June 2016 - Linux-audit - Linux-Audit List Archives

[PATCH v2] audit: add fields to exclude filter by reusing user filter

by Richard Guy Briggs

RFE: add additional fields for use in audit filter exclude rules https://github.com/linux-audit/audit-kernel/issues/5 Re-factor and combine audit_filter_type() with audit_filter_user() to use audit_filter_user_rules() to enable the exclude filter to additionally filter on PID, UID, GID, AUID, LOGINUID_SET, SUBJ_*. The process of combining the similar audit_filter_user() and audit_filter_type() functions, required inverting the meaning and including the ALWAYS action of the latter. Keep the check to quit early if the list is empty. Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com> --- v2: combine audit_filter_user() and audit_filter_type() into audit_filter(). --- include/linux/audit.h | 2 -- kernel/audit.c | 4 ++-- kernel/audit.h | 2 ++ kernel/auditfilter.c | 46 ++++++++++------------------------------------ 4 files changed, 14 insertions(+), 40 deletions(-) diff --git a/include/linux/audit.h b/include/linux/audit.h index 32cdafb..539c1d9 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -160,8 +160,6 @@ extern void audit_log_task_info(struct audit_buffer *ab, extern int audit_update_lsm_rules(void); /* Private API (for audit.c only) */ -extern int audit_filter_user(int type); -extern int audit_filter_type(int type); extern int audit_rule_change(int type, __u32 portid, int seq, void *data, size_t datasz); extern int audit_list_rules_send(struct sk_buff *request_skb, int seq); diff --git a/kernel/audit.c b/kernel/audit.c index 384374a..2dfaa19 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -914,7 +914,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) if (!audit_enabled && msg_type != AUDIT_USER_AVC) return 0; - err = audit_filter_user(msg_type); + err = audit_filter(msg_type, AUDIT_FILTER_USER); if (err == 1) { /* match or error */ err = 0; if (msg_type == AUDIT_USER_TTY) { @@ -1362,7 +1362,7 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, if (audit_initialized != AUDIT_INITIALIZED) return NULL; - if (unlikely(audit_filter_type(type))) + if (unlikely(!audit_filter(type, AUDIT_FILTER_TYPE))) return NULL; if (gfp_mask & __GFP_DIRECT_RECLAIM) { diff --git a/kernel/audit.h b/kernel/audit.h index cbbe6bb..1879f02 100644 --- a/kernel/audit.h +++ b/kernel/audit.h @@ -327,6 +327,8 @@ extern pid_t audit_sig_pid; extern kuid_t audit_sig_uid; extern u32 audit_sig_sid; +extern int audit_filter(int msgtype, unsigned int listtype); + #ifdef CONFIG_AUDITSYSCALL extern int __audit_signal_info(int sig, struct task_struct *t); static inline int audit_signal_info(int sig, struct task_struct *t) diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index 96c9a1b..f90c042 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -1349,50 +1349,24 @@ static int audit_filter_user_rules(struct audit_krule *rule, int type, return 1; } -int audit_filter_user(int type) +int audit_filter(int msgtype, unsigned int listtype) { enum audit_state state = AUDIT_DISABLED; struct audit_entry *e; - int rc, ret; - - ret = 1; /* Audit by default */ + int rc, result = 1; /* Audit by default */ rcu_read_lock(); - list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_USER], list) { - rc = audit_filter_user_rules(&e->rule, type, &state); - if (rc) { - if (rc > 0 && state == AUDIT_DISABLED) - ret = 0; - break; - } - } - rcu_read_unlock(); - - return ret; -} - -int audit_filter_type(int type) -{ - struct audit_entry *e; - int result = 0; - - rcu_read_lock(); - if (list_empty(&audit_filter_list[AUDIT_FILTER_TYPE])) + if (list_empty(&audit_filter_list[listtype])) goto unlock_and_return; - list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TYPE], - list) { - int i; - for (i = 0; i < e->rule.field_count; i++) { - struct audit_field *f = &e->rule.fields[i]; - if (f->type == AUDIT_MSGTYPE) { - result = audit_comparator(type, f->op, f->val); - if (!result) - break; - } + list_for_each_entry_rcu(e, &audit_filter_list[listtype], list) { + rc = audit_filter_user_rules(&e->rule, msgtype, &state); + if (rc) { + if (rc > 0 && ((state == AUDIT_DISABLED) || + (listtype == AUDIT_FILTER_TYPE))) + result = 0; + break; } - if (result) - goto unlock_and_return; } unlock_and_return: rcu_read_unlock(); -- 1.7.1

8 years, 4 months

2
2
0 / 0

[PATCH] audit: fix some horrible switch statement style crimes

by Paul Moore

From: Paul Moore <paul(a)paul-moore.com> Signed-off-by: Paul Moore <paul(a)paul-moore.com> --- kernel/auditfilter.c | 8 ++++++-- kernel/auditsc.c | 8 ++++++-- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index 8a8aa3fb..ff59a5e 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -1343,8 +1343,12 @@ static int audit_filter_user_rules(struct audit_krule *rule, int type, return result; } switch (rule->action) { - case AUDIT_NEVER: *state = AUDIT_DISABLED; break; - case AUDIT_ALWAYS: *state = AUDIT_RECORD_CONTEXT; break; + case AUDIT_NEVER: + *state = AUDIT_DISABLED; + break; + case AUDIT_ALWAYS: + *state = AUDIT_RECORD_CONTEXT; + break; } return 1; } diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 7d0e3cf..ec4c552 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -695,8 +695,12 @@ static int audit_filter_rules(struct task_struct *tsk, ctx->prio = rule->prio; } switch (rule->action) { - case AUDIT_NEVER: *state = AUDIT_DISABLED; break; - case AUDIT_ALWAYS: *state = AUDIT_RECORD_CONTEXT; break; + case AUDIT_NEVER: + *state = AUDIT_DISABLED; + break; + case AUDIT_ALWAYS: + *state = AUDIT_RECORD_CONTEXT; + break; } return 1; }

8 years, 4 months

1
0
0 / 0

[PATCH 17/21] audit: Use timespec64 to represent audit timestamps

by Deepa Dinamani

struct timespec is not y2038 safe. Audit timestamps are recorded in string format into an audit buffer for a given context. These mark the entry timestamps for the syscalls. Use y2038 safe struct timespec64 to represent the times. The log strings can handle this transition as strings can hold upto 1024 characters. Signed-off-by: Deepa Dinamani <deepa.kernel(a)gmail.com> Cc: Paul Moore <paul(a)paul-moore.com> Cc: Eric Paris <eparis(a)redhat.com> Cc: linux-audit(a)redhat.com --- include/linux/audit.h | 4 ++-- kernel/audit.c | 10 +++++----- kernel/audit.h | 2 +- kernel/auditsc.c | 6 +++--- 4 files changed, 11 insertions(+), 11 deletions(-) diff --git a/include/linux/audit.h b/include/linux/audit.h index 961a417..2f6a1123 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -335,7 +335,7 @@ static inline void audit_ptrace(struct task_struct *t) /* Private API (for audit.c only) */ extern unsigned int audit_serial(void); extern int auditsc_get_stamp(struct audit_context *ctx, - struct timespec *t, unsigned int *serial); + struct timespec64 *t, unsigned int *serial); extern int audit_set_loginuid(kuid_t loginuid); static inline kuid_t audit_get_loginuid(struct task_struct *tsk) @@ -510,7 +510,7 @@ static inline void __audit_seccomp(unsigned long syscall, long signr, int code) static inline void audit_seccomp(unsigned long syscall, long signr, int code) { } static inline int auditsc_get_stamp(struct audit_context *ctx, - struct timespec *t, unsigned int *serial) + struct timespec64 *t, unsigned int *serial) { return 0; } diff --git a/kernel/audit.c b/kernel/audit.c index 22bb4f2..6c2f405 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -1325,10 +1325,10 @@ unsigned int audit_serial(void) } static inline void audit_get_stamp(struct audit_context *ctx, - struct timespec *t, unsigned int *serial) + struct timespec64 *t, unsigned int *serial) { if (!ctx || !auditsc_get_stamp(ctx, t, serial)) { - *t = CURRENT_TIME; + ktime_get_real_ts64(t); *serial = audit_serial(); } } @@ -1370,7 +1370,7 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, int type) { struct audit_buffer *ab = NULL; - struct timespec t; + struct timespec64 t; unsigned int uninitialized_var(serial); int reserve = 5; /* Allow atomic callers to go up to five entries over the normal backlog limit */ @@ -1422,8 +1422,8 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, audit_get_stamp(ab->ctx, &t, &serial); - audit_log_format(ab, "audit(%lu.%03lu:%u): ", - t.tv_sec, t.tv_nsec/1000000, serial); + audit_log_format(ab, "audit(%llu.%03lu:%u): ", + (unsigned long long)t.tv_sec, t.tv_nsec/1000000, serial); return ab; } diff --git a/kernel/audit.h b/kernel/audit.h index cbbe6bb..029d674 100644 --- a/kernel/audit.h +++ b/kernel/audit.h @@ -111,7 +111,7 @@ struct audit_context { enum audit_state state, current_state; unsigned int serial; /* serial number for record */ int major; /* syscall number */ - struct timespec ctime; /* time of syscall entry */ + struct timespec64 ctime; /* time of syscall entry */ unsigned long argv[4]; /* syscall arguments */ long return_code;/* syscall return code */ u64 prio; diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 62ab53d..ecebb3c 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1523,7 +1523,7 @@ void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2, return; context->serial = 0; - context->ctime = CURRENT_TIME; + ktime_get_real_ts64(&context->ctime); context->in_syscall = 1; context->current_state = state; context->ppid = 0; @@ -1932,13 +1932,13 @@ EXPORT_SYMBOL_GPL(__audit_inode_child); /** * auditsc_get_stamp - get local copies of audit_context values * @ctx: audit_context for the task - * @t: timespec to store time recorded in the audit_context + * @t: timespec64 to store time recorded in the audit_context * @serial: serial value that is recorded in the audit_context * * Also sets the context as auditable. */ int auditsc_get_stamp(struct audit_context *ctx, - struct timespec *t, unsigned int *serial) + struct timespec64 *t, unsigned int *serial) { if (!ctx->in_syscall) return 0; -- 1.9.1

8 years, 4 months

4
6
0 / 0

[RFC PATCH 0/7] audit: clean up audit queue handling

by Richard Guy Briggs

This set of patches cleans up a number of corner cases in the management of the audit queue. Richard Guy Briggs (7): audit: don't needlessly reset valid wait time audit: include auditd's threads in audit_log_start() wait exception audit: allow systemd to use queue reserves audit: wake up threads if queue switched from limited to unlimited audit: allow audit_cmd_mutex holders to use reserves audit: wake up audit_backlog_wait queue when auditd goes away. audit: wake up kauditd_thread after auditd registers kernel/audit.c | 20 +++++++++++++++----- 1 files changed, 15 insertions(+), 5 deletions(-)

8 years, 4 months

4
22
0 / 0

[PATCH] audit: add fields to exclude filter by reusing user filter

by Richard Guy Briggs

RFE: add additional fields for use in audit filter exclude rules https://github.com/linux-audit/audit-kernel/issues/5 Re-factor audit_filter_type() to use audit_filter_user_rules() to enable exclude filter to additionally filter on PID, UID, GID, AUID, LOGINUID_SET, SUBJ_*. Add check in audit_filter_user() to quit early if list is empty. Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com> --- kernel/auditfilter.c | 22 +++++++++------------- 1 files changed, 9 insertions(+), 13 deletions(-) diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index 96c9a1b..515c752 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -1358,6 +1358,9 @@ int audit_filter_user(int type) ret = 1; /* Audit by default */ rcu_read_lock(); + if (list_empty(&audit_filter_list[AUDIT_FILTER_USER])) + goto unlock_and_return; + list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_USER], list) { rc = audit_filter_user_rules(&e->rule, type, &state); if (rc) { @@ -1366,13 +1369,14 @@ int audit_filter_user(int type) break; } } +unlock_and_return: rcu_read_unlock(); - return ret; } int audit_filter_type(int type) { + enum audit_state state = AUDIT_DISABLED; struct audit_entry *e; int result = 0; @@ -1380,19 +1384,11 @@ int audit_filter_type(int type) if (list_empty(&audit_filter_list[AUDIT_FILTER_TYPE])) goto unlock_and_return; - list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TYPE], - list) { - int i; - for (i = 0; i < e->rule.field_count; i++) { - struct audit_field *f = &e->rule.fields[i]; - if (f->type == AUDIT_MSGTYPE) { - result = audit_comparator(type, f->op, f->val); - if (!result) - break; - } + list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TYPE], list) { + if (audit_filter_user_rules(&e->rule, type, &state) == 1) { + result = 1; + break; } - if (result) - goto unlock_and_return; } unlock_and_return: rcu_read_unlock(); -- 1.7.1

8 years, 4 months

3
4
0 / 0

Audit reporting Invalid argument

by Bhagwat, Shriniketan Manjunath

Hello, I am trying to monitor multiple files using Linux audit. In order to get better performance, I am trying to reduce number of rules. If I specify more than one path field as in below example I am getting "Invalid argument". Examle1: # auditctl -a always,exit -F arch=x86_64 -F path=/home/secpack/test.c -F path=/home/secpack/test -S open Error sending add rule data request (Invalid argument) # auditctl -a always,exit -F arch=x86_64 -F path=/home/secpack/test.c -F dir=/tmp/ -S open Error sending add rule data request (Invalid argument) However, I am able to create a single rule to monitor multiple PIDs or UIDs as below. Examle2: # auditctl -a always,exit -F arch=x86_64 -F pid=3526 -F pid=3537 # auditctl -a always,exit -F arch=x86_64 -F auid=0 -F auid=512 -F auid=1002 As per the auditctl man page, Build a rule field takes up to 64 fields on a single command line. Each one must start with -F. Each field equation is anded with each other to trigger an audit record. My question is, 1. specify more than one path field as in example1 is valid? 2. If not valid than how do I create single audit rule to monitor multiple files/directory? 3. If valid, then why "Invalid argument" is reported? 4. To monitor 10 files, should 10 audit rules required? 5. if 10 rules are required, how to I optimize the rule for performance? My next question is does Linux audit support regular expressions? How do I create audit rule to monitor /var/log/*.log? # auditctl -a always,exit -F arch=x86_64 -F path=^/var/log/*.log$ -S open Error sending add rule data request (Invalid argument) If my questions are already documented, please guide me to the documentation. Regards, Ketan

8 years, 4 months

3
10
0 / 0

problems with slow auditing/journaling after updating to RHEL 6.8

by Jacobson, Robert C. (GSFC-444.0)[HONEYWELL TECHNOLOGY SOLUTIONS INC]

I guess the first question I should ask is : is this the proper list for questions about problems? If not, then please accept my apology -- and I would greatly appreciate if you could direct me to the proper list. I recently upgraded a system to RHEL 6.8. kernel: 2.6.32-642.1.1.el6.x86_64 audit: audit-2.4.5-3.el6.x86_64 My users and I immediately noticed a huge drop in application performance -- and when I investigated further, I found a large amount of CPU wait. Here's a graph from nagios data via splunk, over the past 48 hours. The system was patched ~1300 (right about the middle of each graph -- the first spike), then rebooted at 1715 (the second spike): http://i.imgur.com/BuyazLH.jpg Here's some nmon snapshot during a "problem" period: http://i.imgur.com/YbQjeK2.jpg (note: all logical volumes on sda5, dm-9 is the logical volume for audit logs) If I'm interpreting things correctly, it is due to drastic slow-down of journaling on my audit volume. I don't know if this is a problem with the auditing subsystem, or the disk I/O subsystem, or ... what? Here's an excerpt from iotop, while I run a process that generates perhaps 1000 audit log messages: Total DISK READ : 0.00 B/s | Total DISK WRITE : 160.53 K/s Actual DISK READ: 0.00 B/s | Actual DISK WRITE: 586.11 K/s PID PRIO USER DISK READ DISK WRITE SWAPIN IO> COMMAND 1458 be/3 root 0.00 B/s 0.00 B/s 0.00 % 97.23 % [jbd2/dm-9-8] 24354 be/3 root 0.00 B/s 145.59 K/s 0.00 % 0.54 % auditd The total amount of data generated in the logs is actually very small -- approximately 1 MB -- so I'm puzzled as to why it would take so long to write it out. The process that generates most of these audit messages takes 1.1 second to run with auditing off (or on a RHEL 6.7 system with auditing on or off). With auditing running, it takes 32 seconds to run. ## auditing is off: $ time nice -n 10 /product/bin/fclient.rb -d 3 Logging in /tmp/ferret.log real 0m1.113s user 0m0.435s sys 0m0.643s ## auditing is on: $ time nice -n 10 /product/bin/fclient.rb -d 3 Logging in /tmp/ferret.log real 0m32.088s user 0m0.394s sys 0m0.686s I'll note that the ruby version hasn't changed between 6.7 and 6.8 (still ruby-1.8.7.374-4.el6_6.x86_64) The system is using CFQ for disk I/O. The filesystem is ext4. Disks are all local SATA disks. I'd appreciate any guidance you have! -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Robert Jacobson Robert.C.Jacobson(a)nasa.gov Lead System Admin Solar Dynamics Observatory (SDO) Bldg 14, E222 (301) 286-1591

8 years, 4 months

2
1
0 / 0

[PATCH 0/2] add support for more fields to the exclude filter

by Richard Guy Briggs

When support for avoiding in-band signals to indicate an unset loginuid was added to the kernel, userspace was neglected, so add them here as a prerequisite to enable their use in the exclude filter: See upstream kernel commits: 780a7654cee8d61819512385e778e4827db4bfbc 041d7b98ffe59c59fdd639931dea7d74f9aa9a59 The rest to support additional fields for the exclude filter is in the second patch. RFE: add additional fields for use in audit filter exclude rules https://github.com/linux-audit/audit-kernel/issues/5 Richard Guy Briggs (2): add support for loginuid_set using macro AUDIT_LOGINUID_SET exclude filter: add support for user filter fields docs/auditctl.8 | 2 +- lib/fieldtab.h | 2 ++ lib/libaudit.c | 21 ++++++++++++++++++--- 3 files changed, 21 insertions(+), 4 deletions(-)

8 years, 5 months

1
2
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Linux-audit June 2016