Re: Sycall Rules vs Watch Rules
On Wednesday, September 20, 2023 2:45:26 PM EDT Steve Grubb wrote:
On Tuesday, September 19, 2023 8:26:04 PM EDT Amjad Gabbar wrote:
> > The perm fields select the right system calls
> > that should be reported on.
>
> That is accurate from a functional perspective. There is no change in the
> events logged. But there is a difference in performance. This is most
> evident for syscalls not part of the perm fields.
<snip>
> If we look at the performance numbers for the file rules as is, the
> auditing percentage is about 14%.
>
> Now if we were to just add the specific syscalls that the perm fields
> filter on in the rules file, the auditing percentage would drop to around
> 2%.
I think I am mis-remembering something, or there was a change way back in
the beginning. The plan was that we could optimize access by letting the
kernel pick the relevant syscalls based on the permissions. User space
would just define the permissions and the kernel would make it so.
But there were several redesigns of the file auditing. I looked back as far
as the 3.1 kernel and it always follows lookup the syscall, if it's
relevant, then check the rest of the fields in the rule. This eventually
checks the set of syscalls selected by the perms.
The way that it should have worked is when perms is given, throw away any
syscalls and set the mask based on the perms selected. That would have been
optimal and it was what Al Viro and I talked about long ago. However, it
went through several redesigns.
I did some digging. This is the original patch:
https://listman.redhat.com/archives/linux-audit/2006-August/003593.html
Al does mention that syscalls taking a descriptor should not be included. I
guess that can be cleaned up in the include/asm-generic/audit_*.h files.
I think that patch would have landed in the 2.6.18 kernel. I found a 2.6.21
kernel and the path taken is different:
audit_syscall_exit
audit_get_context
audit_filter_inodes <--- this is where it differs
audit_filter_rules
audit_match_perm
In the old kernel, it still called the syscall filter. But I think that was
optimized later. But the whole point of making the perms field was so that
user space could just tell the kernel what it needs and the kernel would
select exactly the syscalls needed. There was no other reason to have it.
Now, what to do about it? A watch was biarch. There were 2 tables for 32 & 64
bits and it would swing between them based on the syscall's arch. To fix this
in user space would mean a watch would have to create 2 rules to cover
biarch. And some systems conceivably may not have 32 bit enabled or vice
versa. There would be no way for user space to know and work around a missing
arch.
The -w notation really can't be optimized. It doesn't specify an arch so it
has to be "all". I guess we can warn on that to rewrite in syscall notation.
-Steve
The problem now is that user space has no list of syscalls that match
each
permission. And then, there's no good way to sync based on mixing and
matching kernels and user space. The kernel may have an updated syscall
list user space doesn't know about and vice versa.
I think you are on to something important. But I am surprised my concept of
how it works doesn't match the implementation. (Al Viro did the original
implementation way back around 2006/7.) The best solution would be a
kernel modification so that there are no mismatched lists. A suboptimal
solution would be to maintain 2 lists and hope they don't change. Which by
the way, I think the kernel lists are outdated again. (Syscalls keep
getting added - quotactl_fd for example)
-Steve
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit