Skip to content

Commit b59f532

Browse files
maipbuimaipbui
committed
modify YANG
Signed-off-by: Mai Bui <[email protected]>
1 parent c1d2bdf commit b59f532

File tree

1 file changed

+78
-86
lines changed

1 file changed

+78
-86
lines changed

‎doc/audit/security_auditing_HLD.md

+78-86
Original file line numberDiff line numberDiff line change
@@ -120,141 +120,133 @@ Examples:
120120

121121
### 3.3 Configuration design
122122
#### 3.3.1 ConfigDB schema
123-
##### 3.3.1.1 AUDIT TABLE
124-
The database to be used is Config DB. A new AUDIT table will be added to the Config DB, which is responsible for storing audit configuration settings. This table allows the system to manage security auditing by defining whether auditing is enabled and specifying the rules to be applied. The structure of the AUDIT table is as follows.
123+
##### 3.3.1.1 AUDITD TABLE
124+
The database to be used is Config DB. A new AUDITD table will be added to the Config DB, which is responsible for storing auditd configuration settings. This table allows the system to manage security auditing by defining whether auditing is enabled and specifying the rules to be applied. The structure of the AUDITD table is as follows.
125125
```
126126
; Defines audit configuration information
127-
key = AUDIT|config ; Audit configuration settings
127+
key = AUDITD ; Audit configuration settings
128128
; field = value
129-
groupid = 1*255VCHAR ; Name of the audit rule group
130-
groupvalue = enabled / disabled ; Indicates whether the entire audit rule group is enabled or disabled
129+
name = 1*255VCHAR ; Name of the audit rule group
130+
state = enabled / disabled ; Indicates whether the entire audit rule group is enabled or disabled
131131
```
132132

133133
##### 3.3.1.2 Config DB JSON Sample
134134
The predefined list of rules in Section 3.2 will be **enabled** by default, while the custom user-defined group will be **disabled** by default. Below is an example of how the audit rules could be represented in JSON format within the Config DB.
135135
```
136136
{
137-
"AUDIT": {
138-
"config": {
139-
"critical_files": "enabled",
140-
"dns_changes": "enabled",
141-
"time_changes": "enabled",
142-
"shutdown_reboot": "enabled",
143-
"cron_changes": "enabled",
144-
"modules_changes": "enabled",
145-
"auth_logs": "enabled",
146-
"bin_changes": "enabled",
147-
"user_group_management": "enabled",
148-
"file_deletion": "enabled",
149-
"log_changes": "enabled",
150-
"docker_changes": "enabled",
151-
"process_audit": "enabled",
152-
"network_activity": "enabled",
153-
"socket_activity": "enabled",
154-
"custom_audit": "disabled"
137+
"AUDITD": {
138+
"critical_files": {
139+
"state": "enabled"
140+
},
141+
"dns_changes": {
142+
"state": "enabled"
143+
},
144+
"time_changes": {
145+
"state": "enabled"
146+
},
147+
"shutdown_reboot": {
148+
"state": "enabled"
149+
},
150+
"cron_changes": {
151+
"state": "enabled"
152+
},
153+
"modules_changes": {
154+
"state": "enabled"
155+
},
156+
"auth_logs": {
157+
"state": "enabled"
158+
},
159+
"bin_changes": {
160+
"state": "enabled"
161+
},
162+
"user_group_management": {
163+
"state": "enabled"
164+
},
165+
"file_deletion": {
166+
"state": "enabled"
167+
},
168+
"log_changes": {
169+
"state": "enabled"
170+
},
171+
"docker_changes": {
172+
"state": "enabled"
173+
},
174+
"process_audit": {
175+
"state": "enabled"
176+
},
177+
"network_activity": {
178+
"state": "enabled"
179+
},
180+
"socket_activity": {
181+
"state": "enabled"
182+
},
183+
"custom_audit": {
184+
"state": "disabled"
155185
}
156186
}
157187
}
158188
```
159189

160190
##### 3.3.1.3 Redis Entries Sample
161-
Once the AUDIT table is populated in the Config DB, the corresponding entries can be viewed in Redis. Below are complete example Redis commands and outputs
191+
Once the AUDITD table is populated in the Config DB, the corresponding entries can be viewed in Redis. Below are complete example Redis commands and outputs
162192
```
163-
127.0.0.1:6379[4]> keys AUDIT|config
164-
1) "AUDIT|config"
193+
127.0.0.1:6379[4]> hgetall AUDIT|file_deletion
194+
1) "state"
195+
2) "enabled"
165196
166-
127.0.0.1:6379[4]> hgetall AUDIT|config
167-
1) "critical_files"
197+
127.0.0.1:6379[4]> hgetall AUDIT|dns_changes
198+
1) "state"
168199
2) "enabled"
169-
3) "dns_changes"
170-
4) "enabled"
171-
5) "time_changes"
172-
6) "enabled"
173-
7) "shutdown_reboot"
174-
8) "enabled"
175-
9) "cron_changes"
176-
10) "enabled"
177-
11) "modules_changes"
178-
12) "enabled"
179-
13) "auth_logs"
180-
14) "enabled"
181-
15) "bin_changes"
182-
16) "enabled"
183-
17) "user_group_management"
184-
18) "enabled"
185-
19) "file_deletion"
186-
20) "enabled"
187-
21) "log_changes"
188-
22) "enabled"
189-
23) "docker_changes"
190-
24) "enabled"
191-
25) "process_audit"
192-
26) "enabled"
193-
27) "network_activity"
194-
28) "enabled"
195-
29) "socket_activity"
196-
30) "enabled"
197-
31) "custom_audit"
198-
32) "disabled"
199200
```
200201

201202
#### 3.3.2 YANG model
202-
New YANG model `sonic-audit.yang` will be added.
203+
New YANG model `sonic-auditd.yang` will be added.
203204
```
204-
module sonic-audit {
205+
module sonic-auditd {
205206
206207
yang-version 1.1;
207208
208-
namespace "http://github.com/sonic-net/sonic-audit";
209-
210-
prefix sonic-audit;
209+
namespace "http://github.com/sonic-net/sonic-auditd";
211210
212-
import sonic-types {
213-
prefix stypes;
214-
}
211+
prefix sonic-auditd;
215212
216-
description "AUDIT YANG Module for SONiC OS";
213+
description "AUDITD YANG module for SONiC OS";
217214
218-
revision 2024-08-12 {
219-
description "First Revision";
215+
revision 2024-09-26 {
216+
description "Initial version";
220217
}
221218
222-
container sonic-audit {
219+
container sonic-auditd {
223220
224-
container AUDIT {
221+
container AUDITD {
225222
226-
description "AUDIT part of config_db";
223+
description "AUDITD part of config_db";
227224
228-
list config {
229-
key "groupid";
225+
list AUDITD_LIST {
226+
key "name";
230227
description "List of audit rules";
231228
232-
leaf groupid {
229+
leaf name {
233230
type string {
234231
length "1..255";
235232
}
236233
description "Name of the audit rule group";
237234
}
238235
239-
leaf groupvalue {
240-
type enumeration {
241-
enum "enabled" {
242-
description "Audit rule is enabled.";
243-
}
244-
enum "disabled" {
245-
description "Audit rule is disabled.";
246-
}
236+
leaf state {
237+
type string {
238+
pattern "enabled|disabled";
247239
}
248240
description "Status of the audit rule group (enabled or disabled).";
249241
}
250242
}
251-
/* end of list config */
243+
/* end of AUDITD_LIST */
252244
}
253-
/* end of container AUDIT */
245+
/* end of container AUDITD */
254246
}
255247
/* end of top level container */
256248
}
257-
/* end of module sonic-audit */
249+
/* end of module sonic-auditd */
258250
```
259251

260252
#### 3.3.3 Flows

0 commit comments

Comments
 (0)