Rule Set Based Access Control (RSBAC) - The Logging System

| # Rule Set Based Access Control (RSBAC) for Linux - Logging

## The Logging System

The Access Control Decision Facility (ADF) contains a powerful logging system. It is possible to specify the event to be logged in dependence of the request type, user, executable and target object (file, fifo, symlink, directory, device, network device or network object (through template)). Some of these features have to be turned on in the kernel configuration.

Logged items are the request, process ID, program name, real or pseudonymous user ID, target type, target ID, attribute type, attribute value, ADF decision and the names of the modules that made this decision.

For each logging switch, the log level can be set individually for each request type:

- For request types, there are three log levels: none, denied requests only and full. 'Denied' is the default setting for all requests. This lets you see all denied requests in the log, although logging has never been set up.
- For target objects (file, fifo, symlink, dir, device, network device and network object only), there are four log levels: none, denied requests only, full and request based (s.a.). The default setting for all these objects is request based (see above).
- For users and executables, there are only two levels: none and full. The default is of course none.

The request based logging is set via the switch_adf_log command line tool, the current values can be seen in /proc/rsbac-info/adf_loglevel. The individual log settings are implemented as attributes and are set via the usual tools.

As all accesses to log settings are access controlled, each model can implement its own access control scheme for their protection.

Whenever a request has run through all modules, the decision dispatcher goes through the following algorithm to decide, whether the request is to be logged. Please note that logging takes place, if at least one of these steps decides that logging is needed. So the decision 'log' terminates the algorithm.

1. If individual user logging is on and the user's log level for this request type is
   - none: go to step 2
   - full: log
2. If individual program logging is on and the program's log level for this request type is
   - none: go to step 3
   - full: log
3. If individual object logging is on, the object is of type file, fifo, symlink, dir, device, network device or network object and the object's log level for the request type is:
   - none: no logging
   - denied: log, if result is NOT_GRANTED, else no logging
   - full: log
   - request based: go to step 4
4. If the log level for the request type is
   - none: no logging
   - denied: log, if result is NOT_GRANTED, else no logging
   - full: log

The algorithm is also used to determine, whether an rsbac_adf_set_attr() call has to be logged - just replace 'result is NOT_GRANTED' by 'function returned an error'.

The rsbac_adf_set_attr() notification function is called from most interception points to inform the decision modules that the intercepted functionality has been performed successfully and that they should adjust their attribute values. It is also the only way to tell the decision modules about newly created objects.

Questions, tips, etc.

19-Mar-02, -ao