AddAuditSupportToNFS

This is an old revision of the document!

Student: Shivank Garg (shivank@FreeBSD.org)
Mentor: Alan Somers (asomers@FreeBSD.org)

Add audit(4) support to NFS - Google Summer of Code 2020 project page

Idea of the project:

FreeBSD includes support for security event auditing. Security event auditing permits the selective and fine-grained configurable logging of security-relevant system events for the purpose of post-mortem analysis, intrusion detection, and run-time monitoring. It is important for advanced security and monitoring and is intended to meet the requirements of the Common Criteria(CC)/Common Access protection profile(CAPP) evaluation. The audit subsystem in FreeBSD, audit(4), can record a variety of system events like user-logins, file system activities, network activities, process creations, etc.

The sysadmin may wish to monitor the filesystem activities within the NFS network. It will require the sysadmin to run the auditd(8) on each NFS client, and audit trails can be transferred across the network with auditdistd(8). The security officer can review each client’s audit trails to review the NFS activities. This arrangement works perfectly fine in case of secure networks, where the admin has control over the clients as well as servers.

The auditd(8) on the server doesn’t generate any record trails for the NFS activities because the audit works mostly on the syscall level and the NFS server is implemented within the kernel. This makes it bypass the syscall layer and the requests go to the VFS layer.

In case NFS is used on insecure networks, running auditd(8) on each client is not an option as the audit records on the client can be tempered. The audit(4) support to the NFS server is a missing feature for such networks. Thus, The aim of this project is to audit each NFS RPC. This would allow audit of all NFS activities within the network by just running auditd(8) on the server.

Features: Audit support

Project description & Implementation

This project will require the modification in the NFS server code to allow audit of each NFS RPC. This will auditd(8) to audit all the NFS activities within the network. The NFS RPCs code lies mostly in nfs_nfsdserv.c and nfs_nfsdsocket.c. There would need to define AUDIT_NFSRPC_ENTER and AUDIT_NFSPRC_EXIT in a similar fashion to AUDIT_SYSCALL_ENTER and AUDIT_SYSCALL_EXIT at NFS RPC level.

For auditing events, within each NFS RPC, one or more AUDIT_ARG_* macros will be called. The various design questions have to be asked for shaping this project. For instance, how to distinguish NFS audit records from other records? One way can be to create new classes for NFS activities, but that would be inefficient. Another way can be to define a new RPC token in audit for the NFS server activities which will contain the information in the RPC requests to display in the audit record.

TBD

* Design the audit(4) support to NFS.

* Submit POC by generating an audit trail for the few major NFSv3 RPC.

* Test the implementation

* Ability to generate an audit trail for any NFSv3 RPC.

* Writing a Test Suite for the implementation.

* Documentation of the work

* Ability to generate an audit trail for any NFS RPC.

* Enhancing the Test Suite for the implementation.

* style(9) the code and submitting it for review

* Documentation and additions to man pages and handbook

For testing, I’ll be using Kyua(1) and ATF framework to test the NFS audit record trails. I already have some experience with Kyua and atf-sh. Also, I looked into Audit TestSuite, which is mostly written with atf-c. I hope I’ll be able to reuse it with some tweaking to work with NFS audit.