lkml.org 
[lkml]   [2018]   [Nov]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[RFC PATCH ghak100 V1 2/2] audit: moar filter PATH records keyed on filesystem magic
    Date
    Like 42d5e37654e4 ("audit: filter PATH records keyed on filesystem magic")

    Any user or remote filesystem could become unavailable and effectively
    block on a forced unmount.

    -a always,exit -S umount2 -F key=umount2

    Provide a method to ignore these user and remote filesystems to prevent
    them from being impossible to unmount.

    Extend the "AUDIT_FILTER_FS" filter that uses the field type
    AUDIT_FSTYPE keying off the filesystem 4-octet hexadecimal magic
    identifier to filter specific filesystems to cover audit_inode() to address
    this blockage.

    An example rule would look like:
    -a never,filesystem -F fstype=0x517B -F key=ignore_smb
    -a never,filesystem -F fstype=0x6969 -F key=ignore_nfs

    Arguably the better way to address this issue is to disable auditing
    processes that touch removable filesystems.

    Please see the github issue tracker
    https://github.com/linux-audit/audit-kernel/issues/100

    Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
    ---
    kernel/auditsc.c | 23 +++++++++++++++++++++++
    1 file changed, 23 insertions(+)

    diff --git a/kernel/auditsc.c b/kernel/auditsc.c
    index d39a7fbaf944..59d6d3fbc00e 100644
    --- a/kernel/auditsc.c
    +++ b/kernel/auditsc.c
    @@ -1777,10 +1777,33 @@ void __audit_inode(struct filename *name, const struct dentry *dentry,
    struct inode *inode = d_backing_inode(dentry);
    struct audit_names *n;
    bool parent = flags & AUDIT_INODE_PARENT;
    + struct audit_entry *e;
    + struct list_head *list = &audit_filter_list[AUDIT_FILTER_FS];
    + int i;

    if (!context->in_syscall)
    return;

    + rcu_read_lock();
    + if (!list_empty(list)) {
    + list_for_each_entry_rcu(e, list, list) {
    + for (i = 0; i < e->rule.field_count; i++) {
    + struct audit_field *f = &e->rule.fields[i];
    +
    + if (f->type == AUDIT_FSTYPE) {
    + if (audit_comparator(inode->i_sb->s_magic,
    + f->op, f->val)) {
    + if (e->rule.action == AUDIT_NEVER) {
    + rcu_read_unlock();
    + return;
    + }
    + }
    + }
    + }
    + }
    + }
    + rcu_read_unlock();
    +
    if (!name)
    goto out_alloc;

    --
    1.8.3.1
    \
     
     \ /
      Last update: 2018-11-16 18:34    [W:4.070 / U:0.136 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site