Differentiating user activity from system activity
In the broadest possible sense, including definitions of 'user activity' and 'system activity', what schemes have people considered for the above?
On other unixes, audit events have an associated 'terminal'. On the face of it, this seems like a reasonable differentiator. I.e. a 'user' process has a terminal, a 'system' process does not. Is this any good?
On Linux we don't record a terminal. How about a non-default auid? What about system daemons restarted by an administrator? How about SELinux?
Your thoughts appreciated,
Matt
Signature · 6 lines
Matthew Booth, RHCA, RHCSS Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490
Quoted 1 line · Matthew Booth
On Linux we don't record a terminal.
We do record terminal info in the tty & term fields. Additionally, if the auid and ses fields are -1, you know its a process that was descended from init. If they have something in them, then it was descended from a login session.
Quoted 1 line
What about system daemons restarted by an administrator?
They would inherit the admin's environment and identifiers.
Quoted 1 line
How about SELinux?
Not sure how this applies.
-Steve
Quoted 6 lines · Steve Grubb
Quoted 1 line · Matthew Booth
On Linux we don't record a terminal.
We do record terminal info in the tty & term fields. Additionally, if the auid and ses fields are -1, you know its a process that was descended from init. If they have something in them, then it was descended from a login session.
I should have made this clear: the principal target is RHEL 4, although RHEL 5 features are worth noting. Do these fields exists in RHEL 5?
Quoted 3 lines
Quoted 1 line
What about system daemons restarted by an administrator?
They would inherit the admin's environment and identifiers.
Is that something you've ever given any thought to? This could be quite problematic in a number of situations. I suspect SELinux would be the answer here.
Quoted 3 lines
Quoted 1 line
How about SELinux?
Not sure how this applies.
This would be RHEL 5 only, but I was thinking something along the lines of differentiating based on SELinux context.
Matt