Audit Management by Role in Trusted Extensions

Auditing in Trusted Extensions requires the same planning as in the Oracle Solaris OS. For details about planning, see Chapter 29, Planning for Oracle Solaris Auditing, in System Administration Guide: Security Services.

Role Setup for Audit Administration

In Trusted Extensions, auditing is the responsibility of two roles. The System Administrator role sets up the disks and the network of audit storage. The Security Administrator role decides what is to be audited, and specifies the information in the audit configuration files. As in the Oracle Solaris OS, you create the roles in software. The rights profiles for these two roles are provided. The initial setup team created the Security Administrator role during initial configuration. For details, see Create the Security Administrator Role in Trusted Extensions.

Note - A system only records the security-relevant events that the audit configuration files configure the system to record (that is, by preselection). Therefore, any subsequent audit review can only consider the events that have been recorded. As a result of misconfiguration, attempts to breach the security of the system can go undetected, or the administrator is unable to detect the user who is responsible for an attempted breach of security. Administrators must regularly analyze audit trails to check for breaches of security.

Audit Tasks in Trusted Extensions

The procedures to configure and manage auditing in Trusted Extensions differ slightly from Oracle Solaris procedures. In Trusted Extensions, audit configuration is performed in the global zone by one of two administrative roles. Then, the system administrator copies specific customized audit files from the global zone to every labeled zone. By following this procedure, user actions are audited identically in the global zone and in labeled zones

For details, see Audit Tasks of the Security Administrator and Audit Tasks of the System Administrator

Audit Tasks of the Security Administrator

The following tasks are security-relevant, and are therefore the responsibility of the security administrator. Follow the Oracle Solaris instructions.

Task	For Oracle Solaris Instructions	Trusted Extensions Instructions
Configure audit files.	Configuring the Audit Service (Task Map) in System Administration Guide: Security Services
(Optional) Change default audit policy.	How to Change Audit Policy in System Administration Guide: Security Services
Disable and re-enable auditing.	How to Disable the Audit Service in System Administration Guide: Security Services	Auditing is enabled by default.
Manage auditing.	Oracle Solaris Auditing (Task Map) in System Administration Guide: Security Services	Ignore per-zone audit tasks.

Audit Tasks of the System Administrator

The following tasks are the responsibility of the system administrator. Follow the Oracle Solaris instructions.

Task	For Oracle Solaris Instructions	Trusted Extensions Instructions
Create a ZFS file system that is dedicated to audit files. Create an `audit_warn` alias.	Managing Audit Records on Local Systems (Tasks) in System Administration Guide: Security Services How to Configure the audit_warn Email Alias in System Administration Guide: Security Services	Perform all administration in the global zone.
Copy or loopback mount customized audit files to labeled zones.	Configuring the Audit Service in Zones (Tasks) in System Administration Guide: Security Services	Loopback mount or copy the files to every labeled zone after the zones are created.
(Optional) Distribute audit configuration files.	No instructions	See How to Copy Files From Portable Media in Trusted Extensions
Manage auditing.	Oracle Solaris Auditing (Task Map) in System Administration Guide: Security Services	Ignore per-zone audit tasks.
Select audit records by label.	How to Select Audit Events From the Audit Trail in System Administration Guide: Security Services	To select records by label, use the `auditreduce` command with the `-l` option.

Skip Navigation Links
Exit Print View
	Oracle Solaris Trusted Extensions Configuration and Administration Oracle Solaris 11 Express 11/10