Section 5.5.12. Privilege Auditing

5.5.12. Privilege Auditing

The project introduces a system call that needs auditing, setppriv(2); it also adds two new opcodes to modctl() that need auditing too. Three new audit events, AUE_SETPPRIV, AUE_MODALLOCPRIV, and AUE_MODDEVPLCY are generated for changing privilege sets, adding a privilege from outside the kernel, and changing the device policy, respectively.

Solaris keeps track of whether suser() was called and whether it was called successfully and recorded its information in the audit trail. Many "privilege checks," such as drv_priv(9f), turned out to be direct comparisons of the effective uid to zero, which are not recorded in the audit trail.

The Least Privilege implementation takes a cue from Trusted Solaris and records the privileges the process used or failed to use in the audit trail. The privileges are recorded in their textual representation. The successful use of basic privileges is not audited. The attempt to use a basic privilege that is missing is audited because it can be considered an event that should not have taken place. The already defined audit modifier tokens AUT_PRIV and AUT_UPRIV are used for that purpose.