Re: [RFC PATCH v9 08/16] ipe: add permissive toggle

From: Deven Bowers <deven.desai(a)linux.microsoft.com&gt; IPE, like SELinux, supports a permissive mode. This mode allows policy authors to test and evaluate IPE policy without it effecting their programs. When the mode is changed, a 1404 AUDIT_MAC_STATUS be reported. This patch adds the following audit records: audit: MAC_STATUS permissive=1 auid=4294967295 ses=4294967295 lsm=ipe res=1 audit: MAC_STATUS permissive=0 auid=4294967295 ses=4294967295 lsm=ipe res=1 These records are emitted within the following events: audit: MAC_STATUS permissive=1 auid=4294967295 ses=4294967295 lsm=ipe res=1 audit[185]: SYSCALL arch=c000003e syscall=1 success=yes exit=2 a0=1 a1=56308bb3ecc0 a2=2 a3=7f290fdc53e0 items=0 ppid=183 pid=185 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=4294967295 comm="bash" exe="/usr/bin/bash" key=(null) audit: PROCTITLE proctitle="-bash" audit: MAC_STATUS permissive=0 auid=4294967295 ses=4294967295 lsm=ipe res=1 audit[185]: SYSCALL arch=c000003e syscall=1 success=yes exit=2 a0=1 a1=56308bb3ecc0 a2=2 a3=7f290fdc53e0 items=0 ppid=183 pid=185 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=4294967295 comm="bash" exe="/usr/bin/bash" key=(null) audit: PROCTITLE proctitle="-bash" Implying user used bash to toggle the switch. Signed-off-by: Deven Bowers <deven.desai(a)linux.microsoft.com&gt; Signed-off-by: Fan Wu <wufan(a)linux.microsoft.com&gt;

--- security/ipe/audit.c | 36 +++++++++++++++++++++++ security/ipe/audit.h | 1 + security/ipe/eval.c | 9 ++++++ security/ipe/eval.h | 1 + security/ipe/fs.c | 69 ++++++++++++++++++++++++++++++++++++++++++-- 5 files changed, 114 insertions(+), 2 deletions(-) diff --git a/security/ipe/audit.c b/security/ipe/audit.c index 295e9f9f5146..ff74026a595f 100644 --- a/security/ipe/audit.c +++ b/security/ipe/audit.c @@ -194,3 +194,39 @@ void ipe_audit_policy_load(const struct ipe_policy *const p) audit_log_end(ab); } + +/** + * ipe_audit_enforce - Audit a change in IPE's enforcement state. + */ +void ipe_audit_enforce(void) +{ + struct audit_buffer *ab; + + ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_MAC_STATUS); + if (!ab) + return; + + audit_log_format(ab, "permissive=%d", !READ_ONCE(enforce)); + audit_log_format(ab, " auid=%u ses=%u lsm=ipe res=1", + from_kuid(&init_user_ns, audit_get_loginuid(current)), + audit_get_sessionid(current)); + + audit_log_end(ab); +}

+/** + * emit_enforcement - Emit the enforcement state of IPE started with. + * + * Return: + * 0 - Always + */ +static int emit_enforcement(void) +{ + if (!ipe_enabled) + return -EOPNOTSUPP; + + ipe_audit_enforce(); + return 0; +} + +late_initcall(emit_enforcement);