Hi, The patch below converts IPC auditing to collect sid's and convert to context string only if it needs to output an audit record. This patch depends on the inode audit change patch already being applied. Signed-off-by: Steve Grubb <sgrubb@redhat.com>
Showing the changes to kernel (1 of 6 files). Show all
Unified · Split
| @@ -107,7 +107,7 @@ struct audit_aux_data_ipcctl { · 106 unmodified lines | ||
| 107 | 107 | uid_t uid; |
| 108 | 108 | gid_t gid; |
| 109 | 109 | mode_t mode; |
| 110 | − char *ctx; | |
| 110 | + u32 osid; | |
| 111 | 111 | }; |
| 112 | 112 | |
| 113 | 113 | struct audit_aux_data_socketcall { |
| @@ -432,11 +432,6 @@ static inline void audit_free_aux(struct audit_context *context) · 318 unmodified lines | ||
| 432 | 432 | dput(axi->dentry); |
| 433 | 433 | mntput(axi->mnt); |
| 434 | 434 | } |
| 435 | − if ( aux->type == AUDIT_IPC ) { | |
| 436 | − struct audit_aux_data_ipcctl *axi = (void *)aux; | |
| 437 | − if (axi->ctx) | |
| 438 | − kfree(axi->ctx); | |
| 439 | − } | |
| 440 | 435 | |
| 441 | 436 | context->aux = aux->next; |
| 442 | 437 | kfree(aux); |
| @@ -584,7 +579,7 @@ static void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk · 141 unmodified lines | ||
| 584 | 579 | |
| 585 | 580 | static void audit_log_exit(struct audit_context *context, struct task_struct *tsk) |
| 586 | 581 | { |
| 587 | − int i; | |
| 582 | + int i, call_panic = 0; | |
| 588 | 583 | struct audit_buffer *ab; |
| 589 | 584 | struct audit_aux_data *aux; |
| 590 | 585 | const char *tty; |
| @@ -635,8 +630,20 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts · 44 unmodified lines | ||
| 635 | 630 | case AUDIT_IPC: { |
| 636 | 631 | struct audit_aux_data_ipcctl *axi = (void *)aux; |
| 637 | 632 | audit_log_format(ab, |
| 638 | − " qbytes=%lx iuid=%u igid=%u mode=%x obj=%s", | |
| 639 | − axi->qbytes, axi->uid, axi->gid, axi->mode, axi->ctx); | |
| 633 | + " qbytes=%lx iuid=%u igid=%u mode=%x", | |
| 634 | + axi->qbytes, axi->uid, axi->gid, axi->mode); | |
| 635 | + if (axi->osid != 0) { | |
| 636 | + char *ctx = NULL; | |
| 637 | + u32 len; | |
| 638 | + if (selinux_ctxid_to_string( | |
| 639 | + axi->osid, &ctx, &len)) { | |
| 640 | + audit_log_format(ab, " obj=%u", | |
| 641 | + axi->osid); | |
| 642 | + call_panic = 1; | |
| 643 | + } else | |
| 644 | + audit_log_format(ab, " obj=%s", ctx); | |
| 645 | + kfree(ctx); | |
| 646 | + } | |
| 640 | 647 | break; } |
| 641 | 648 | |
| 642 | 649 | case AUDIT_SOCKETCALL: { |
| @@ -671,7 +678,6 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts · 28 unmodified lines | ||
| 671 | 678 | } |
| 672 | 679 | } |
| 673 | 680 | for (i = 0; i < context->name_count; i++) { |
| 674 | − int call_panic = 0; | |
| 675 | 681 | unsigned long ino = context->names[i].ino; |
| 676 | 682 | unsigned long pino = context->names[i].pino; |
| 677 | 683 | |
| @@ -708,16 +714,16 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts · 30 unmodified lines | ||
| 708 | 714 | context->names[i].osid, &ctx, &len)) { |
| 709 | 715 | audit_log_format(ab, " obj=%u", |
| 710 | 716 | context->names[i].osid); |
| 711 | − call_panic = 1; | |
| 717 | + call_panic = 2; | |
| 712 | 718 | } else |
| 713 | 719 | audit_log_format(ab, " obj=%s", ctx); |
| 714 | 720 | kfree(ctx); |
| 715 | 721 | } |
| 716 | 722 | |
| 717 | 723 | audit_log_end(ab); |
| 718 | − if (call_panic) | |
| 719 | − audit_panic("error converting sid to string"); | |
| 720 | 724 | } |
| 725 | + if (call_panic) | |
| 726 | + audit_panic("error converting sid to string"); | |
| 721 | 727 | } |
| 722 | 728 | |
| 723 | 729 | /** |
| @@ -951,7 +957,7 @@ void audit_putname(const char *name) · 227 unmodified lines | ||
| 951 | 957 | #endif |
| 952 | 958 | } |
| 953 | 959 | |
| 954 | −void audit_inode_context(int idx, const struct inode *inode) | |
| 960 | +static void audit_inode_context(int idx, const struct inode *inode) | |
| 955 | 961 | { |
| 956 | 962 | struct audit_context *context = current->audit_context; |
| 957 | 963 | |
| @@ -1141,38 +1147,6 @@ uid_t audit_get_loginuid(struct audit_context *ctx) · 183 unmodified lines | ||
| 1141 | 1147 | return ctx ? ctx->loginuid : -1; |
| 1142 | 1148 | } |
| 1143 | 1149 | |
| 1144 | −static char *audit_ipc_context(struct kern_ipc_perm *ipcp) | |
| 1145 | −{ | |
| 1146 | − struct audit_context *context = current->audit_context; | |
| 1147 | − char *ctx = NULL; | |
| 1148 | − int len = 0; | |
| 1149 | − | |
| 1150 | − if (likely(!context)) | |
| 1151 | − return NULL; | |
| 1152 | − | |
| 1153 | − len = security_ipc_getsecurity(ipcp, NULL, 0); | |
| 1154 | − if (len == -EOPNOTSUPP) | |
| 1155 | − goto ret; | |
| 1156 | − if (len < 0) | |
| 1157 | − goto error_path; | |
| 1158 | − | |
| 1159 | − ctx = kmalloc(len, GFP_ATOMIC); | |
| 1160 | − if (!ctx) | |
| 1161 | − goto error_path; | |
| 1162 | − | |
| 1163 | − len = security_ipc_getsecurity(ipcp, ctx, len); | |
| 1164 | − if (len < 0) | |
| 1165 | − goto error_path; | |
| 1166 | − | |
| 1167 | − return ctx; | |
| 1168 | − | |
| 1169 | −error_path: | |
| 1170 | − kfree(ctx); | |
| 1171 | − audit_panic("error in audit_ipc_context"); | |
| 1172 | −ret: | |
| 1173 | − return NULL; | |
| 1174 | −} | |
| 1175 | − | |
| 1176 | 1150 | /** |
| 1177 | 1151 | * audit_ipc_perms - record audit data for ipc |
| 1178 | 1152 | * @qbytes: msgq bytes |
| @@ -1198,7 +1172,7 @@ int audit_ipc_perms(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode, str · 19 unmodified lines | ||
| 1198 | 1172 | ax->uid = uid; |
| 1199 | 1173 | ax->gid = gid; |
| 1200 | 1174 | ax->mode = mode; |
| 1201 | − ax->ctx = audit_ipc_context(ipcp); | |
| 1175 | + selinux_get_ipc_sid(ipcp, &ax->osid); | |
| 1202 | 1176 | |
| 1203 | 1177 | ax->d.type = AUDIT_IPC; |
| 1204 | 1178 | ax->d.next = context->aux; |