History

[PATCH] change lspp ipc auditing

Hi, The patch below converts IPC auditing to collect sid's and convert to context string only if it needs to output an audit record. This patch depends on the inode audit change patch already being applied. Signed-off-by: Steve Grubb <sgrubb@redhat.com>

Steve Grubb committed 20 years ago

Commit 9c7aa6a1 parent 1b50eed6 files · +47 −77Browse files

Unified · Split

6 files
  1. include/linux/security.h +0 −16
  2. include/linux/selinux.h +15 −0
  3. kernel/auditsc.c +21 −47
  4. security/dummy.c +0 −6
  5. security/selinux/exports.c +11 −0
  6. security/selinux/hooks.c +0 −8
include/linux/security.h+0−16
@@ -869,11 +869,6 @@ struct swap_info_struct; · 868 unmodified lines
869869 * @ipcp contains the kernel IPC permission structure
870870 * @flag contains the desired (requested) permission set
871871 * Return 0 if permission is granted.
872− * @ipc_getsecurity:
873− * Copy the security label associated with the ipc object into
874− * @buffer. @buffer may be NULL to request the size of the buffer
875− * required. @size indicates the size of @buffer in bytes. Return
876− * number of bytes used/required on success.
877872 *
878873 * Security hooks for individual messages held in System V IPC message queues
879874 * @msg_msg_alloc_security:
@@ -1223,7 +1218,6 @@ struct security_operations { · 343 unmodified lines
12231218 void (*task_to_inode)(struct task_struct *p, struct inode *inode);
12241219
12251220 int (*ipc_permission) (struct kern_ipc_perm * ipcp, short flag);
1226− int (*ipc_getsecurity)(struct kern_ipc_perm *ipcp, void *buffer, size_t size);
12271221
12281222 int (*msg_msg_alloc_security) (struct msg_msg * msg);
12291223 void (*msg_msg_free_security) (struct msg_msg * msg);
@@ -1887,11 +1881,6 @@ static inline int security_ipc_permission (struct kern_ipc_perm *ipcp, · 657 unmodified lines
18871881 return security_ops->ipc_permission (ipcp, flag);
18881882 }
18891883
1890−static inline int security_ipc_getsecurity(struct kern_ipc_perm *ipcp, void *buffer, size_t size)
1891−{
1892− return security_ops->ipc_getsecurity(ipcp, buffer, size);
1893−}
1894−
18951884 static inline int security_msg_msg_alloc (struct msg_msg * msg)
18961885 {
18971886 return security_ops->msg_msg_alloc_security (msg);
@@ -2532,11 +2521,6 @@ static inline int security_ipc_permission (struct kern_ipc_perm *ipcp, · 634 unmodified lines
25322521 return 0;
25332522 }
25342523
2535−static inline int security_ipc_getsecurity(struct kern_ipc_perm *ipcp, void *buffer, size_t size)
2536−{
2537− return -EOPNOTSUPP;
2538−}
2539−
25402524 static inline int security_msg_msg_alloc (struct msg_msg * msg)
25412525 {
25422526 return 0;
include/linux/selinux.h+15−0
@@ -16,6 +16,7 @@ · 15 unmodified lines
1616 struct selinux_audit_rule;
1717 struct audit_context;
1818 struct inode;
19+struct kern_ipc_perm;
1920
2021 #ifdef CONFIG_SECURITY_SELINUX
2122
@@ -98,6 +99,15 @@ int selinux_ctxid_to_string(u32 ctxid, char **ctx, u32 *ctxlen); · 76 unmodified lines
9899 */
99100 void selinux_get_inode_sid(const struct inode *inode, u32 *sid);
100101
102+/**
103+ * selinux_get_ipc_sid - get the ipc security context ID
104+ * @ipcp: ipc structure to get the sid from.
105+ * @sid: pointer to security context ID to be filled in.
106+ *
107+ * Returns nothing
108+ */
109+void selinux_get_ipc_sid(const struct kern_ipc_perm *ipcp, u32 *sid);
110+
101111 #else
102112
103113 static inline int selinux_audit_rule_init(u32 field, u32 op,
@@ -141,6 +151,11 @@ static inline void selinux_get_inode_sid(const struct inode *inode, u32 *sid) · 37 unmodified lines
141151 *sid = 0;
142152 }
143153
154+static inline void selinux_get_ipc_sid(const struct kern_ipc_perm *ipcp, u32 *sid)
155+{
156+ *sid = 0;
157+}
158+
144159 #endif /* CONFIG_SECURITY_SELINUX */
145160
146161 #endif /* _LINUX_SELINUX_H */
kernel/auditsc.c+21−47
@@ -107,7 +107,7 @@ struct audit_aux_data_ipcctl { · 106 unmodified lines
107107 uid_t uid;
108108 gid_t gid;
109109 mode_t mode;
110− char *ctx;
110+ u32 osid;
111111 };
112112
113113 struct audit_aux_data_socketcall {
@@ -432,11 +432,6 @@ static inline void audit_free_aux(struct audit_context *context) · 318 unmodified lines
432432 dput(axi->dentry);
433433 mntput(axi->mnt);
434434 }
435− if ( aux->type == AUDIT_IPC ) {
436− struct audit_aux_data_ipcctl *axi = (void *)aux;
437− if (axi->ctx)
438− kfree(axi->ctx);
439− }
440435
441436 context->aux = aux->next;
442437 kfree(aux);
@@ -584,7 +579,7 @@ static void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk · 141 unmodified lines
584579
585580 static void audit_log_exit(struct audit_context *context, struct task_struct *tsk)
586581 {
587− int i;
582+ int i, call_panic = 0;
588583 struct audit_buffer *ab;
589584 struct audit_aux_data *aux;
590585 const char *tty;
@@ -635,8 +630,20 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts · 44 unmodified lines
635630 case AUDIT_IPC: {
636631 struct audit_aux_data_ipcctl *axi = (void *)aux;
637632 audit_log_format(ab,
638− " qbytes=%lx iuid=%u igid=%u mode=%x obj=%s",
639− axi->qbytes, axi->uid, axi->gid, axi->mode, axi->ctx);
633+ " qbytes=%lx iuid=%u igid=%u mode=%x",
634+ axi->qbytes, axi->uid, axi->gid, axi->mode);
635+ if (axi->osid != 0) {
636+ char *ctx = NULL;
637+ u32 len;
638+ if (selinux_ctxid_to_string(
639+ axi->osid, &ctx, &len)) {
640+ audit_log_format(ab, " obj=%u",
641+ axi->osid);
642+ call_panic = 1;
643+ } else
644+ audit_log_format(ab, " obj=%s", ctx);
645+ kfree(ctx);
646+ }
640647 break; }
641648
642649 case AUDIT_SOCKETCALL: {
@@ -671,7 +678,6 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts · 28 unmodified lines
671678 }
672679 }
673680 for (i = 0; i < context->name_count; i++) {
674− int call_panic = 0;
675681 unsigned long ino = context->names[i].ino;
676682 unsigned long pino = context->names[i].pino;
677683
@@ -708,16 +714,16 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts · 30 unmodified lines
708714 context->names[i].osid, &ctx, &len)) {
709715 audit_log_format(ab, " obj=%u",
710716 context->names[i].osid);
711− call_panic = 1;
717+ call_panic = 2;
712718 } else
713719 audit_log_format(ab, " obj=%s", ctx);
714720 kfree(ctx);
715721 }
716722
717723 audit_log_end(ab);
718− if (call_panic)
719− audit_panic("error converting sid to string");
720724 }
725+ if (call_panic)
726+ audit_panic("error converting sid to string");
721727 }
722728
723729 /**
@@ -951,7 +957,7 @@ void audit_putname(const char *name) · 227 unmodified lines
951957 #endif
952958 }
953959
954−void audit_inode_context(int idx, const struct inode *inode)
960+static void audit_inode_context(int idx, const struct inode *inode)
955961 {
956962 struct audit_context *context = current->audit_context;
957963
@@ -1141,38 +1147,6 @@ uid_t audit_get_loginuid(struct audit_context *ctx) · 183 unmodified lines
11411147 return ctx ? ctx->loginuid : -1;
11421148 }
11431149
1144−static char *audit_ipc_context(struct kern_ipc_perm *ipcp)
1145−{
1146− struct audit_context *context = current->audit_context;
1147− char *ctx = NULL;
1148− int len = 0;
1149−
1150− if (likely(!context))
1151− return NULL;
1152−
1153− len = security_ipc_getsecurity(ipcp, NULL, 0);
1154− if (len == -EOPNOTSUPP)
1155− goto ret;
1156− if (len < 0)
1157− goto error_path;
1158−
1159− ctx = kmalloc(len, GFP_ATOMIC);
1160− if (!ctx)
1161− goto error_path;
1162−
1163− len = security_ipc_getsecurity(ipcp, ctx, len);
1164− if (len < 0)
1165− goto error_path;
1166−
1167− return ctx;
1168−
1169−error_path:
1170− kfree(ctx);
1171− audit_panic("error in audit_ipc_context");
1172−ret:
1173− return NULL;
1174−}
1175−
11761150 /**
11771151 * audit_ipc_perms - record audit data for ipc
11781152 * @qbytes: msgq bytes
@@ -1198,7 +1172,7 @@ int audit_ipc_perms(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode, str · 19 unmodified lines
11981172 ax->uid = uid;
11991173 ax->gid = gid;
12001174 ax->mode = mode;
1201− ax->ctx = audit_ipc_context(ipcp);
1175+ selinux_get_ipc_sid(ipcp, &ax->osid);
12021176
12031177 ax->d.type = AUDIT_IPC;
12041178 ax->d.next = context->aux;
security/dummy.c+0−6
@@ -563,11 +563,6 @@ static int dummy_ipc_permission (struct kern_ipc_perm *ipcp, short flag) · 562 unmodified lines
563563 return 0;
564564 }
565565
566−static int dummy_ipc_getsecurity(struct kern_ipc_perm *ipcp, void *buffer, size_t size)
567−{
568− return -EOPNOTSUPP;
569−}
570−
571566 static int dummy_msg_msg_alloc_security (struct msg_msg *msg)
572567 {
573568 return 0;
@@ -976,7 +971,6 @@ void security_fixup_ops (struct security_operations *ops) · 402 unmodified lines
976971 set_to_dummy_if_null(ops, task_reparent_to_init);
977972 set_to_dummy_if_null(ops, task_to_inode);
978973 set_to_dummy_if_null(ops, ipc_permission);
979− set_to_dummy_if_null(ops, ipc_getsecurity);
980974 set_to_dummy_if_null(ops, msg_msg_alloc_security);
981975 set_to_dummy_if_null(ops, msg_msg_free_security);
982976 set_to_dummy_if_null(ops, msg_queue_alloc_security);
security/selinux/exports.c+11−0
@@ -15,6 +15,7 @@ · 14 unmodified lines
1515 #include <linux/module.h>
1616 #include <linux/selinux.h>
1717 #include <linux/fs.h>
18+#include <linux/ipc.h>
1819
1920 #include "security.h"
2021 #include "objsec.h"
@@ -50,3 +51,13 @@ void selinux_get_inode_sid(const struct inode *inode, u32 *sid) · 29 unmodified lines
5051 *sid = 0;
5152 }
5253
54+void selinux_get_ipc_sid(const struct kern_ipc_perm *ipcp, u32 *sid)
55+{
56+ if (selinux_enabled) {
57+ struct ipc_security_struct *isec = ipcp->security;
58+ *sid = isec->sid;
59+ return;
60+ }
61+ *sid = 0;
62+}
63+
security/selinux/hooks.c+0−8
@@ -4052,13 +4052,6 @@ static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag) · 4051 unmodified lines
40524052 return ipc_has_perm(ipcp, av);
40534053 }
40544054
4055−static int selinux_ipc_getsecurity(struct kern_ipc_perm *ipcp, void *buffer, size_t size)
4056−{
4057− struct ipc_security_struct *isec = ipcp->security;
4058−
4059− return selinux_getsecurity(isec->sid, buffer, size);
4060−}
4061−
40624055 /* module stacking operations */
40634056 static int selinux_register_security (const char *name, struct security_operations *ops)
40644057 {
@@ -4321,7 +4314,6 @@ static struct security_operations selinux_ops = { · 256 unmodified lines
43214314 .task_to_inode = selinux_task_to_inode,
43224315
43234316 .ipc_permission = selinux_ipc_permission,
4324− .ipc_getsecurity = selinux_ipc_getsecurity,
43254317
43264318 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
43274319 .msg_msg_free_security = selinux_msg_msg_free_security,