Re: [PATCH] audit: Report suspicious O_CREAT usage

This renames the very specific audit_log_link_denied() to audit_log_path_denied() and adds the AUDIT_* type as an argument. This allows for the creation of the new AUDIT_ANOM_CREAT that can be used to report the fifo/regular file creation restrictions that were introduced in commit 30aba6656f61 ("namei: allow restricted O_CREAT of FIFOs and regular files"). Without this change, discovering that the restriction is enabled can be very challenging: https://lore.kernel.org/lkml/CA+jJMxvkqjXHy3DnV5MVhFTL2RUhg0WQ-XVFW3ngDQO... Reported-by: Jérémie Galarneau <jeremie.galarneau(a)efficios.com&gt; Signed-off-by: Kees Cook <keescook(a)chromium.org&gt; --- This is not a complete fix because reporting was broken in commit 15564ff0a16e ("audit: make ANOM_LINK obey audit_enabled and audit_dummy_context") which specifically goes against the intention of these records: they should _always_ be reported. If auditing isn't enabled, they should be ratelimited. Instead of using audit, should this just go back to using pr_ratelimited()? --- fs/namei.c | 7 +++++-- include/linux/audit.h | 5 +++-- include/uapi/linux/audit.h | 1 + kernel/audit.c | 11 ++++++----- 4 files changed, 15 insertions(+), 9 deletions(-)

diff --git a/fs/namei.c b/fs/namei.c index 671c3c1a3425..0e60f81e1d5a 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -1031,6 +1031,9 @@ static int may_create_in_sticky(struct dentry * const dir, (dir->d_inode->i_mode & 0020 && ((sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) || (sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode))))) { + audit_log_path_denied(AUDIT_ANOM_CREAT, + S_ISFIFO(inode->i_mode) ? "fifo" + : "regular"); return -EACCES;

diff --git a/include/linux/audit.h b/include/linux/audit.h index aee3dc9eb378..b3715e2ee1c5 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -217,7 +218,7 @@ static inline void audit_log_d_path(struct audit_buffer *ab, { } static inline void audit_log_key(struct audit_buffer *ab, char *key) { } -static inline void audit_log_link_denied(const char *string) +static inline void audit_log_path_denied(int type, const char *string); { }