Figure 5-69: Audit framework components
5.6.1.1 Audit kernel components
Linux Audit of the SLES kernel includes three kernel-side components relating to the audit functionality. The
first component is a generic mechanism for creating audit records and communicating with user space. The
communication is achieved via netlink socket interface. Netlink enables the transfer of information between
kernel modules and user-space processes. It provides kernel-user space bidirectional communication links.
Linux Audit consists of a standard sockets-based interface for user processes and an internal kernel API for
kernel modules.
5.6.1.1.1 Kernel-userspace interface
On top of netlink, there exists the generic netlink family that provides simplified access for less demanding
users. This introduces a control for ID management and name resolution, and possesses a new type of safety
interface for netlink messages and attributes handling. This interface also features simplified message
constructing, validation capabilities, and documentation.
This first component also receives user-space commands to control the operation of the audit framework and
to set the audit filter rules and file system watch points.
132
Summary of Contents for Novell 10 SP1 EAL4
Page 1: ...SUSE Linux Enterprise Server 10 SP1 EAL4 High Level Design Version 1 2 1...
Page 23: ...11...
Page 29: ...17...
Page 43: ...31...
Page 54: ...42 Figure 5 8 New data blocks are allocated and initialized for an ext3 field...
Page 117: ...105 Figure 5 48 Page Address Translation and access control...
Page 125: ...113 Figure 5 54 31 bit Dynamic Address Translation with page table protection...
Page 126: ...114 Figure 5 55 64 bit Dynamic Address Translation with page table protection...
Page 172: ...160 Figure 5 79 System x SLES boot sequence...
Page 214: ...202...
