: Steve Grubb <sgrubb@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-07-16 09:05:47 -07:00
..
9p 9p: fix a race condition bug in umount which caused a segfault 2007-07-14 15:14:19 -05:00
802 [NET]: Make all initialized struct seq_operations const. 2007-07-10 23:07:31 -07:00
8021q [VLAN]: Fix memset length 2007-07-14 18:56:30 -07:00
appletalk [NET]: Make all initialized struct seq_operations const. 2007-07-10 23:07:31 -07:00
atm fallout from constified seq_operations 2007-07-15 16:40:52 -07:00
ax25 [NET]: Make all initialized struct seq_operations const. 2007-07-10 23:07:31 -07:00
bluetooth [Bluetooth] Add basics to better support and handle eSCO links 2007-07-11 07:35:32 +02:00
bridge [NETFILTER]: Lower *tables printk severity 2007-07-14 20:46:15 -07:00
core O_CLOEXEC for SCM_RIGHTS 2007-07-16 09:05:45 -07:00
dccp [IPV6]: Do not send RH0 anymore. 2007-07-10 22:55:49 -07:00
decnet [NET]: Make all initialized struct seq_operations const. 2007-07-10 23:07:31 -07:00
econet [SK_BUFF]: Convert skb->tail to sk_buff_data_t 2007-04-25 22:26:28 -07:00
ethernet [ETH]: Validate address in eth_mac_addr 2007-07-11 19:41:18 -07:00
ieee80211 [PATCH] softmac: use list_for_each_entry 2007-07-08 22:16:37 -04:00
ipv4 [TCP]: Verify the presence of RETRANS bit when leaving FRTO 2007-07-15 00:19:29 -07:00
ipv6 [IPV6]: Call inet6addr_chain notifiers on link down 2007-07-15 00:16:35 -07:00
ipx [NET]: Make all initialized struct seq_operations const. 2007-07-10 23:07:31 -07:00
irda [NET]: Make all initialized struct seq_operations const. 2007-07-10 23:07:31 -07:00
iucv [AF_IUCV]: Add lock when updating accept_q 2007-07-14 19:04:25 -07:00
key xfrm: Add security check before flushing SAD/SPD 2007-06-07 13:42:46 -07:00
lapb [PATCH] remove many unneeded #includes of sched.h 2007-02-14 08:09:54 -08:00
llc [NET]: Make all initialized struct seq_operations const. 2007-07-10 23:07:31 -07:00
mac80211 [PATCH] mac80211: improved 802.11g CTS protection 2007-07-12 16:07:26 -04:00
netfilter [NETFILTER]: nf_conntrack: UDPLITE support 2007-07-14 20:48:44 -07:00
netlabel Audit: add TTY input auditing 2007-07-16 09:05:47 -07:00
netlink [NET]: Make all initialized struct seq_operations const. 2007-07-10 23:07:31 -07:00
netrom [NET]: Make all initialized struct seq_operations const. 2007-07-10 23:07:31 -07:00
packet [NET]: Make all initialized struct seq_operations const. 2007-07-10 23:07:31 -07:00
rfkill [RFKILL]: fix net/rfkill/rfkill-input.c bug on 64-bit systems 2007-07-14 18:50:15 -07:00
rose [NET]: Make all initialized struct seq_operations const. 2007-07-10 23:07:31 -07:00
rxrpc [NET]: Make all initialized struct seq_operations const. 2007-07-10 23:07:31 -07:00
sched [NET_SCHED]: Kill CONFIG_NET_CLS_POLICE 2007-07-15 00:03:05 -07:00
sctp [NET]: Make all initialized struct seq_operations const. 2007-07-10 23:07:31 -07:00
sunrpc authgss build fix 2007-07-16 09:05:34 -07:00
tipc [TIPC]: Optimize stream send routine to avoid fragmentation 2007-07-10 22:06:12 -07:00
unix [AF_UNIX]: Rewrite garbage collector, fixes race. 2007-07-11 14:22:39 -07:00
wanrouter [NET]: Make all initialized struct seq_operations const. 2007-07-10 23:07:31 -07:00
wireless [PATCH] cfg80211: Radiotap parser 2007-07-12 16:07:24 -04:00
x25 [NET]: Make all initialized struct seq_operations const. 2007-07-10 23:07:31 -07:00
xfrm [XFRM] Introduce standalone SAD lookup 2007-07-10 22:16:35 -07:00
compat.c O_CLOEXEC for SCM_RIGHTS 2007-07-16 09:05:45 -07:00
Kconfig 9p: Reorganization of 9p file system code 2007-07-14 15:13:40 -05:00
Makefile 9p: Reorganization of 9p file system code 2007-07-14 15:13:40 -05:00
nonet.c [PATCH] Make most file operations structs in fs/ const 2006-03-28 09:16:06 -08:00
socket.c O_CLOEXEC for SCM_RIGHTS 2007-07-16 09:05:45 -07:00
sysctl_net.c Remove obsolete #include <linux/config.h> 2006-06-30 19:25:36 +02:00
TUNABLE