Dynamic Procedures

Dynamic controls apply to one workstation at a time, since the audit command only applies to the current workstation where you are logged in. Use dynamic controls to test auditing on a workstation (estimate volume of records, for example), or to add an auditing flag without having to reboot the workstation. However, if you make dynamic changes on one workstation for other than testing purposes, you should make the changes on all workstations.

The following procedures work only when auditing is enabled.

To Determine Current Audit Policy

The auditconfig(1M) command enables an appropriately configured role to determine audit policy and to see what policies can be set. If your role is not configured to determine the policy, or if auditing is turned off, the command auditconfig -getpolicy returns an error. The following example was run by the role secadmin, at label admin_low:

$ auditconfig -getpolicy
	audit policies = none
$ auditconfig -lspolicy
policy string   description: 
	arge    include exec environment args in audit recs 
	argv    include exec args in audit recs 
	cnt     when no more space, drop recs and keep a count 
	group   include supplementary groups in audit recs 
	seq     include a sequence number in audit recs 
	trail   include trailer tokens in audit recs 
	path    allow multiple paths per event 
	acl 	   include ACL information in audit recs 
	ahlt    halt machine if we can't record an async event 
	slabel  include sensitivity labels in audit recs 
	passwd  include cleartext passwords in audit recs 
	windata_down 	include downgraded information in audit recs 
	windata_up 	include upgraded information in audit recs 
	all     all policies 
	none 	no policies 

To Create an Admin_High Workspace

To label files admin_high or to move them to an admin_high directory, to reset the audit daemon, and to make other changes in auditing requires an admin_high process. An admin_high process starts from an admin_high workspace.

1. Click the right button on the Front Panel and choose Assume secadmin Role from the menu.

   A secadmin role workspace becomes the current workspace.

2. In the current workspace, click the right button on the workspace name (secadmin) button and choose Change Workspace SL from the menu.

3. In the label builder, click the ADMIN_HIGH button.

4. Click OK at the bottom of the label builder.

   The color of the workspace button turns to black, indicating an admin_high workspace. An admin_high workspace is available only to an administrative role.

To Set Audit Policy Temporarily

The auditconfig command enables you to change audit policy, such as whether to include acl information in the audit record. Since the policy variable is a dynamic kernel variable, the policy that you set is in effect until the workstation next boots. See the auditconfig(1M) man page for a list of policy parameters.

To set policies in one invocation of the command, or to override all current policies, as role secadmin at label admin_low, separate the policies with commas (no spaces):

$ auditconfig -setpolicy trail,seq $ auditconfig -getpolicy audit policies = trail,seq $ auditconfig -setpolicy argv,acl $ auditconfig -getpolicy audit policies = argv,acl

To add policies to the current policies, as role secadmin at label admin_low, preface each added policy with a plus (+):

$ auditconfig -setpolicy trail,seq $ auditconfig -getpolicy audit policies = trail,seq $ auditconfig -setpolicy +argv $ auditconfig -setpolicy +acl $ auditconfig -getpolicy audit policies = seq,trail,argv,acl

To remove policies from the current policies, as role secadmin at label admin_low, preface each policy to be removed with a minus (-):

$ auditconfig -setpolicy trail,seq $ auditconfig -getpolicy audit policies = trail,seq $ auditconfig -setpolicy -seq $ auditconfig -getpolicy audit policies = trail

In the examples above, the trail and seq tokens are added to debug audit trail discrepancies. To set policies permanently, enter the auditconfig command in the audit_startup(1M) script. See "To Set Audit Policy Permanently" for how to edit the script.

To run auditing in an evaluated configuration, the cnt policy cannot be turned on; the ahlt policy (the default) cannot be turned off.

To Change Audit Flags Dynamically

The auditconfig(1M) command enables you to change audit flags dynamically, such as adding extra flags to a user, a session, or a process while the user, session, or process is active. Since the flags are added dynamically, they are in effect until the user logs out, the session ends, or the process ends.

To set a particular user to be additionally audited for successful file reads, as role secadmin at label admin_low:

$ auditconfig -setumask audit_user_id +fr

To set a particular session to be additionally audited for failed file attribute access, as role secadmin at label admin_low:

$ auditconfig -setsmask audit_session_id -fa

To set a particular process to be additionally audited for successful and unsuccessful file attribute modifications, as role secadmin at label admin_low:

$ ps -ef | grep application-to-be-monitored $ auditconfig -setpmask process_id fm

To Stop the Audit Daemon

Only one audit daemon may run at a time. An attempt to start a second one will result in an error message, and the new one will exit. If there is a problem with the audit daemon, terminate the audit daemon gracefully, then restart it manually.

To stop the audit daemon in event of trouble, as role secadmin, at label admin_high:

$ audit -t

This is not recommended. Audit records may be lost.

To Start the Audit Daemon

The audit daemon starts when the workstation is brought up to multiuser mode, and restarts when the audit daemon is instructed by the audit -s command to reread an audit configuration file.

To restart the audit daemon in event of trouble or a change to an audit configuration file, as role secadmin, at label admin_high:

$ audit -s

The pointer may be reset to the beginning of the list of audit directories when the administrator enters the audit -s command.

To Send Audit Records to a New Audit File

To change the current audit file for audit records being generated on the workstation, as role secadmin at label admin_high:

$ audit -n filename

The new file is created in the same directory as the current file. The directory must be able to contain files labeled admin_high.