One of Linux Security System Study Notes: Linux Log System and Audit System

 

I recently read "Linux security system analysis and programming" and want to release some notes. This is the first article.

Linux's log system is mainly a syslog system architecture. The kernel function printk writes messages to a circular buffer for high-level sys_syslog system calls to read messages. In the code sectionLinux/Kernel/Printk. c 

The audit system of Linux provides a method to record system security information, which provides system administrators with prompt warnings when users violate system security rules. Other kernel threads write data to the socket Buffer Queue audit_skb_queue through the kernel audit API. The kernel thread kauditd uses the netlink mechanism to send the audit message to the main thread of the user control's audit background auditd, the main auditd thread then sends the audit message to the log file writing thread in the audit background through the event queue to write the log file. On the other hand, the audit background also sends audit messages to the dispatcher application through a pipe bound to the socket. The code is mainly used in linux/kernel/audit. c.

Auditd is not installed and started in Debian by default. You need to enable it through aptitude install auditd.