From gww@sac.sfbay.sun.com Fri Jun 12 13:05:23 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n5CK5M5X027173 for ; Fri, 12 Jun 2009 13:05:23 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n5CK5E60008656; Fri, 12 Jun 2009 21:05:22 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KL500B2V6GX2400@brm-avmta-1.central.sun.com>; Fri, 12 Jun 2009 14:05:21 -0600 (MDT) Received: from dm-sfbay-01.sfbay.sun.com ([129.145.155.118]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KL5002FA6GW2A70@brm-avmta-1.central.sun.com>; Fri, 12 Jun 2009 14:05:21 -0600 (MDT) Received: from sac.sfbay.sun.com (sac.SFBay.Sun.COM [129.146.226.132]) by dm-sfbay-01.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n5CK5IVm003242; Fri, 12 Jun 2009 13:05:18 -0700 (PDT) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n5CK5Hqj027167; Fri, 12 Jun 2009 13:05:17 -0700 (PDT) Received: (from gww@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id n5CK5HW7027163; Fri, 12 Jun 2009 13:05:17 -0700 (PDT) Date: Fri, 12 Jun 2009 13:05:17 -0700 (PDT) From: Gary Winiger Subject: Subject: PSARC/2009/354 Always on / no reboot Solaris Audit To: PSARC-ext@sun.com Cc: audit-core@sun.com, glenn.brunette@sun.com, marek.pospisil@sun.com Message-id: <200906122005.n5CK5HW7027163@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 5414 I'm sponsoring this case for Marek Pospisil and the Solaris Audit project team. It requests a Minor Release Binding and an unchanged interface taxonomy. I believe it qualifies for self-review and have marked it "closed approved automatic." I'm happy to turn it into a fast track and set a timer if anyone believes I've misjudged. Full diffmarked man pages are in the case directory. Gary.. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Background: ========== Historically, Solaris Auditing required the administrator to run the now obsolete bsmconv(1m) command, configure auditing and REBOOT. To disable auditing the administrator had to run the now obsolete bsmunconv(1m) command and REBOOT. Customer feedback from most enterprise shops has consistently been that rebooting has been an impedement to their use of Solaris Auditing. See also, RFE 6192139 Solaris auditing should always be enabled bsmconv has contained two functions. One was to modify system(4) to load the Solaris Audit kernel module (set c2audit:audit_load = 1), thus requiring the reboot, and enable the audit service. The other was to configure device allocation, allocate(1). In preparation for this case and one that rearchitects device allocation to be always available, PSARC/2008/787 Obsolete of some Solaris Audit commands, obsoleted bsmconv/bsmunconv. A future case when device allocation no longer requires running bsmconv/bsmunconv will request their removal. With the integration of this case, bsmconv/bsmunconv will still enable/disable the audit service and configure/disable device allocation. If desired, it remains possible to modify system(4) to cause the audit module not to be loaded (exclude c2audit). Proposal: ======== No longer require the modification of system(4) and the implied reboot. Solaris Auditing will always be available to be configured and then enabled either by bsmconv(1m) if device allocation is also desired or by audit(1m) -s. Solaris Auditing can similarly be disabled by running bsmunconv(1m) or by audit(1m) -t. While audit -s/-t is the preferred, documented, and historic interface for enabling(or refreshing)/disabling the audit daemon (from pre-smf days through this case), svcadm enable/refresh/disable svc:/system/auditd will work as well. The audit(1m), auditd(1m) and bsmconv/bsmunconv(1m) man pages are updated: audit(1m): ========== OPTIONS -n Notify the audit daemon to close the current audit file and open a new audit file in the current audit directory. -s Notify the audit daemon to read the audit control file. The audit daemon stores the information internally. If the audit daemon is not running, - but audit has been enabled by means of - bsmconv(1M), the audit daemon is started. + enable (start) the audit daemon. -t Direct the audit daemon to close the current - audit trail file, disable auditing, and die. Use + audit trail file and disable (stop) the audit daemon. Use -s to restart auditing. -v path Verify the syntax for the audit control file stored in path. The audit command displays an approval message or outputs specific error mes- sages for each error found. NOTES - The functionality described in this man page is available - only if the Solaris Auditing feature has been enabled. See - bsmconv(1M) for more information. For the -s option, audit validates the audit_control syntax and displays an error message if a syntax error is found. If a syntax error message is displayed, the audit daemon does not re-read audit_control. Because audit_control is pro- - cessed at boot time, the -v option is provided to allow syn- + cessed at the time the audit deamon is enabled, the -v + option is provided to allow syn- tax checking of an edited copy of audit_control. Using -v, audit exits with 0 if the syntax is correct; otherwise, it returns a positive integer. auditd(1m): ========== DESCRIPTION audit(1M) is used to control auditd. It can cause auditd to: + o to enable auditd if not enabled; o close the current audit file and open a new one; o close the current audit file, re-read /etc/security/audit_control and open a new audit file; o close the audit trail and terminate auditing. NOTES - The functionality described in this man page is available - only if the Solaris Auditing feature has been enabled. See - bsmconv(1M) for more information. - auditd is loaded in the global zone at boot time if auditing - is enabled. See bsmconv(1M). bsmconv/bsmunconv(1m): ========== ATTRIBUTES ____________________________________________________________ | ATTRIBUTE TYPE | ATTRIBUTE VALUE | |_____________________________|_____________________________| | Availability | SUNWcsr | |_____________________________|_____________________________| | Interface Stability | Obsolete Committed | |_____________________________|_____________________________| NOTES bsmconv and bsmunconv are not valid in a non-global zone. These commands are Obsolete and may be removed and replaced with equivalent functionality in a future release of Solaris. + The audit(1M) command may also be used to enable Solaris Auditing. From gdamore@sun.com Fri Jun 12 13:21:20 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n5CKLKDv027838 for ; Fri, 12 Jun 2009 13:21:20 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n5CKLHBl017642; Fri, 12 Jun 2009 21:21:19 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KL50090377HD000@nwk-avmta-1.sfbay.Sun.COM>; Fri, 12 Jun 2009 13:21:17 -0700 (PDT) Received: from sca-es-mail-1.sun.com ([192.18.43.132]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KL500MJV77HOU40@nwk-avmta-1.sfbay.Sun.COM>; Fri, 12 Jun 2009 13:21:17 -0700 (PDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n5CKLH41020819; Fri, 12 Jun 2009 13:21:17 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KL500J0072A9D00@fe-sfbay-09.sun.com>; Fri, 12 Jun 2009 13:21:17 -0700 (PDT) Received: from [192.168.251.11] ([unknown] [76.93.15.33]) by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KL50014A777LM70@fe-sfbay-09.sun.com>; Fri, 12 Jun 2009 13:21:08 -0700 (PDT) Date: Fri, 12 Jun 2009 13:21:07 -0700 From: "Garrett D'Amore" Subject: Re: Subject: PSARC/2009/354 Always on / no reboot Solaris Audit In-reply-to: <200906122005.n5CK5HW7027163@sac.sfbay.sun.com> Sender: Garrett.Damore@sun.com To: Gary Winiger Cc: PSARC-ext@sun.com, audit-core@sun.com, Glenn.Brunette@sun.com, Marek.Pospisil@sun.com Message-id: <4A32B8B3.4080907@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200906122005.n5CK5HW7027163@sac.sfbay.sun.com> User-Agent: Thunderbird 2.0.0.18 (X11/20081201) Status: RO Content-Length: 5750 Gary Winiger wrote: > I'm sponsoring this case for Marek Pospisil and the Solaris Audit > project team. It requests a Minor Release Binding and an unchanged > interface taxonomy. > > I believe it qualifies for self-review and have marked it "closed approved > automatic." I'm happy to turn it into a fast track and set a timer if > anyone believes I've misjudged. > +1 in advance in case someone does do so. :-) -- Garrett > Full diffmarked man pages are in the case directory. > > Gary.. > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > Background: > ========== > Historically, Solaris Auditing required the administrator to run the > now obsolete bsmconv(1m) command, configure auditing and REBOOT. > To disable auditing the administrator had to run the now obsolete > bsmunconv(1m) command and REBOOT. Customer feedback from most enterprise > shops has consistently been that rebooting has been an impedement to > their use of Solaris Auditing. See also, RFE 6192139 Solaris auditing should > always be enabled > > bsmconv has contained two functions. One was to modify system(4) to > load the Solaris Audit kernel module (set c2audit:audit_load = 1), thus > requiring the reboot, and enable the audit service. The other was to > configure device allocation, allocate(1). In preparation for this case > and one that rearchitects device allocation to be always available, > PSARC/2008/787 Obsolete of some Solaris Audit commands, obsoleted > bsmconv/bsmunconv. A future case when device allocation no longer requires > running bsmconv/bsmunconv will request their removal. With the integration > of this case, bsmconv/bsmunconv will still enable/disable the audit service and > configure/disable device allocation. > > If desired, it remains possible to modify system(4) to cause the audit > module not to be loaded (exclude c2audit). > > Proposal: > ======== > No longer require the modification of system(4) and the implied reboot. > Solaris Auditing will always be available to be configured and then > enabled either by bsmconv(1m) if device allocation is also desired or > by audit(1m) -s. Solaris Auditing can similarly be disabled by running > bsmunconv(1m) or by audit(1m) -t. > > While audit -s/-t is the preferred, documented, and historic interface for > enabling(or refreshing)/disabling the audit daemon (from pre-smf days through > this case), svcadm enable/refresh/disable svc:/system/auditd will work > as well. > > The audit(1m), auditd(1m) and bsmconv/bsmunconv(1m) man pages are updated: > > audit(1m): > ========== > > OPTIONS > -n Notify the audit daemon to close the current > audit file and open a new audit file in the > current audit directory. > > -s Notify the audit daemon to read the audit control > file. The audit daemon stores the information > internally. If the audit daemon is not running, > - but audit has been enabled by means of > - bsmconv(1M), the audit daemon is started. > + enable (start) the audit daemon. > > -t Direct the audit daemon to close the current > - audit trail file, disable auditing, and die. Use > + audit trail file and disable (stop) the audit daemon. Use > -s to restart auditing. > > -v path Verify the syntax for the audit control file > stored in path. The audit command displays an > approval message or outputs specific error mes- > sages for each error found. > > NOTES > - The functionality described in this man page is available > - only if the Solaris Auditing feature has been enabled. See > - bsmconv(1M) for more information. > > For the -s option, audit validates the audit_control syntax > and displays an error message if a syntax error is found. If > a syntax error message is displayed, the audit daemon does > not re-read audit_control. Because audit_control is pro- > - cessed at boot time, the -v option is provided to allow syn- > + cessed at the time the audit deamon is enabled, the -v > + option is provided to allow syn- > tax checking of an edited copy of audit_control. Using -v, > audit exits with 0 if the syntax is correct; otherwise, it > returns a positive integer. > > auditd(1m): > ========== > > DESCRIPTION > > audit(1M) is used to control auditd. It can cause auditd to: > > + o to enable auditd if not enabled; > > o close the current audit file and open a new one; > > o close the current audit file, re-read > /etc/security/audit_control and open a new audit > file; > > o close the audit trail and terminate auditing. > > NOTES > - The functionality described in this man page is available > - only if the Solaris Auditing feature has been enabled. See > - bsmconv(1M) for more information. > > - auditd is loaded in the global zone at boot time if auditing > - is enabled. See bsmconv(1M). > > bsmconv/bsmunconv(1m): > ========== > ATTRIBUTES > ____________________________________________________________ > | ATTRIBUTE TYPE | ATTRIBUTE VALUE | > |_____________________________|_____________________________| > | Availability | SUNWcsr | > |_____________________________|_____________________________| > | Interface Stability | Obsolete Committed | > |_____________________________|_____________________________| > > NOTES > bsmconv and bsmunconv are not valid in a non-global zone. > > These commands are Obsolete and may be removed and replaced > with equivalent functionality in a future release of > Solaris. > > + The audit(1M) command may also be used to enable Solaris Auditing. >