This patch adds basic auditing to io_uring operations, regardless of their context. This is accomplished by allocating audit_context structures for the io-wq worker and io_uring SQPOLL kernel threads as well as explicitly auditing the io_uring operations in io_issue_sqe(). Individual io_uring operations can bypass auditing through the "audit_skip" field in the struct io_op_def definition for the operation; although great care must be taken so that security relevant io_uring operations do not bypass auditing; please contact the audit mailing list (see the MAINTAINERS file) with any questions. The io_uring operations are audited using a new AUDIT_URINGOP record, an example is shown below: type=UNKNOWN[1336] msg=audit(1631800225.981:37289): uring_op=19 success=yes exit=0 items=0 ppid=15454 pid=15681 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) Thanks to Richard Guy Briggs for review and feedback.
Showing the changes to include/uapi (1 of 6 files). Show all
Unified · Split
| @@ -118,6 +118,7 @@ · 117 unmodified lines | |||
| 118 | #define AUDIT_TIME_ADJNTPVAL 1333 /* NTP value adjustment */ | 118 | #define AUDIT_TIME_ADJNTPVAL 1333 /* NTP value adjustment */ |
| 119 | #define AUDIT_BPF 1334 /* BPF subsystem */ | 119 | #define AUDIT_BPF 1334 /* BPF subsystem */ |
| 120 | #define AUDIT_EVENT_LISTENER 1335 /* Task joined multicast read socket */ | 120 | #define AUDIT_EVENT_LISTENER 1335 /* Task joined multicast read socket */ |
| 121 | #define AUDIT_URINGOP 1336 /* io_uring operation */ | ||
| 121 | 122 | ||
| 122 | #define AUDIT_AVC 1400 /* SE Linux avc denial or grant */ | 123 | #define AUDIT_AVC 1400 /* SE Linux avc denial or grant */ |
| 123 | #define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */ | 124 | #define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */ |