===== Audit Kernel Events =====

==== Mentor ====

RobertWatson

==== Student (+contact information) ====

EfstratiosKaratzas

==== Abstract ====

Kernel subsytems such as NFS & PF can be enhanced to log security related information using %%TrustedBSD%%'s Audit subsystem. The kernel audit framework will need serious reworking itself because it is currently based on the notion that information is gathered only through system calls and a single kernel thread will be involved in at most one security event at a time. This project will focus on providing audit support for NFS RPCs and the necessary foundations for modifying other kernel subsystems.

==== p4 depot path ====

%%//%%depot/projects/soc2010/gpf_audit/freebsd/

==== Timeline ====
May 1 – May 10: <del>Provide audit support for current NFS server implementation, using only vn_fullpath(9). Perform first tests.</del>

May 11 – May 20: <del>Some extra research + design & coding of a new KPI that produces a path, given a vnode pointer. Thorough testing & writing of man page for the KPI.</del>

May 21 – May 27: <del>Integrate the new KPI to NFS code, more testing & bug fixing. This actually led to the creation of a new VOP, VOP_GETPARENT(), and a new vfs op, VFS_FHTOHINT().</del> Release code & demos to get feedback from the community & sysadmins.

May 28 – June 5: <del>Study nfsv4 implementation + start pondering about handling multiple audit records in a single kernel thread.</del>

June 6 – June 13: <del>Design a solution for this problem(rough patch). Request assistance from mentor.</del>

June 14 – June 25: <del>Provide audit support for new NFS server implementation, at least for NFS v2&3 rpcs.</del>

June 26 – July 12: <del>Provide support for NFSv4 compound rpcs, thorough testing.</del>

July 13 – July 23: <del>By this time, I will have some feedback on my proposed solution for the simultaneous handling of multiple td_ars in a kthread. Write some code and see if it applies cleanly to other parts of the kernel that use the audit framework (most notably the sys/calls), without breaking anything.</del>

July 24 – August 16: <del>Remaining tasks: Introduce new token types to bsm libs & praudit - write/update man pages - make praudit match NFS error codes to NFS error messages - revisit NFSv4 operation "OPEN" - ???</del>

<del>Final shipping to Google.</del>

//EOF//

==== Demo ====
Following, are two audit logs from my own NFS server. The experimental NFS server found in sys/fs/nfsserver was used to produce these logs. The protocols used are NFSv3 and NFSv4.

To produce these logs, I executed a shell script that triggers most of the NFS RPCs; it can be found {{soc2010efstratioskaratzas/test.sh?linkonly|here}}.
The actual logs can be found {{soc2010efstratioskaratzas/nfsv3_log.txt?linkonly|here(NFS v3)}} and {{soc2010efstratioskaratzas/nfsv4_log.txt?linkonly|here(NFS v4)}}.

== Note ==
There is a new argument for praudit(1), 'c' so that foreign credentials are not matched against local userbase and are shown in raw numeric form; alternatively, argument 'r' can also be used. Argument '-c' was used to produce these logs.
The NFS v4 log is much larger because the protocol wraps simple operations into a bunch of multiple RPCs (compound RPCs); I've stripped non NFS relevant Audit Events so the logs should not prove too hard to read.

==== Code Sample ====

This is a diff file that was procuded at the end of gsoc; last update: August 30 2010

{{soc2010efstratioskaratzas/gpf_audit.diff?linkonly|gpf_audit.diff}}

== Note ==
There are some files missing from the diff file; 3 new man pages that were introduced while working no this project: vn_fullpath_nocache(9), VOP_GEPARENT(9), VFS_FHHINT(9)

==== FreeBSD Dev Summit 2010 (Karlsruhe) Presentation ====

{{201010DevSummit/2010DevSummitAuditNFS.pdf?linkonly|slides}}

Feel free to share any thoughts!

==== References ====

  * [[http://www.trustedbsd.org/docs.html|Audit Documentation]]
  * [[http://www.commoncriteriaportal.org/files/ppfiles/capp.pdf|CC/CAPP specification]]
  * The Design and Implementation of the %%FreeBSD%% Operating System, by %%McKusick%% & Neville-Neil
  * [[http://www.ietf.org/rfc/rfc1094.txt|NFSv2 RFC]]
  * [[http://www.ietf.org/rfc/rfc1813.txt|NFSv3 RFC]]
  * [[http://www.ietf.org/rfc/rfc3530.txt|NFSv4 RFC]]
  * [[http://hub.opensolaris.org/bin/download/Community+Group+zfs/docs/ondiskformat0822.pdf|ZFS On-Disk Specification]]