lkml.org 
[lkml]   [2018]   [Jun]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[RFC PATCH ghak90 (was ghak32) V3 06/10] audit: add containerid filtering
    Date
    Implement audit container identifier filtering using the AUDIT_CONTID
    field name to send an 8-character string representing a u64 since the
    value field is only u32.

    Sending it as two u32 was considered, but gathering and comparing two
    fields was more complex.

    The feature indicator is AUDIT_FEATURE_BITMAP_CONTAINERID_FILTER.

    See: https://github.com/linux-audit/audit-kernel/issues/91
    See: https://github.com/linux-audit/audit-userspace/issues/40
    See: https://github.com/linux-audit/audit-testsuite/issues/64
    See: https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID
    Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
    ---
    include/linux/audit.h | 1 +
    include/uapi/linux/audit.h | 5 ++++-
    kernel/audit.h | 1 +
    kernel/auditfilter.c | 47 ++++++++++++++++++++++++++++++++++++++++++++++
    kernel/auditsc.c | 3 +++
    5 files changed, 56 insertions(+), 1 deletion(-)

    diff --git a/include/linux/audit.h b/include/linux/audit.h
    index f549121..1e37abf 100644
    --- a/include/linux/audit.h
    +++ b/include/linux/audit.h
    @@ -76,6 +76,7 @@ struct audit_field {
    u32 type;
    union {
    u32 val;
    + u64 val64;
    kuid_t uid;
    kgid_t gid;
    struct {
    diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
    index 469ab25..b440558 100644
    --- a/include/uapi/linux/audit.h
    +++ b/include/uapi/linux/audit.h
    @@ -262,6 +262,7 @@
    #define AUDIT_LOGINUID_SET 24
    #define AUDIT_SESSIONID 25 /* Session ID */
    #define AUDIT_FSTYPE 26 /* FileSystem Type */
    +#define AUDIT_CONTID 27 /* Container ID */

    /* These are ONLY useful when checking
    * at syscall exit time (AUDIT_AT_EXIT). */
    @@ -342,6 +343,7 @@ enum {
    #define AUDIT_FEATURE_BITMAP_SESSIONID_FILTER 0x00000010
    #define AUDIT_FEATURE_BITMAP_LOST_RESET 0x00000020
    #define AUDIT_FEATURE_BITMAP_FILTER_FS 0x00000040
    +#define AUDIT_FEATURE_BITMAP_CONTAINERID_FILTER 0x00000080

    #define AUDIT_FEATURE_BITMAP_ALL (AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT | \
    AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME | \
    @@ -349,7 +351,8 @@ enum {
    AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND | \
    AUDIT_FEATURE_BITMAP_SESSIONID_FILTER | \
    AUDIT_FEATURE_BITMAP_LOST_RESET | \
    - AUDIT_FEATURE_BITMAP_FILTER_FS)
    + AUDIT_FEATURE_BITMAP_FILTER_FS | \
    + AUDIT_FEATURE_BITMAP_CONTAINERID_FILTER)

    /* deprecated: AUDIT_VERSION_* */
    #define AUDIT_VERSION_LATEST AUDIT_FEATURE_BITMAP_ALL
    diff --git a/kernel/audit.h b/kernel/audit.h
    index 1cf1c35..743d445 100644
    --- a/kernel/audit.h
    +++ b/kernel/audit.h
    @@ -235,6 +235,7 @@ static inline int audit_hash_ino(u32 ino)

    extern int audit_match_class(int class, unsigned syscall);
    extern int audit_comparator(const u32 left, const u32 op, const u32 right);
    +extern int audit_comparator64(const u64 left, const u32 op, const u64 right);
    extern int audit_uid_comparator(kuid_t left, u32 op, kuid_t right);
    extern int audit_gid_comparator(kgid_t left, u32 op, kgid_t right);
    extern int parent_len(const char *path);
    diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
    index eaa3201..a5f60ce 100644
    --- a/kernel/auditfilter.c
    +++ b/kernel/auditfilter.c
    @@ -410,6 +410,7 @@ static int audit_field_valid(struct audit_entry *entry, struct audit_field *f)
    /* FALL THROUGH */
    case AUDIT_ARCH:
    case AUDIT_FSTYPE:
    + case AUDIT_CONTID:
    if (f->op != Audit_not_equal && f->op != Audit_equal)
    return -EINVAL;
    break;
    @@ -584,6 +585,14 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
    }
    entry->rule.exe = audit_mark;
    break;
    + case AUDIT_CONTID:
    + if (f->val != sizeof(u64))
    + goto exit_free;
    + str = audit_unpack_string(&bufp, &remain, f->val);
    + if (IS_ERR(str))
    + goto exit_free;
    + f->val64 = ((u64 *)str)[0];
    + break;
    }
    }

    @@ -666,6 +675,11 @@ static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule)
    data->buflen += data->values[i] =
    audit_pack_string(&bufp, audit_mark_path(krule->exe));
    break;
    + case AUDIT_CONTID:
    + data->buflen += data->values[i] = sizeof(u64);
    + for (i = 0; i < sizeof(u64); i++)
    + ((char *)bufp)[i] = ((char *)&f->val64)[i];
    + break;
    case AUDIT_LOGINUID_SET:
    if (krule->pflags & AUDIT_LOGINUID_LEGACY && !f->val) {
    data->fields[i] = AUDIT_LOGINUID;
    @@ -752,6 +766,10 @@ static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b)
    if (!gid_eq(a->fields[i].gid, b->fields[i].gid))
    return 1;
    break;
    + case AUDIT_CONTID:
    + if (a->fields[i].val64 != b->fields[i].val64)
    + return 1;
    + break;
    default:
    if (a->fields[i].val != b->fields[i].val)
    return 1;
    @@ -1208,6 +1226,31 @@ int audit_comparator(u32 left, u32 op, u32 right)
    }
    }

    +int audit_comparator64(u64 left, u32 op, u64 right)
    +{
    + switch (op) {
    + case Audit_equal:
    + return (left == right);
    + case Audit_not_equal:
    + return (left != right);
    + case Audit_lt:
    + return (left < right);
    + case Audit_le:
    + return (left <= right);
    + case Audit_gt:
    + return (left > right);
    + case Audit_ge:
    + return (left >= right);
    + case Audit_bitmask:
    + return (left & right);
    + case Audit_bittest:
    + return ((left & right) == right);
    + default:
    + BUG();
    + return 0;
    + }
    +}
    +
    int audit_uid_comparator(kuid_t left, u32 op, kuid_t right)
    {
    switch (op) {
    @@ -1346,6 +1389,10 @@ int audit_filter(int msgtype, unsigned int listtype)
    result = audit_comparator(audit_loginuid_set(current),
    f->op, f->val);
    break;
    + case AUDIT_CONTID:
    + result = audit_comparator64(audit_get_contid(current),
    + f->op, f->val64);
    + break;
    case AUDIT_MSGTYPE:
    result = audit_comparator(msgtype, f->op, f->val);
    break;
    diff --git a/kernel/auditsc.c b/kernel/auditsc.c
    index 81c9765..ea1ee35 100644
    --- a/kernel/auditsc.c
    +++ b/kernel/auditsc.c
    @@ -622,6 +622,9 @@ static int audit_filter_rules(struct task_struct *tsk,
    case AUDIT_LOGINUID_SET:
    result = audit_comparator(audit_loginuid_set(tsk), f->op, f->val);
    break;
    + case AUDIT_CONTID:
    + result = audit_comparator64(audit_get_contid(tsk), f->op, f->val64);
    + break;
    case AUDIT_SUBJ_USER:
    case AUDIT_SUBJ_ROLE:
    case AUDIT_SUBJ_TYPE:
    --
    1.8.3.1
    \
     
     \ /
      Last update: 2018-06-06 19:04    [W:4.109 / U:0.420 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site