Messages in this thread | | | Date | Tue, 15 Mar 2022 17:23:19 -0700 | Subject | Re: [PATCH v33 27/29] Audit: Add record for multiple object security contexts | From | Casey Schaufler <> |
| |
On 3/15/2022 4:47 PM, Paul Moore wrote: > On Thu, Mar 10, 2022 at 7:01 PM Casey Schaufler <casey@schaufler-ca.com> wrote: >> Create a new audit record AUDIT_MAC_OBJ_CONTEXTS. >> An example of the MAC_OBJ_CONTEXTS (1421) record is: >> >> type=MAC_OBJ_CONTEXTS[1421] >> msg=audit(1601152467.009:1050): >> obj_selinux=unconfined_u:object_r:user_home_t:s0 >> >> When an audit event includes a AUDIT_MAC_OBJ_CONTEXTS record >> the "obj=" field in other records in the event will be "obj=?". >> An AUDIT_MAC_OBJ_CONTEXTS record is supplied when the system has >> multiple security modules that may make access decisions based >> on an object security context. >> >> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> >> --- >> include/linux/audit.h | 5 +++ >> include/uapi/linux/audit.h | 1 + >> kernel/audit.c | 47 +++++++++++++++++++++++ >> kernel/auditsc.c | 79 ++++++++++++-------------------------- >> 4 files changed, 77 insertions(+), 55 deletions(-) > ... > >> diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h >> index af0aaccfaf57..d25d76b29e3c 100644 >> --- a/include/uapi/linux/audit.h >> +++ b/include/uapi/linux/audit.h >> @@ -144,6 +144,7 @@ >> #define AUDIT_MAC_CALIPSO_ADD 1418 /* NetLabel: add CALIPSO DOI entry */ >> #define AUDIT_MAC_CALIPSO_DEL 1419 /* NetLabel: del CALIPSO DOI entry */ >> #define AUDIT_MAC_TASK_CONTEXTS 1420 /* Multiple LSM task contexts */ >> +#define AUDIT_MAC_OBJ_CONTEXTS 1421 /* Multiple LSM objext contexts */ >> >> #define AUDIT_FIRST_KERN_ANOM_MSG 1700 >> #define AUDIT_LAST_KERN_ANOM_MSG 1799 >> diff --git a/kernel/audit.c b/kernel/audit.c >> index ad825af203cf..ac92e7fc5aa6 100644 >> --- a/kernel/audit.c >> +++ b/kernel/audit.c >> @@ -2202,6 +2202,53 @@ static void audit_buffer_aux_end(struct audit_buffer *ab) >> ab->skb = skb_peek(&ab->skb_list); >> } >> >> +void audit_log_object_context(struct audit_buffer *ab, struct lsmblob *blob) >> +{ >> + int i; >> + int error; >> + struct lsmcontext context; >> + >> + if (!lsm_multiple_contexts()) { >> + error = security_secid_to_secctx(blob, &context, LSMBLOB_FIRST); >> + if (error) { >> + if (error != -EINVAL) >> + goto error_path; >> + return; >> + } >> + audit_log_format(ab, " obj=%s", context.context); >> + security_release_secctx(&context); >> + } else { >> + audit_log_format(ab, " obj=?"); >> + error = audit_buffer_aux_new(ab, AUDIT_MAC_OBJ_CONTEXTS); >> + if (error) >> + goto error_path; >> + >> + for (i = 0; i < LSMBLOB_ENTRIES; i++) { >> + if (blob->secid[i] == 0) >> + continue; >> + error = security_secid_to_secctx(blob, &context, i); >> + if (error) { >> + if (error != -EINVAL) >> + audit_panic("error in audit_log_object_context"); >> + audit_log_format(ab, "%sobj_%s=?", >> + i ? " " : "", >> + lsm_slot_to_name(i)); >> + } else { >> + audit_log_format(ab, "%sobj_%s=%s", >> + i ? " " : "", >> + lsm_slot_to_name(i), >> + context.context); >> + security_release_secctx(&context); >> + } >> + } >> + >> + audit_buffer_aux_end(ab); >> + } >> + return; >> + >> +error_path: >> + audit_panic("error in audit_log_object_context"); >> +} > The comment from patch 26/29 regarding the audit_panic() placement > also applies to audit_log_object_context(). > >> diff --git a/kernel/auditsc.c b/kernel/auditsc.c >> index 7848e7351cf9..923e4e3a5697 100644 >> --- a/kernel/auditsc.c >> +++ b/kernel/auditsc.c >> @@ -1114,36 +1114,25 @@ static inline void audit_free_context(struct audit_context *context) >> kfree(context); >> } >> >> -static int audit_log_pid_context(struct audit_context *context, pid_t pid, >> - kuid_t auid, kuid_t uid, >> - unsigned int sessionid, >> - struct lsmblob *blob, char *comm) >> +static void audit_log_pid_context(struct audit_context *context, pid_t pid, >> + kuid_t auid, kuid_t uid, >> + unsigned int sessionid, >> + struct lsmblob *blob, char *comm) >> { >> struct audit_buffer *ab; >> - struct lsmcontext lsmctx; >> - int rc = 0; >> >> ab = audit_log_start(context, GFP_KERNEL, AUDIT_OBJ_PID); >> if (!ab) >> - return rc; >> + return; >> >> audit_log_format(ab, "opid=%d oauid=%d ouid=%d oses=%d", pid, >> from_kuid(&init_user_ns, auid), >> from_kuid(&init_user_ns, uid), sessionid); >> - if (lsmblob_is_set(blob)) { >> - if (security_secid_to_secctx(blob, &lsmctx, LSMBLOB_FIRST)) { >> - audit_log_format(ab, " obj=(none)"); >> - rc = 1; >> - } else { >> - audit_log_format(ab, " obj=%s", lsmctx.context); >> - security_release_secctx(&lsmctx); >> - } >> - } >> + if (lsmblob_is_set(blob)) >> + audit_log_object_context(ab, blob); >> audit_log_format(ab, " ocomm="); >> audit_log_untrustedstring(ab, comm); >> audit_log_end(ab); >> - >> - return rc; >> } >> >> static void audit_log_execve_info(struct audit_context *context, >> @@ -1373,18 +1362,10 @@ static void show_special(struct audit_context *context, int *call_panic) >> from_kgid(&init_user_ns, context->ipc.gid), >> context->ipc.mode); >> if (osid) { >> - struct lsmcontext lsmcxt; >> struct lsmblob blob; >> >> lsmblob_init(&blob, osid); >> - if (security_secid_to_secctx(&blob, &lsmcxt, >> - LSMBLOB_FIRST)) { >> - audit_log_format(ab, " osid=%u", osid); >> - *call_panic = 1; >> - } else { >> - audit_log_format(ab, " obj=%s", lsmcxt.context); >> - security_release_secctx(&lsmcxt); >> - } >> + audit_log_object_context(ab, &blob); > While we lose the "osid=X" in case of failure, the secid/SID is a > private kernel value meaning it was always of questionable value.
I could come up with a change to audit_log_object_context() that would put out an osid= in the single security module case. I would prefer not to if that would be acceptable.
> > > -- > paul-moore.com
| |