[LU-9727] Lustre Audit with Changelogs

• Type: New Feature
• Resolution: Fixed
• Priority: Minor
• Fix Version/s: Lustre 2.11.0, Lustre 2.12.0
• Affects Version/s: Lustre 2.10.0
• Labels: feature patch sec
• Assignee: Sebastien Buisson (Inactive)
• Reporter: Sebastien Buisson (Inactive)

Description

Hi,

As Lustre Changelogs are a centralized mechanism reporting activity on the file system, we would like to use it as a basis for an audit facility for Lustre. The aim is to be able to track all accesses to files residing on Lustre, so that they can be recorded and looked up later for auditing purposes.

Changelogs cannot be used as-is to achieve auditing, because of the following limitations we have identified so far:
(a) uid/gid information is not recorded;
(b) OPEN and GEXATTR operations are not recorded;
(c) CLOSE operations are not recorded if the file is opened in READ_ONLY mode;
(d) Changelogs only record successful operations, not attempts.

Further comments on limitations:
(a) LU-1996 (https://review.whamcloud.com/4060) added support for jobid in Changelogs. If jobid is set to procname_uid, Changelogs will contain procname.uid information. So this could be used to know which user is doing the access. But jobid can be used for another purpose than audit, so we cannot always rely on it. We should create a new changelog extension similar to changelog_ext_jobid, that would hold uid/gid information.

(b) and (c) We do understand that it would have a performance cost to record OPEN and GEXATTR operations, as it would mean generating a write in the Changelogs for a read operation. Similarly for a CLOSE when a file is opened read-only. We will have to exclude OPEN and GETXATTR from the default Changelogs mask, and potentially create a dedicated changelogs entry type for the 'close on read-only' case, excluded by default. Moreover, we will evaluate the performance cost when these operations are recorded.

(d) Having all access attempts recorded will definitely increase MDS/MDT load, so we should examine carefully the performance impact of doing this. We would warn users about how much they would suffer by recording all access attempts.

I will feed this ticket by pushing patches to address the various limitations identified here (and possibly others to come).

Sebastien.

Issue Links

• is related to: LU-11050 mdd: modifying changelog_deniednext does not yield immediate result
• is related to: LU-10450 NULL pointer deref in mdd_changelog_data_store_by_fid+0xfa
• is related to: LU-10738 mdd: LBUG() from changelog_store_data_by_fid
• is related to: LU-10750 mdd_close() should check if changelogs are enabled
• is related to: LUDOC-391 document changelog audit feature
• is related to: LU-13308 update changelog_ext_nid to handle IPv6 addresses
• is related to: LU-15372 add projid to changelog
• is related to: LU-10483 Replace FMODE_READ and FMODE_WRITE in lustre_user.h with MDS_* equivalents
• is related to: LU-15373 changelog improvements tracking