AM5749: Enable Linux Audit Service

Alex

Part Number: AM5749

For security reasons, I need to enable Linux's 'auditd' service. Grep'ing all the bitbake recipes, it seems the audit service is not included in the current Yocto SDK (or any previous SDK for that matter).

How do I enable auditing? What do I install? How do I install it? How do I enable it? Etc.

Primarily, I really only need to audit system logins.

Thanks!

over 4 years ago

0 Karthik Ramanan over 4 years ago

TI__Guru** 113810 points

Alex,

From a quick search, the auditd service is provided by the Yocto layer meta-selinux (http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux/tree/recipes-security/audit/audit_2.3.2.bb?h=fido)

This meta-selinux Yocto layer is not included as part of the SDK - the list of layers in the SDK can be found by looking at configuration file that is provided with the SDK.

The integration this layer will need to be done at the customer side just like the integration of any other Yocto layer.

TI does not plan to do it in the SDK or provide steps to enable this. There is a generic Yocto training that has one slide on enabling new layer that can serve as a starting point: https://training.ti.com/sites/default/files/docs/Customizing-Yocto-Based-Linux-Distribution-for-Production.pdf

Regards

Karthik

0 Alex over 4 years ago in reply to Karthik Ramanan

Expert 2430 points

So, I see that's in a "Security Enhanced" (aka SELinux) meta-layer. That will be compatible with your generic AM57x, Yocto-based SDK?

0 Karthik Ramanan over 4 years ago in reply to Alex

TI__Guru** 113810 points

Alex,

I'm aware that customers/parterns have integrated this meta-selinux has been integrated along with the Yocto based SDK.

However, we cannot comment on the steps or the effort/complexity involved to get this done since it has never been fully attempted by TI.

Regards
Karthik

Processors

Processors forum

AM5749: Enable Linux Audit Service