Complete review of various ABI system call lists to confirm all relevant system calls are assigned events. Add new event types as required. The mapping for most system calls to audit events is stored in the various syscalls.master (and similarly named files) around the kernel tree.
Complete review of system calls to make sure that all key arguments are being audited. As necessary, add AUDIT_ARG() calls to system call implementations.
Complete userland review, in particular of administrative and login-related tools, to make sure they are all auditing events appropriately. Many login programs do perform necessary auditing (sshd, login) but some still don't (ftpd). Administrative tools require more work – pw(8), password change tools, etc, all require audit support.
Create new application Audit
API allowing stateful and context-aware interpretation of audit trails – starting with file endian, but also including account information, etc.
Built-in support for compressing trails on rotation.
Investigation of the issue of cryptographic protection of trails, and perhaps a sample configuration for audit_notify showing how to encrypt trails on rotation.
Add NIS/YP/NSS support for audit configuration files so that audit configuration can be distributed with password/group/etc configuration data.
(csjp) Sequence-based IDS using BSM
(csjp) Network extensions to sequence-based IDS using BSM
(diego) Teach kernel firewalls and other kernel security systems how to use audit to report events, rather than syslog. This may require some amount of re-working of the kernel audit APIs to allow construction. Of particular interest will be changes to allow the audit code to run in ithread contexts where firewalls may be running. Add “ipfw audit”?
(simon) Investigate creation of a distributed audit daemon to reliably manage the transfer of audit trails to central audit management hosts. Ideally it would support cryptographic protection (SSL?) and reliable delivery (i.e., if the delivery aborts due to a reboot, it picks up about where it left off when it comes up again).
(marinos) Investigate adding multiple simultaneous audit trails with different security properties (i.e., allowing Apache to maintain its own application-layer trail). This might be implemented by encapsulating the notion of an “audit pipeline” in a structure/object that can be replicated. Quite a bit of work is required to figure out the right model here. One very nice property of this is that it would allow applications to submit audit records to a trail they could not later modify.
(marinos) Refine the relationship between jail and audit: add “zone” token support and stick jail names into zone tokens when auditing events in jails. Explore privilege issues relating to audit and jail: which audit system calls should, and which should not, be allowed in jail? Is audit about a single system trail tracking jails, or is there interest in per-jail audit trails? Since login/sshd/etc determine what should be audited for a user, does that require that we let jails determine what is audited?\
(gpf) Support for auditing NFS server events, firewall events.