Auditing Overhead, Auditing Adaptation, and Benchmark Evaluation in Linux Lei Zeng1, Yang Xiao1* and Hui Chen2
Total Page：16
File Type：pdf, Size：1020Kb
SECURITY AND COMMUNICATION NETWORKS Security Comm. Networks 2015; 8:3523–3534 Published online 4 June 2015 in Wiley Online Library (wileyonlinelibrary.com). DOI: 10.1002/sec.1277 RESEARCH ARTICLE Auditing overhead, auditing adaptation, and benchmark evaluation in Linux Lei Zeng1, Yang Xiao1* and Hui Chen2 1 Department of Computer Science, The University of Alabama, Tuscaloosa 35487-0290, AL, U.S.A. 2 Department of Mathematics and Computer Science, Virginia State University, Petersburg 23806, VA, U.S.A. ABSTRACT Logging is a critical component of Linux auditing. However, our experiments indicate that the logging overhead can be significant. The paper aims to leverage the performance overhead introduced by Linux audit framework under various us- age patterns. The study on the problem leads to an adaptive audit-logging mechanism. Many security incidents or other im- portant events are often accompanied with precursory events. We identify important precursory events – the vital signs of system activity and the audit events that must be recorded. We then design an adaptive auditing mechanism that increases or reduces the type of events collected and the frequency of events collected based upon the online analysis of the vital-sign events. The adaptive auditing mechanism reduces the overall system overhead and achieves a similar level of protection on the system and network security. We further adopt LMbench to evaluate the performance of key operations in Linux with compliance to four security standards. Copyright © 2015 John Wiley & Sons, Ltd. KEYWORDS logging; overhead; Linux; auditing *Correspondence Yang Xiao, Department of Computer Science, The University of Alabama, 101 Houser Hall, PO Box 870290, Tuscaloosa 35487-0290, AL, U.S.A. E-mail: [email protected] 1. INTRODUCTION systems that cannot meet the requirements of the higher category). Category C sets forth the requirements for dis- Auditing in operating systems is necessary to achieve net- cretionary protection. Category B defines the requirements work and system security. Linux auditing watches file ac- for mandatory protection. In category A, formal verifica- cesses, monitors system calls, records commands run by tion methods are required to assure that sensitive or classi- users, and security events, such as authentication, authori- fied data processed or stored by the system can be zation, and privilege elevation, which is achieved via log- protected by discretionary and mandatory security con- ging the system activities to events. Attributes of an trols. Categories B and C are further divided into a number event include the date, time, type, subject identity, result, of subclasses, organized hierarchically. For example, class and sensitivity labels. C1 requires the separation user and data enforcement of ac- The book [1] published by the US Department of cess limitation to the data on an individual basis, while a Defense in 1985 defines the requirement of logging for more finely grained discretionary access control character- auditing purpose. This book is often referred to as “the izes class C2 so that actions of users become accountable Orange Book,” which has been regarded as the security via auditing of security-related events, log-in procedures, requirements for the design and implementation of secure and resource isolation. computer systems and has a profound influence on the The Common Criteria is closely related to the Orange design of secure computer systems. The Orange Book Book. Its goal is to establish a guideline for developing divides its security criteria into four categories, D, C, B, and evaluating computer products in regard to its security and A, which are organized in a hierarchical manner such features. The Common Criteria concentrates on the secu- that category D has the lowest level of security require- rity threads from human activities. It reiterates the audit ments while category A has the highest level. Category D requirement for secure computer systems. Logging is es- stands for the minimal protection (i.e., the computer sential to meet the requirement. Although these standards Copyright © 2015 John Wiley & Sons, Ltd. 3523 Auditing overhead and auditing adaptation in Linux L. Zeng, Y. Xiao and H. Chen recognize the importance of auditing, the focus is obvi- The rest of the paper is organized as follows. In ously placed in bookkeeping audit trail/log, which is in fact Section 2, we introduce Linux audit framework. Section 3 the system activity log. presents the Linux benchmarks and Linux security stan- In regard to the logging functionality of computer sys- dards. In Section 4, we study overhead of Linux logging. tems, audit information must be recorded and protected We propose an adaptive mechanism and study the perfor- selectively [1–8]. It is the logging functionality that keeps mance of the proposed adaptive logging in Section 5. In and protects the audit information, which is often referred Section 6, we present an evaluation for Linux benchmarks. to as audit trails, audit data, logs, or logging data. The Finally, we conclude the paper in Section 7. criteria also indicates that identifications are needed for individual subjects and access information, such as iden- tities of accessing information, and their authorization of 2. LINUX AUDIT FRAMEWORK accessing the information is mediated [1]. Information of identification and authorization must be saved in Linux audit provides users with a way to analyze system computers, protected from attractors, and used when activities in great detail [9]. It does not, however, protect performing some security-relevant actions [1]. Thus, the users from attacks [9]. Instead, Linux audit helps users to responsible party can be traced via its actions related to track these issues and take security measures to prevent security, and the outcome of the actions can be assessed, them [9]. and this is essentially based on the logging data recorded Linux audit framework includes several components: on nonvolatile memory. auditd, auditctl, audit rules, aureport, ausearch, audispd, Linux audit framework [9] helps Linux meet many and autrace, as shown in Figure 1 [9]. government and industrial security standards, such as We explain the functions in Figure 1 as follows [9]: Controlled Access Protection Profile/Evaluation Assurance Level 4+ (CAPP/EAL4+) [10], Labeled Security Protec- • Auditd – The audit daemon writes the audit messages tion Profile (LSPP) [11], role-based access control (RBAC) that collected in the Linux kernel to disk or transfers [12], National Industrial Security Program Operating them to audispd. The configuration file, /etc/ Manual (NISPOM) [13], Federal Information Security sysconfig/auditd, controls how the audit daemon Management Act (FISMA) [14], payment card industry starts, and the configuration file, /etc/auditd.conf, con- (PCI) [15,16], and Director of Central Intelligence Direc- trols how the audit daemon functions once it starts. tive 6/3 (DCID 6/3) [17]. It is important to the adoption • Auditctl – The auditctl utility is responsible for kernel of Linux in mission critical environments to meet the settings, log generation parameters, and audit rules requirements of the security standards; otherwise, Linux that determine which events are tracked. cannot compete with other commercial operating systems, • Audit rules – Audit rules are contained in the file /etc/ such as IBM AIX and Windows Server. They have already audit.rules. The file is loaded when the system boots received certifications in many government and industrial and starts audit daemon. security standards. • Aureport – The aureport utility helps users to create a However, to the best of our knowledge, an important custom view of logged messages. question remains open: What is the performance overhead • Ausearch – Users can use the ausearch utility to induced by Linux audit framework under various traffic search some events with characteristics, such as keys, and usage patterns? Would recent development and devel- of the logged format in the log file. opment of high-throughput/high-bandwidth networks fur- • Audispd – The audit dispatcher daemon (audispd) dis- ther stress Linux audit framework? patches event messages to other applications instead In this paper, we first identify the important usage pat- of writing them to a disk. terns of Linux operating systems, and then, we design ex- periments to measure the overhead induced by the Linux audit framework in these usage patterns. The experiments inform the design of an adaptive auditing mechanism, which uses a set of selected but important type of events as the vital sign of system and network activity and uses the vital signs to adjust audit logging. In order to change the type of events logged, the frequency of events logged and the time-window intensive logging must be per- formed. The adoption achieves a low overhead in normal uses and at the same time provides the same amount of audit data sufficiently to accomplish an audit during critical events, such as system and network intrusion. We further adopt LMbench to evaluate the performance of key operations in Linux with compliance to four secu- rity standards. Figure 1. Linux audit framework [9]. 3524 Security Comm. Networks 2015; 8:3523–3534 © 2015 John Wiley & Sons, Ltd. DOI: 10.1002/sec L. Zeng, Y. Xiao and H. Chen Auditing overhead and auditing adaptation in Linux An audit event that is written to disk is shown in 3. LINUX BENCHMARKS AND Figure 2. SECURITY STANDARDS There are several keywords in an audit event record: type, msg, arch, syscall, success, exit, a0 to a3, items, ppid, 3.1. Synthetic benchmarks versus pid, auid, uid, gid, euid, suid, fsuid, tty, comm., exe, subj, application benchmarks key, item, name, inode, dev, mode, and ouid. We explain them in details as follows [9]: There are two kinds of benchmarks for operating systems: synthetic and application [18]. In application benchmarks, • The type field in the record denotes the type of events a common application is chosen to test the system perfor- recorded. mance. One drawback of application benchmarks is that • The msg field stores a message identification (ID).