To atime or relatime?

Joe Nall joe at nall.com
Thu Jun 14 10:27:32 UTC 2012


On Jun 13, 2012, at 11:53 PM, Shawn Wells wrote:

> I received this note from a colleague today regarding content in the scap-security-guide for RHEL6:
> 
>> Ext4 mounts devices with the relatime option by default.  Probably not a good idea for secure environments.  Means atime is not accurate.  Very bad for systems using AIDE.  RHEL 6 security guide needs to turn atime back on for Ext4 mounts.  
>> 
>> cat /proc/mounts
>> 
>> Sent from iPhone.  
>> 
> 
> When he states that "atime is not accurate" I believe he's referring to how relatime maintains atime data, but not for each time the file was accessed. Only modified. 
> 
> From a performance perspective relatime makes a lot of sense. Enablement of relatime means that the filesystem will not write read-times to a file when read. Imagine recording every time a file in hadoop or a highly utilized fileshare was read... that could be a lot of overhead which relatime prevents.
> 
> With that said, we're writing a security guide and not a performance guide. What does everyone think about this, and what should we do? One option is to set "default_relatime=0" in grub to prevent any filesystem from doing this. Is that overkill?

Overkill

Audit rules record when something you care about has been accessed.

joe


More information about the scap-security-guide mailing list