History

Merge tag 'audit-pr-20211101' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit

Pull audit updates from Paul Moore: "Add some additional audit logging to capture the openat2() syscall open_how struct info. Previous variations of the open()/openat() syscalls allowed audit admins to inspect the syscall args to get the information contained in the new open_how struct used in openat2()" * tag 'audit-pr-20211101' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: return early if the filter rule has a lower priority audit: add OPENAT2 record to list "how" info audit: add support for the openat2 syscall audit: replace magic audit syscall class numbers with macros lsm_audit: avoid overloading the "key" audit field audit: Convert to SPDX identifier audit: rename struct node to struct audit_node to prevent future name collisions

Linus Torvalds committed 5 years ago

Commit d2fac0a2 parents cdab10b d9516f323 files · +184 −98Browse files

Showing the changes to kernel (3 of 23 files). Show all

Unified · Split

3 files
  1. kernel/audit.h +2 −0
  2. kernel/audit_tree.c +10 −10
  3. kernel/auditsc.c +29 −22
kernel/audit.h+2−0
@@ -14,6 +14,7 @@ · 13 unmodified lines
14#include <linux/skbuff.h>14#include <linux/skbuff.h>
15#include <uapi/linux/mqueue.h>15#include <uapi/linux/mqueue.h>
16#include <linux/tty.h>16#include <linux/tty.h>
17#include <uapi/linux/openat2.h> // struct open_how
17 18
18/* AUDIT_NAMES is the number of slots we reserve in the audit_context19/* AUDIT_NAMES is the number of slots we reserve in the audit_context
19 * for saving names from getname(). If we get more names we will allocate20 * for saving names from getname(). If we get more names we will allocate
@@ -193,6 +194,7 @@ struct audit_context { · 173 unmodified lines
193 int fd;194 int fd;
194 int flags;195 int flags;
195 } mmap;196 } mmap;
197 struct open_how openat2;
196 struct {198 struct {
197 int argc;199 int argc;
198 } execve;200 } execve;
kernel/audit_tree.c+10−10
@@ -30,7 +30,7 @@ struct audit_chunk { · 29 unmodified lines
30 int count;30 int count;
31 atomic_long_t refs;31 atomic_long_t refs;
32 struct rcu_head head;32 struct rcu_head head;
33 struct node {33 struct audit_node {
34 struct list_head list;34 struct list_head list;
35 struct audit_tree *owner;35 struct audit_tree *owner;
36 unsigned index; /* index; upper bit indicates 'will prune' */36 unsigned index; /* index; upper bit indicates 'will prune' */
@@ -269,7 +269,7 @@ bool audit_tree_match(struct audit_chunk *chunk, struct audit_tree *tree) · 232 unmodified lines
269 269
270/* tagging and untagging inodes with trees */270/* tagging and untagging inodes with trees */
271 271
272static struct audit_chunk *find_chunk(struct node *p)272static struct audit_chunk *find_chunk(struct audit_node *p)
273{273{
274 int index = p->index & ~(1U<<31);274 int index = p->index & ~(1U<<31);
275 p -= index;275 p -= index;
@@ -322,7 +322,7 @@ static void replace_chunk(struct audit_chunk *new, struct audit_chunk *old) · 46 unmodified lines
322 list_replace_rcu(&old->hash, &new->hash);322 list_replace_rcu(&old->hash, &new->hash);
323}323}
324 324
325static void remove_chunk_node(struct audit_chunk *chunk, struct node *p)325static void remove_chunk_node(struct audit_chunk *chunk, struct audit_node *p)
326{326{
327 struct audit_tree *owner = p->owner;327 struct audit_tree *owner = p->owner;
328 328
@@ -459,7 +459,7 @@ static int tag_chunk(struct inode *inode, struct audit_tree *tree) · 130 unmodified lines
459{459{
460 struct fsnotify_mark *mark;460 struct fsnotify_mark *mark;
461 struct audit_chunk *chunk, *old;461 struct audit_chunk *chunk, *old;
462 struct node *p;462 struct audit_node *p;
463 int n;463 int n;
464 464
465 mutex_lock(&audit_tree_group->mark_mutex);465 mutex_lock(&audit_tree_group->mark_mutex);
@@ -570,11 +570,11 @@ static void prune_tree_chunks(struct audit_tree *victim, bool tagged) · 104 unmodified lines
570{570{
571 spin_lock(&hash_lock);571 spin_lock(&hash_lock);
572 while (!list_empty(&victim->chunks)) {572 while (!list_empty(&victim->chunks)) {
573 struct node *p;573 struct audit_node *p;
574 struct audit_chunk *chunk;574 struct audit_chunk *chunk;
575 struct fsnotify_mark *mark;575 struct fsnotify_mark *mark;
576 576
577 p = list_first_entry(&victim->chunks, struct node, list);577 p = list_first_entry(&victim->chunks, struct audit_node, list);
578 /* have we run out of marked? */578 /* have we run out of marked? */
579 if (tagged && !(p->index & (1U<<31)))579 if (tagged && !(p->index & (1U<<31)))
580 break;580 break;
@@ -616,7 +616,7 @@ static void trim_marked(struct audit_tree *tree) · 35 unmodified lines
616 }616 }
617 /* reorder */617 /* reorder */
618 for (p = tree->chunks.next; p != &tree->chunks; p = q) {618 for (p = tree->chunks.next; p != &tree->chunks; p = q) {
619 struct node *node = list_entry(p, struct node, list);619 struct audit_node *node = list_entry(p, struct audit_node, list);
620 q = p->next;620 q = p->next;
621 if (node->index & (1U<<31)) {621 if (node->index & (1U<<31)) {
622 list_del_init(p);622 list_del_init(p);
@@ -684,7 +684,7 @@ void audit_trim_trees(void) · 61 unmodified lines
684 struct audit_tree *tree;684 struct audit_tree *tree;
685 struct path path;685 struct path path;
686 struct vfsmount *root_mnt;686 struct vfsmount *root_mnt;
687 struct node *node;687 struct audit_node *node;
688 int err;688 int err;
689 689
690 tree = container_of(cursor.next, struct audit_tree, list);690 tree = container_of(cursor.next, struct audit_tree, list);
@@ -840,7 +840,7 @@ int audit_add_tree_rule(struct audit_krule *rule) · 149 unmodified lines
840 drop_collected_mounts(mnt);840 drop_collected_mounts(mnt);
841 841
842 if (!err) {842 if (!err) {
843 struct node *node;843 struct audit_node *node;
844 spin_lock(&hash_lock);844 spin_lock(&hash_lock);
845 list_for_each_entry(node, &tree->chunks, list)845 list_for_each_entry(node, &tree->chunks, list)
846 node->index &= ~(1U<<31);846 node->index &= ~(1U<<31);
@@ -939,7 +939,7 @@ int audit_tag_tree(char *old, char *new) · 92 unmodified lines
939 mutex_unlock(&audit_filter_mutex);939 mutex_unlock(&audit_filter_mutex);
940 940
941 if (!failed) {941 if (!failed) {
942 struct node *node;942 struct audit_node *node;
943 spin_lock(&hash_lock);943 spin_lock(&hash_lock);
944 list_for_each_entry(node, &tree->chunks, list)944 list_for_each_entry(node, &tree->chunks, list)
945 node->index &= ~(1U<<31);945 node->index &= ~(1U<<31);
kernel/auditsc.c+29−22
@@ -1,3 +1,4 @@
1// SPDX-License-Identifier: GPL-2.0-or-later
1/* auditsc.c -- System-call auditing support2/* auditsc.c -- System-call auditing support
2 * Handles all system-call specific auditing features.3 * Handles all system-call specific auditing features.
3 *4 *
@@ -6,20 +7,6 @@ · 2 unmodified lines
6 * Copyright (C) 2005, 2006 IBM Corporation7 * Copyright (C) 2005, 2006 IBM Corporation
7 * All Rights Reserved.8 * All Rights Reserved.
8 *9 *
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 2 of the License, or
12 * (at your option) any later version.
13 *
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
18 *
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, write to the Free Software
21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22 *
23 * Written by Rickard E. (Rik) Faith <faith@redhat.com>10 * Written by Rickard E. (Rik) Faith <faith@redhat.com>
24 *11 *
25 * Many of the ideas implemented here are from Stephen C. Tweedie,12 * Many of the ideas implemented here are from Stephen C. Tweedie,
@@ -76,6 +63,7 @@ · 50 unmodified lines
76#include <linux/fsnotify_backend.h>63#include <linux/fsnotify_backend.h>
77#include <uapi/linux/limits.h>64#include <uapi/linux/limits.h>
78#include <uapi/linux/netfilter/nf_tables.h>65#include <uapi/linux/netfilter/nf_tables.h>
66#include <uapi/linux/openat2.h> // struct open_how
79 67
80#include "audit.h"68#include "audit.h"
81 69
@@ -166,7 +154,7 @@ static int audit_match_perm(struct audit_context *ctx, int mask) · 84 unmodified lines
166 n = ctx->major;154 n = ctx->major;
167 155
168 switch (audit_classify_syscall(ctx->arch, n)) {156 switch (audit_classify_syscall(ctx->arch, n)) {
169 case 0: /* native */157 case AUDITSC_NATIVE:
170 if ((mask & AUDIT_PERM_WRITE) &&158 if ((mask & AUDIT_PERM_WRITE) &&
171 audit_match_class(AUDIT_CLASS_WRITE, n))159 audit_match_class(AUDIT_CLASS_WRITE, n))
172 return 1;160 return 1;
@@ -177,7 +165,7 @@ static int audit_match_perm(struct audit_context *ctx, int mask) · 4 unmodified lines
177 audit_match_class(AUDIT_CLASS_CHATTR, n))165 audit_match_class(AUDIT_CLASS_CHATTR, n))
178 return 1;166 return 1;
179 return 0;167 return 0;
180 case 1: /* 32bit on biarch */168 case AUDITSC_COMPAT: /* 32bit on biarch */
181 if ((mask & AUDIT_PERM_WRITE) &&169 if ((mask & AUDIT_PERM_WRITE) &&
182 audit_match_class(AUDIT_CLASS_WRITE_32, n))170 audit_match_class(AUDIT_CLASS_WRITE_32, n))
183 return 1;171 return 1;
@@ -188,14 +176,16 @@ static int audit_match_perm(struct audit_context *ctx, int mask) · 4 unmodified lines
188 audit_match_class(AUDIT_CLASS_CHATTR_32, n))176 audit_match_class(AUDIT_CLASS_CHATTR_32, n))
189 return 1;177 return 1;
190 return 0;178 return 0;
191 case 2: /* open */179 case AUDITSC_OPEN:
192 return mask & ACC_MODE(ctx->argv[1]);180 return mask & ACC_MODE(ctx->argv[1]);
193 case 3: /* openat */181 case AUDITSC_OPENAT:
194 return mask & ACC_MODE(ctx->argv[2]);182 return mask & ACC_MODE(ctx->argv[2]);
195 case 4: /* socketcall */183 case AUDITSC_SOCKETCALL:
196 return ((mask & AUDIT_PERM_WRITE) && ctx->argv[0] == SYS_BIND);184 return ((mask & AUDIT_PERM_WRITE) && ctx->argv[0] == SYS_BIND);
197 case 5: /* execve */185 case AUDITSC_EXECVE:
198 return mask & AUDIT_PERM_EXEC;186 return mask & AUDIT_PERM_EXEC;
187 case AUDITSC_OPENAT2:
188 return mask & ACC_MODE((u32)((struct open_how *)ctx->argv[2])->flags);
199 default:189 default:
200 return 0;190 return 0;
201 }191 }
@@ -480,6 +470,9 @@ static int audit_filter_rules(struct task_struct *tsk, · 278 unmodified lines
480 u32 sid;470 u32 sid;
481 unsigned int sessionid;471 unsigned int sessionid;
482 472
473 if (ctx && rule->prio <= ctx->prio)
474 return 0;
475
483 cred = rcu_dereference_check(tsk->cred, tsk == current || task_creation);476 cred = rcu_dereference_check(tsk->cred, tsk == current || task_creation);
484 477
485 for (i = 0; i < rule->field_count; i++) {478 for (i = 0; i < rule->field_count; i++) {
@@ -747,8 +740,6 @@ static int audit_filter_rules(struct task_struct *tsk, · 261 unmodified lines
747 }740 }
748 741
749 if (ctx) {742 if (ctx) {
750 if (rule->prio <= ctx->prio)
751 return 0;
752 if (rule->filterkey) {743 if (rule->filterkey) {
753 kfree(ctx->filterkey);744 kfree(ctx->filterkey);
754 ctx->filterkey = kstrdup(rule->filterkey, GFP_ATOMIC);745 ctx->filterkey = kstrdup(rule->filterkey, GFP_ATOMIC);
@@ -1437,6 +1428,12 @@ static void show_special(struct audit_context *context, int *call_panic) · 682 unmodified lines
1437 audit_log_format(ab, "fd=%d flags=0x%x", context->mmap.fd,1428 audit_log_format(ab, "fd=%d flags=0x%x", context->mmap.fd,
1438 context->mmap.flags);1429 context->mmap.flags);
1439 break;1430 break;
1431 case AUDIT_OPENAT2:
1432 audit_log_format(ab, "oflag=0%llo mode=0%llo resolve=0x%llx",
1433 context->openat2.flags,
1434 context->openat2.mode,
1435 context->openat2.resolve);
1436 break;
1440 case AUDIT_EXECVE:1437 case AUDIT_EXECVE:
1441 audit_log_execve_info(context, &ab);1438 audit_log_execve_info(context, &ab);
1442 break;1439 break;
@@ -2815,6 +2812,16 @@ void __audit_mmap_fd(int fd, int flags) · 1372 unmodified lines
2815 context->type = AUDIT_MMAP;2812 context->type = AUDIT_MMAP;
2816}2813}
2817 2814
2815void __audit_openat2_how(struct open_how *how)
2816{
2817 struct audit_context *context = audit_context();
2818
2819 context->openat2.flags = how->flags;
2820 context->openat2.mode = how->mode;
2821 context->openat2.resolve = how->resolve;
2822 context->type = AUDIT_OPENAT2;
2823}
2824
2818void __audit_log_kern_module(char *name)2825void __audit_log_kern_module(char *name)
2819{2826{
2820 struct audit_context *context = audit_context();2827 struct audit_context *context = audit_context();

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t