lkml.org 
[lkml]   [2018]   [Nov]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [PATCH ghak59 V2 1/6] audit: give a clue what CONFIG_CHANGE op was involved
    On Fri, Jul 27, 2018 at 3:51 PM Richard Guy Briggs <rgb@redhat.com> wrote:
    > The failure to add an audit rule due to audit locked gives no clue
    > what CONFIG_CHANGE operation failed.
    > Similarly the set operation is the only other operation that doesn't
    > give the "op=" field to indicate the action.
    > All other CONFIG_CHANGE records include an op= field to give a clue as
    > to what sort of configuration change is being executed.
    >
    > Since these are the only CONFIG_CHANGE records that that do not have an
    > op= field, add them to bring them in line with the rest.
    >
    > Old records:
    > type=CONFIG_CHANGE msg=audit(1519812997.781:374): pid=610 uid=0 auid=0 ses=1 subj=... audit_enabled=2 res=0
    > type=CONFIG_CHANGE msg=audit(2018-06-14 14:55:04.507:47) : audit_enabled=1 old=1 auid=unset ses=unset subj=... res=yes
    >
    > New records:
    > type=CONFIG_CHANGE msg=audit(1520958477.855:100): pid=610 uid=0 auid=0 ses=1 subj=... op=add_rule audit_enabled=2 res=0
    >
    > type=CONFIG_CHANGE msg=audit(2018-06-14 14:55:04.507:47) : op=set audit_enabled=1 old=1 auid=unset ses=unset subj=... res=yes
    >
    > See: https://github.com/linux-audit/audit-kernel/issues/59
    > Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
    > ---
    > kernel/audit.c | 6 ++++--
    > 1 file changed, 4 insertions(+), 2 deletions(-)
    >
    > diff --git a/kernel/audit.c b/kernel/audit.c
    > index 2a80587..1ed8723 100644
    > --- a/kernel/audit.c
    > +++ b/kernel/audit.c
    > @@ -400,7 +400,7 @@ static int audit_log_config_change(char *function_name, u32 new, u32 old,
    > ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
    > if (unlikely(!ab))
    > return rc;
    > - audit_log_format(ab, "%s=%u old=%u", function_name, new, old);
    > + audit_log_format(ab, "op=set %s=%u old=%u", function_name, new, old);
    > audit_log_session_info(ab);
    > rc = audit_log_task_context(ab);
    > if (rc)
    > @@ -1362,7 +1362,9 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
    > return -EINVAL;
    > if (audit_enabled == AUDIT_LOCKED) {
    > audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE);
    > - audit_log_format(ab, " audit_enabled=%d res=0", audit_enabled);
    > + audit_log_format(ab, " op=%s_rule audit_enabled=%d res=0",
    > + msg_type == AUDIT_ADD_RULE ? "add" : "remove",

    Let's not be clever here, this just makes it harder to grep for
    "op=add_rule"; make the ternary statement return "add_rule" or
    "remove_rule".

    > + audit_enabled);
    > audit_log_end(ab);
    > return -EPERM;
    > }

    --
    paul moore
    www.paul-moore.com

    \
     
     \ /
      Last update: 2018-11-19 19:07    [W:4.866 / U:0.064 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site