May 2017 - Linux-audit - Linux-Audit List Archives

Disabling rsyslog rate-limiting just for audit/audispd

by Stephen Buchanan

With the caveat that I am perhaps asking the wrong audience, I'm hoping that someone has hit this issue before, and possibly solved it. I've set up a number of servers in my environment to forward all audit log entries via audispd and rsyslog to a central rsyslog receiver where they are parsed and saved. All that is working (audit is sent with LOG_LOCAL6 in audispd syslog plugin, "local6.* @@loghost:514" is in rsyslog.conf). The problem/question I have is whether it is possible to turn off rate-limiting for rsyslog *only for audit traffic*. Leaving aside that I need to tune the audit rules better, on heavily loaded servers the rsyslogd starts dropping most of the audit traffic due to the rate-limiting parameters. I know I can turn it off (or set it much higher) for all rsyslog, but is there any way to selectively set the rate limit by either source (audispd) or facility (local6)? I've just joined the rsyslog mailing list, if I fail here then I'll ask there, but I'm afraid that the answer will have something to do with using rsyslog v8, and I'm stuck with the RHEL7-provided v7.4.7. Any assistance/suggestions/leads are appreciated. Stephen

8 years

2
1
0 / 0

[PATCH] errormsg: use descriptive macros for error numbers

by Richard Guy Briggs

Convert all the numerical error return codes in comparison option and field option parsing routines audit_rule_interfield_comp_data() and audit_rule_fieldpair_data() to descriptive macros for easier code navigation and verification. See: https://github.com/linux-audit/audit-userspace/issues/11 Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com> --- lib/errormsg.h | 29 +++++++++++++++++++ lib/libaudit.c | 84 ++++++++++++++++++++++++++++---------------------------- 2 files changed, 71 insertions(+), 42 deletions(-) diff --git a/lib/errormsg.h b/lib/errormsg.h index 9524697..17ff767 100644 --- a/lib/errormsg.h +++ b/lib/errormsg.h @@ -68,4 +68,33 @@ static const struct msg_tab err_msgtab[] = { { -30, 2, "Field option not supported by kernel:" }, { -31, 1, "must be used with exclude, user, or exit filter" }, }; +#define EAU_OPMISSING 1 +#define EAU_FIELDUNKNOWN 2 +#define EAU_ARCHMISPLACED 3 +#define EAU_ARCHUNKNOWN 4 +#define EAU_ELFUNKNOWN 5 +#define EAU_ARCHNOBIT 6 +#define EAU_EXITONLY 7 +#define EAU_MSGTYPEUNKNOWN 8 +#define EAU_MSGTYPEEXCLUDE 9 +#define EAU_UPGRADEFAIL 10 +#define EAU_STRTOOLONG 11 +#define EAU_MSGTYPECREDEXCLUDE 12 +#define EAU_OPEQNOTEQ 13 +#define EAU_PERMRWXA 14 +#define EAU_ERRUNKNOWN 15 +#define EAU_FILETYPEUNKNOWN 16 +#define EAU_EXITENTRYONLY 17 +#define EAU_KEYDEP 19 +#define EAU_FIELDVALMISSING 20 +#define EAU_FIELDVALNUM 21 +#define EAU_FIELDNAME 22 +#define EAU_COMPFIELDNAME 24 +#define EAU_COMPVAL 25 +#define EAU_COMPFIELDUNKNOWN 26 +#define EAU_COMPVALUNKNOWN 27 +#define EAU_FIELDTOOMANY 28 +#define EAU_OPEQ 29 +#define EAU_FIELDNOSUPPORT 30 +#define EAU_FIELDNOFILTER 31 #endif diff --git a/lib/libaudit.c b/lib/libaudit.c index 002dd89..a3b4261 100644 --- a/lib/libaudit.c +++ b/lib/libaudit.c @@ -520,7 +520,7 @@ int audit_reset_lost(int fd) struct audit_status s; if ((audit_get_features() & AUDIT_FEATURE_BITMAP_LOST_RESET) == 0) - return -30; + return -EAU_FIELDNOSUPPORT; memset(&s, 0, sizeof(s)); s.mask = AUDIT_STATUS_LOST; @@ -979,7 +979,7 @@ int audit_rule_interfield_comp_data(struct audit_rule_data **rulep, return -1; if (rule->field_count >= (AUDIT_MAX_FIELDS - 1)) - return -28; + return -EAU_FIELDTOOMANY; /* look for 2-char operators first then look for 1-char operators afterwards @@ -994,24 +994,24 @@ int audit_rule_interfield_comp_data(struct audit_rule_data **rulep, *v++ = '\0'; op = AUDIT_EQUAL; } else { - return -13; + return -EAU_OPEQNOTEQ; } if (*f == 0) - return -24; + return -EAU_COMPFIELDNAME; if (*v == 0) - return -25; + return -EAU_COMPVAL; if ((field1 = audit_name_to_field(f)) < 0) - return -26; + return -EAU_COMPFIELDUNKNOWN; if ((field2 = audit_name_to_field(v)) < 0) - return -27; + return -EAU_COMPVALUNKNOWN; /* Interfield comparison can only be in exit filter */ if (flags != AUDIT_FILTER_EXIT) - return -7; + return -EAU_EXITONLY; // It should always be AUDIT_FIELD_COMPARE rule->fields[rule->field_count] = AUDIT_FIELD_COMPARE; @@ -1392,7 +1392,7 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair, return -1; if (rule->field_count >= (AUDIT_MAX_FIELDS - 1)) - return -28; + return -EAU_FIELDTOOMANY; /* look for 2-char operators first then look for 1-char operators afterwards @@ -1430,23 +1430,23 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair, } if (v == NULL) - return -1; + return -EAU_OPMISSING; if (*f == 0) - return -22; + return -EAU_FIELDNAME; if (*v == 0) - return -20; + return -EAU_FIELDVALMISSING; if ((field = audit_name_to_field(f)) < 0) - return -2; + return -EAU_FIELDUNKNOWN; /* Exclude filter can be used only with MSGTYPE and cred fields */ if (flags == AUDIT_FILTER_EXCLUDE) { uint32_t features = audit_get_features(); if ((features & AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND) == 0) { if (field != AUDIT_MSGTYPE) - return -30; + return -EAU_FIELDNOSUPPORT; } else { switch(field) { case AUDIT_PID: @@ -1461,7 +1461,7 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair, case AUDIT_SUBJ_CLR: break; default: - return -12; + return -EAU_MSGTYPECREDEXCLUDE; } } } @@ -1529,13 +1529,13 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair, rule->values[rule->field_count] = audit_name_to_errno(v); if (rule->values[rule->field_count] == 0) - return -15; + return -EAU_ERRUNKNOWN; } break; case AUDIT_MSGTYPE: if (flags != AUDIT_FILTER_EXCLUDE && flags != AUDIT_FILTER_USER) - return -9; + return -EAU_MSGTYPEEXCLUDE; if (isdigit((char)*(v))) rule->values[rule->field_count] = @@ -1545,7 +1545,7 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair, rule->values[rule->field_count] = audit_name_to_msg_type(v); else - return -8; + return -EAU_MSGTYPEUNKNOWN; break; /* These next few are strings */ case AUDIT_OBJ_USER: @@ -1558,7 +1558,7 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair, /* Watch & object filtering is invalid on anything * but exit */ if (flags != AUDIT_FILTER_EXIT) - return -7; + return -EAU_EXITONLY; if (field == AUDIT_WATCH || field == AUDIT_DIR) _audit_permadded = 1; @@ -1573,21 +1573,21 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair, if (field == AUDIT_EXE) { uint32_t features = audit_get_features(); if ((features & AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH) == 0) - return -30; + return -EAU_FIELDNOSUPPORT; if (op != AUDIT_EQUAL) - return -29; + return -EAU_OPEQ; _audit_exeadded = 1; } if (field == AUDIT_FILTERKEY && !(_audit_syscalladded || _audit_permadded || _audit_exeadded)) - return -19; + return -EAU_KEYDEP; vlen = strlen(v); if (field == AUDIT_FILTERKEY && vlen > AUDIT_MAX_KEY_LEN) - return -11; + return -EAU_STRTOOLONG; else if (vlen > PATH_MAX) - return -11; + return -EAU_STRTOOLONG; rule->values[rule->field_count] = vlen; offset = rule->buflen; rule->buflen += vlen; @@ -1604,21 +1604,21 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair, break; case AUDIT_ARCH: if (_audit_syscalladded) - return -3; + return -EAU_ARCHMISPLACED; if (!(op == AUDIT_NOT_EQUAL || op == AUDIT_EQUAL)) - return -13; + return -EAU_OPEQNOTEQ; if (isdigit((char)*(v))) { int machine; errno = 0; _audit_elf = strtoul(v, NULL, 0); if (errno) - return -5; + return -EAU_ELFUNKNOWN; // Make sure we have a valid mapping machine = audit_elf_to_machine(_audit_elf); if (machine < 0) - return -5; + return -EAU_ELFUNKNOWN; } else { const char *arch=v; @@ -1628,7 +1628,7 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair, to elf. */ elf = audit_machine_to_elf(machine); if (elf == 0) - return -5; + return -EAU_ELFUNKNOWN; _audit_elf = elf; } @@ -1637,15 +1637,15 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair, break; case AUDIT_PERM: if (flags != AUDIT_FILTER_EXIT) - return -7; + return -EAU_EXITONLY; else if (op != AUDIT_EQUAL) - return -13; + return -EAU_OPEQNOTEQ; else { unsigned int i, len, val = 0; len = strlen(v); if (len > 4) - return -11; + return -EAU_STRTOOLONG; for (i = 0; i < len; i++) { switch (tolower(v[i])) { @@ -1662,7 +1662,7 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair, val |= AUDIT_PERM_ATTR; break; default: - return -14; + return -EAU_PERMRWXA; } } rule->values[rule->field_count] = val; @@ -1670,11 +1670,11 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair, break; case AUDIT_FILETYPE: if (!(flags == AUDIT_FILTER_EXIT)) - return -17; + return -EAU_EXITENTRYONLY; rule->values[rule->field_count] = audit_name_to_ftype(v); if ((int)rule->values[rule->field_count] < 0) { - return -16; + return -EAU_FILETYPEUNKNOWN; } break; case AUDIT_ARG0...AUDIT_ARG3: @@ -1687,16 +1687,16 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair, rule->values[rule->field_count] = strtol(v, NULL, 0); else - return -21; + return -EAU_FIELDVALNUM; break; case AUDIT_SESSIONID: if ((audit_get_features() & AUDIT_FEATURE_BITMAP_SESSIONID_FILTER) == 0) - return -30; + return -EAU_FIELDNOSUPPORT; if (flags != AUDIT_FILTER_EXCLUDE && flags != AUDIT_FILTER_USER && flags != AUDIT_FILTER_EXIT) - return -31; + return -EAU_FIELDNOFILTER; // Do positive & negative separate for 32 bit systems vlen = strlen(v); if (isdigit((char)*(v))) @@ -1712,20 +1712,20 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair, case AUDIT_DEVMAJOR...AUDIT_INODE: case AUDIT_SUCCESS: if (flags != AUDIT_FILTER_EXIT) - return -7; + return -EAU_EXITONLY; /* fallthrough */ default: if (field == AUDIT_INODE) { if (!(op == AUDIT_NOT_EQUAL || op == AUDIT_EQUAL)) - return -13; + return -EAU_OPEQNOTEQ; } if (field == AUDIT_PPID && !(flags==AUDIT_FILTER_EXIT)) - return -17; + return -EAU_EXITENTRYONLY; if (!isdigit((char)*(v))) - return -21; + return -EAU_FIELDVALNUM; if (field == AUDIT_INODE) rule->values[rule->field_count] = -- 1.7.1

8 years

2
5
0 / 0

Exclude Watched Items

by Boyce, Kevin P [US] (AS)

Ok I admit I should know how to do this, but it is evident I do not. On RHEL 5.11, what is the correct way for me to not audit anything in /proc? I had tried: -d entry,always -S all -F dir=/proc -a exclude,always -F dir=/proc Both of these are ignored. The first makes sense because I guess -d must match exactly a rule already loaded in the kernel. The second is telling me I have an invalid message type, but I can't seem to find the valid message types documented in the man pages. Other systemcalls which are audited are open, fopen, chown, chattr, etc. I am trying to prevent auditing of the open syscall on /proc/... because there are a lot of them, and it is not a requirement. Kevin

8 years

3
3
0 / 0

What fields should be used for reporting shared memory?

by Martin Kletzander

Hi, I am going through the fields in the dictionary and I can't find any name to use for the following scenario. We (libvirt) are running virtual machines and there's a thing nowadays, that people like to use, called ivshmem (Inter-VM SHared MEMory). From host's point of view this is just a shared memory region accessed by multiple VMs (and possibly to host as well). The machine maps the shared memory given a name (e.g. name "asdf" results in /dev/shm/asdf to be mapped) *or* it can communicate with a server over UNIX socket and that server handles interrupts and also tells the client which shared memory region to map. Talking about information we have; in server-less setup it's the shared memory region that is shared, in the server scenario it is the socket. That's information we can output. So my question is, when starting a domain or hot-(un)plugging, what naming should we use for this kind of device and what are the things that we should describe about it? Basically, how would you like the message to look? Thanks in advance for any info. Have a nice day, Martin

8 years

2
4
0 / 0

audit-testsuite usage

by Richard Guy Briggs

Hi folks, We're trying to get an idea of how many users there are for the relatively new https://github.com/linux-audit/audit-testsuite and how they are using it or would like to use it to help inform decisions about how to manage the suite so that it is still useful to us but not prevent some other unforseen reasonable use cases. Who is using it? How/Why? Thanks! - RGB -- Richard Guy Briggs <rgb(a)redhat.com> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635

8 years

4
4
0 / 0

[GIT PULL] Audit patches for v4.12

by Paul Moore

Hi Linus, Fourteen audit patches for v4.12 that span the full range of fixes, new features, and internal cleanups. We have a patches to move to 64-bit timestamps, convert refcounts from atomic_t to refcount_t, track PIDs using the pid struct instead of pid_t, convert our own private audit buffer cache to a standard kmem_cache, log kernel module names when they are unloaded, and normalize the NETFILTER_PKT to make the userspace folks happier. From a fixes perspective, the most important is likely the auditd connection tracking RCU fix; it was a rather brain dead bug that I'll take the blame for, but thankfully it didn't seem to affect many people (only one report). I think the patch subject lines and commit descriptions do a pretty good job of explaining the details and why the changes are important so I'll point you there instead of duplicating it here; as usual, if you have any questions you know where to find us. We also manage to take out more code than we put in this time, that always makes me happy :) Please merge for v4.12. -Paul --- The following changes since commit a351e9b9fc24e982ec2f0e76379a49826036da12: Linux 4.11 (2017-04-30 19:47:48 -0700) are available in the git repository at: git://git.infradead.org/users/pcmoore/audit stable-4.12 for you to fetch changes up to 48d0e023af9799cd7220335baf8e3ba61eeafbeb: audit: fix the RCU locking for the auditd_connection structure (2017-05-02 10:16:05 -0400) ---------------------------------------------------------------- Deepa Dinamani (1): audit: Use timespec64 to represent audit timestamps Elena Reshetova (2): audit: convert audit_tree.count from atomic_t to refcount_t audit: convert audit_watch.count from atomic_t to refcount_t Nicholas Mc Guire (3): audit: remove unnecessary semicolon in audit_field_valid() audit: remove unnecessary semicolon in audit_mark_handle_event() audit: remove unnecessary semicolon in audit_watch_handle_event() Paul Moore (5): audit: combine audit_receive() and audit_receive_skb() audit: kernel generated netlink traffic should have a portid of 0 audit: store the auditd PID as a pid struct instead of pid_t audit: use kmem_cache to manage the audit_buffer cache audit: fix the RCU locking for the auditd_connection structure Richard Guy Briggs (3): audit: log module name on delete_module netfilter: use consistent ipv4 network offset in xt_AUDIT audit: normalize NETFILTER_PKT include/linux/audit.h | 7 +- kernel/audit.c | 319 +++++++++++++++++++++++-------------------- kernel/audit.h | 7 +- kernel/audit_fsnotify.c | 2 +- kernel/audit_tree.c | 9 +- kernel/audit_watch.c | 11 +- kernel/auditfilter.c | 18 ++- kernel/auditsc.c | 6 +- kernel/module.c | 2 + net/netfilter/xt_AUDIT.c | 126 +++++-------------- 10 files changed, 232 insertions(+), 275 deletions(-) -- paul moore www.paul-moore.com

8 years

1
0
0 / 0

[PATCH v3 0/4] Improved seccomp logging

by Tyler Hicks

This patch set is the third revision of the following two previously submitted patch sets: v1: http://lkml.kernel.org/r/1483375990-14948-1-git-send-email-tyhicks@canoni... v1: http://lkml.kernel.org/r/1483377999-15019-2-git-send-email-tyhicks@canoni... v2: http://lkml.kernel.org/r/1486100262-32391-1-git-send-email-tyhicks@canoni... The patch set aims to address some known deficiencies in seccomp's current logging capabilities: 1. Inability to log all filter actions. 2. Inability to selectively enable filtering; e.g. devs want noisy logging, users want relative quiet. 3. Consistent behavior with audit enabled and disabled. 4. Inability to easily develop a filter due to the lack of a permissive/complain mode. Changes since v2 to address feedback from Kees: - Patch 1 + Log a warning when sysctl registration fails + Move comment describing SECCOMP_RET_*_NAME from PATCH 2 + Document the actions_avail sysctl - Patch 2 + Inline seccomp_log() + Optimize logging for RET_ALLOW hot path + Use "{ }" for name buffer initialization + Make a copy of the ctl_table and only modify the copy + Rename max_action_to_log sysctl to log_max_action + Document the log_max_action sysctl - Patch 3 + Put some space between RET_LOG and RET_ALLOW for future actions + Separate the RET_ALLOW and RET_LOG cases in __seccomp_filter() - Patch 4 + Adjust the selftests for the updated RET_LOG value Tyler Tyler Hicks (4): seccomp: Add sysctl to display available actions seccomp: Add sysctl to configure actions that should be logged seccomp: Create an action to log before allowing seccomp: Add tests for SECCOMP_RET_LOG Documentation/prctl/seccomp_filter.txt | 43 ++++++ Documentation/sysctl/kernel.txt | 1 + include/linux/audit.h | 6 +- include/uapi/linux/seccomp.h | 1 + kernel/seccomp.c | 185 +++++++++++++++++++++++++- tools/testing/selftests/seccomp/seccomp_bpf.c | 94 +++++++++++++ 6 files changed, 322 insertions(+), 8 deletions(-) -- 2.7.4

8 years

5
28
0 / 0

[RFC PATCH] audit: the fix RCU locking for the auditd_connection structure

by Paul Moore

From: Paul Moore <paul(a)paul-moore.com> Cong Wang correctly pointed out that the RCU read locking of the auditd_connection struct was wrong, this patch correct this by adopting a more traditional, and correct RCU locking model. This patch is heavily based on an earlier prototype by Cong Wang. [XXX: Cong Wang, as mentioned previously, I'd like to add your sign-off; please let me know if that is okay with you.] Cc: <stable(a)vger.kernel.org> # 4.11.x-: 264d509637d9 Reported-by: Cong Wang <xiyou.wangcong(a)gmail.com> ??!! -> Signed-off-by: Cong Wang <xiyou.wangcong(a)gmail.com> Signed-off-by: Paul Moore <paul(a)paul-moore.com> --- kernel/audit.c | 157 ++++++++++++++++++++++++++++++++++++-------------------- 1 file changed, 100 insertions(+), 57 deletions(-) diff --git a/kernel/audit.c b/kernel/audit.c index 10bc2bad2adf..a7c6a50477aa 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -112,18 +112,19 @@ struct audit_net { * @pid: auditd PID * @portid: netlink portid * @net: the associated network namespace - * @lock: spinlock to protect write access + * @rcu: RCU head * * Description: * This struct is RCU protected; you must either hold the RCU lock for reading - * or the included spinlock for writing. + * or the associated spinlock for writing. */ static struct auditd_connection { struct pid *pid; u32 portid; struct net *net; - spinlock_t lock; -} auditd_conn; + struct rcu_head rcu; +} *auditd_conn = NULL; +static DEFINE_SPINLOCK(auditd_conn_lock); /* If audit_rate_limit is non-zero, limit the rate of sending audit records * to that number per second. This prevents DoS attacks, but results in @@ -215,9 +216,11 @@ struct audit_reply { int auditd_test_task(struct task_struct *task) { int rc; + struct auditd_connection *ac; rcu_read_lock(); - rc = (auditd_conn.pid && auditd_conn.pid == task_tgid(task) ? 1 : 0); + ac = rcu_dereference(auditd_conn); + rc = (ac && ac->pid == task_tgid(task) ? 1 : 0); rcu_read_unlock(); return rc; @@ -225,22 +228,21 @@ int auditd_test_task(struct task_struct *task) /** * auditd_pid_vnr - Return the auditd PID relative to the namespace - * @auditd: the auditd connection * * Description: - * Returns the PID in relation to the namespace, 0 on failure. This function - * takes the RCU read lock internally, but if the caller needs to protect the - * auditd_connection pointer it should take the RCU read lock as well. + * Returns the PID in relation to the namespace, 0 on failure. */ -static pid_t auditd_pid_vnr(const struct auditd_connection *auditd) +static pid_t auditd_pid_vnr(void) { pid_t pid; + const struct auditd_connection *ac; rcu_read_lock(); - if (!auditd || !auditd->pid) + ac = rcu_dereference(auditd_conn); + if (!ac || !ac->pid) pid = 0; else - pid = pid_vnr(auditd->pid); + pid = pid_vnr(ac->pid); rcu_read_unlock(); return pid; @@ -434,6 +436,24 @@ static int audit_set_failure(u32 state) } /** + * auditd_conn_free - RCU helper to release an auditd connection struct + * @rcu: RCU head + * + * Description: + * Drop any references inside the auditd connection tracking struct and free + * the memory. + */ + static void auditd_conn_free(struct rcu_head *rcu) + { + struct auditd_connection *ac; + + ac = container_of(rcu, struct auditd_connection, rcu); + put_pid(ac->pid); + put_net(ac->net); + kfree(ac); + } + +/** * auditd_set - Set/Reset the auditd connection state * @pid: auditd PID * @portid: auditd netlink portid @@ -441,27 +461,33 @@ static int audit_set_failure(u32 state) * * Description: * This function will obtain and drop network namespace references as - * necessary. + * necessary. Returns zero on success, negative values on failure. */ -static void auditd_set(struct pid *pid, u32 portid, struct net *net) +static int auditd_set(struct pid *pid, u32 portid, struct net *net) { unsigned long flags; + struct auditd_connection *ac_old, *ac_new; - spin_lock_irqsave(&auditd_conn.lock, flags); - if (auditd_conn.pid) - put_pid(auditd_conn.pid); - if (pid) - auditd_conn.pid = get_pid(pid); - else - auditd_conn.pid = NULL; - auditd_conn.portid = portid; - if (auditd_conn.net) - put_net(auditd_conn.net); - if (net) - auditd_conn.net = get_net(net); - else - auditd_conn.net = NULL; - spin_unlock_irqrestore(&auditd_conn.lock, flags); + if (!pid || !net) + return -EINVAL; + + ac_new = kzalloc(sizeof(*ac_new), GFP_KERNEL); + if (!ac_new) + return -ENOMEM; + ac_new->pid = get_pid(pid); + ac_new->portid = portid; + ac_new->net = get_net(net); + + spin_lock_irqsave(&auditd_conn_lock, flags); + ac_old = rcu_dereference_protected(auditd_conn, + lockdep_is_held(&auditd_conn_lock)); + rcu_assign_pointer(auditd_conn, ac_new); + spin_unlock_irqrestore(&auditd_conn_lock, flags); + + if (ac_old) + call_rcu(&ac_old->rcu, auditd_conn_free); + + return 0; } /** @@ -556,13 +582,19 @@ static void kauditd_retry_skb(struct sk_buff *skb) */ static void auditd_reset(void) { + unsigned long flags; struct sk_buff *skb; + struct auditd_connection *ac_old; /* if it isn't already broken, break the connection */ - rcu_read_lock(); - if (auditd_conn.pid) - auditd_set(0, 0, NULL); - rcu_read_unlock(); + spin_lock_irqsave(&auditd_conn_lock, flags); + ac_old = rcu_dereference_protected(auditd_conn, + lockdep_is_held(&auditd_conn_lock)); + rcu_assign_pointer(auditd_conn, NULL); + spin_unlock_irqrestore(&auditd_conn_lock, flags); + + if (ac_old) + call_rcu(&ac_old->rcu, auditd_conn_free); /* flush all of the main and retry queues to the hold queue */ while ((skb = skb_dequeue(&audit_retry_queue))) @@ -588,6 +620,7 @@ static int auditd_send_unicast_skb(struct sk_buff *skb) u32 portid; struct net *net; struct sock *sk; + struct auditd_connection *ac; /* NOTE: we can't call netlink_unicast while in the RCU section so * take a reference to the network namespace and grab local @@ -597,15 +630,15 @@ static int auditd_send_unicast_skb(struct sk_buff *skb) * section netlink_unicast() should safely return an error */ rcu_read_lock(); - if (!auditd_conn.pid) { + ac = rcu_dereference(auditd_conn); + if (!ac) { rcu_read_unlock(); rc = -ECONNREFUSED; goto err; } - net = auditd_conn.net; - get_net(net); + net = get_net(ac->net); sk = audit_get_sk(net); - portid = auditd_conn.portid; + portid = ac->portid; rcu_read_unlock(); rc = netlink_unicast(sk, skb, portid, 0); @@ -740,6 +773,7 @@ static int kauditd_thread(void *dummy) u32 portid = 0; struct net *net = NULL; struct sock *sk = NULL; + struct auditd_connection *ac; #define UNICAST_RETRIES 5 @@ -747,14 +781,14 @@ static int kauditd_thread(void *dummy) while (!kthread_should_stop()) { /* NOTE: see the lock comments in auditd_send_unicast_skb() */ rcu_read_lock(); - if (!auditd_conn.pid) { + ac = rcu_dereference(auditd_conn); + if (!ac) { rcu_read_unlock(); goto main_queue; } - net = auditd_conn.net; - get_net(net); + net = get_net(ac->net); sk = audit_get_sk(net); - portid = auditd_conn.portid; + portid = ac->portid; rcu_read_unlock(); /* attempt to flush the hold queue */ @@ -1117,7 +1151,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) s.failure = audit_failure; /* NOTE: use pid_vnr() so the PID is relative to the current * namespace */ - s.pid = auditd_pid_vnr(&auditd_conn); + s.pid = auditd_pid_vnr(); s.rate_limit = audit_rate_limit; s.backlog_limit = audit_backlog_limit; s.lost = atomic_read(&audit_lost); @@ -1160,7 +1194,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) /* test the auditd connection */ audit_replace(req_pid); - auditd_pid = auditd_pid_vnr(&auditd_conn); + auditd_pid = auditd_pid_vnr(); /* only the current auditd can unregister itself */ if ((!new_pid) && (new_pid != auditd_pid)) { audit_log_config_change("audit_pid", new_pid, @@ -1174,19 +1208,30 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) return -EEXIST; } - if (audit_enabled != AUDIT_OFF) - audit_log_config_change("audit_pid", new_pid, - auditd_pid, 1); - if (new_pid) { /* register a new auditd connection */ - auditd_set(req_pid, NETLINK_CB(skb).portid, - sock_net(NETLINK_CB(skb).sk)); + err = auditd_set(req_pid, + NETLINK_CB(skb).portid, + sock_net(NETLINK_CB(skb).sk)); + if (audit_enabled != AUDIT_OFF) + audit_log_config_change("audit_pid", + new_pid, + auditd_pid, + err ? 0 : 1); + if (err) + return err; + /* try to process any backlog */ wake_up_interruptible(&kauditd_wait); - } else + } else { + if (audit_enabled != AUDIT_OFF) + audit_log_config_change("audit_pid", + new_pid, + auditd_pid, 1); + /* unregister the auditd connection */ auditd_reset(); + } } if (s.mask & AUDIT_STATUS_RATE_LIMIT) { err = audit_set_rate_limit(s.rate_limit); @@ -1454,10 +1499,11 @@ static void __net_exit audit_net_exit(struct net *net) { struct audit_net *aunet = net_generic(net, audit_net_id); - rcu_read_lock(); - if (net == auditd_conn.net) - auditd_reset(); - rcu_read_unlock(); + /* NOTE: you would think that we would want to check the auditd + * connection and potentially reset it here if it lives in this + * namespace, but since the auditd connection tracking struct holds a + * reference to this namespace (see auditd_set()) we are only ever + * going to get here after that connection has been released */ netlink_kernel_release(aunet->sk); } @@ -1481,9 +1527,6 @@ static int __init audit_init(void) sizeof(struct audit_buffer), 0, SLAB_PANIC, NULL); - memset(&auditd_conn, 0, sizeof(auditd_conn)); - spin_lock_init(&auditd_conn.lock); - skb_queue_head_init(&audit_queue); skb_queue_head_init(&audit_retry_queue); skb_queue_head_init(&audit_hold_queue);

8 years

3
5
0 / 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Linux-audit May 2017