5 p.m.
Here's the userspace patch for audit-0.6.5 -- It doesn't work as is.
To get this working I had to make a directory audit-0.6.5/linux and cp
/ ln -s audit.h into it. The patch should do this for you. However,
you will have to 'install -m 0644 lib/libaudit.h audit-0.6.5/'
yourself.
cd audit-0.6.5/
autoreconf -fv --install
./configure --sbindir=/path/to/sbin --libdir=/lib --with-pam=yes/no
install -m 0644 lib/libaudit.h .
make
It's probably just best to not "make install" and just cd src/ and run
auditctl from there for testing the auditfs kernel piece. I'm hoping
that some form of this code will eventually be integrated into the
userspace tool.
So please break..er test my code :)
--
- Timothy R. Chavez
8:29 a.m.
On Monday 07 March 2005 18:00, Timothy R. Chavez wrote:
Here's the userspace patch for audit-0.6.5 -- It doesn't work
as is.
So please break..er test my code :)
Shouldn't these defines come from the kernel header?
diff -Nurp audit-0.6.5/src/auditctl.c audit-0.6.5-scratch/src/auditctl.c
--- audit-0.6.5/src/auditctl.c 2005-03-03 10:11:00.000000000 -0600
+++ audit-0.6.5-scratch/src/auditctl.c 2005-03-07 15:56:19.000000000 -0600
@@ -49,6 +49,14 @@
*/
#define LINE_SIZE 1600
+#define WATCH_MAY_EXEC 1
+#define WATCH_MAY_WRITE 2
+#define WATCH_MAY_READ 4
+#define WATCH_MAY_APPEND 8
+
+#define WATCH_NAME 1
+#define WATCH_FILTERKEY 2
+#define WATCH_PERMS 3
Also, just a little design comment, do we really need to have an enable for fs
auditing? Isn't there an implicit enabling by virtue of either having watches
or not having them?
Also, should there be a #ifdef CONFIG_AUDITFILESYSTEM? Shouldn't it be part of
the audit system? The audit ipc patch, for example, didn't declare itself
separately configurable.
-Steve
9:14 a.m.
On Tue, 8 Mar 2005 09:29:19 -0500, Steve Grubb <sgrubb(a)redhat.com> wrote:
On Monday 07 March 2005 18:00, Timothy R. Chavez wrote:
> Here's the userspace patch for audit-0.6.5 -- It doesn't work as is.
>
> So please break..er test my code :)
Shouldn't these defines come from the kernel header?
diff -Nurp audit-0.6.5/src/auditctl.c audit-0.6.5-scratch/src/auditctl.c
--- audit-0.6.5/src/auditctl.c 2005-03-03 10:11:00.000000000 -0600
+++ audit-0.6.5-scratch/src/auditctl.c 2005-03-07 15:56:19.000000000 -0600
@@ -49,6 +49,14 @@
*/
#define LINE_SIZE 1600
+#define WATCH_MAY_EXEC 1
+#define WATCH_MAY_WRITE 2
+#define WATCH_MAY_READ 4
+#define WATCH_MAY_APPEND 8
+
+#define WATCH_NAME 1
+#define WATCH_FILTERKEY 2
+#define WATCH_PERMS 3
Also, just a little design comment, do we really need to have an enable for fs
auditing? Isn't there an implicit enabling by virtue of either having watches
or not having them?
Also, should there be a #ifdef CONFIG_AUDITFILESYSTEM? Shouldn't it be part of
the audit system? The audit ipc patch, for example, didn't declare itself
separately configurable.
-Steve
The bottom define's are simply used by the audit_watch_setup function
in userspace to figure out what part of the watch to setup. There's
no reason for them to be in the kernel. . The auditfs piece does not
use the top four macros at all so I see no reason for them to be in
kernel space either. These values come from include/linux/fs.h and I
thought it'd be easiest just to mirror them in userspace by copying
them over.
--
Linux-audit mailing list
Linux-audit(a)redhat.com
http://www.redhat.com/mailman/listinfo/linux-audit
--
- Timothy R. Chavez
10:35 a.m.
On Tuesday 08 March 2005 10:14, Timothy R. Chavez wrote:
These values come from include/linux/fs.h and I thought it'd be
easiest
just to mirror them in userspace by copying them over.
I don't think its a good idea to mirror them. We'll move them to the right
place and fix the includes.
But there's still a question from the last note...do we need a fs_enable? We
don't have a rule enable. Its either got rules and produces output or it
doesn't. (Ignore the fact that SE Linux avc messages get sent even with no
rules.)
In auditsc.c is this chunk of code:
+ if (!auditfs_enabled)
+ return;
+
+ list_for_each_entry(file, &context->wtrail, list) {
+ ab = audit_log_start(context);
+ if (!ab)
+ continue;
list_for_each_entry should avoid the loop if there's no rules. Therefore its
less efficient to add a check for auditfs_enabled.
+ audit_log_format(ab,
+ "name=%s filter_key=%s perm_mask=%u perm=%d inode=%lu "
+ "inode_mode=%d inode_uid=%d inode_gid=%d "
+ "inode_dev=%02x:%02x inode_rdev=%02x:%02x",
+ file->wentry->w_watch->name,
+ file->wentry->w_watch->filterkey,
+ file->wentry->w_watch->perms,
+ file->mask, file->ino, file->mode, file->uid,
+ file->gid, MAJOR(file->dev), MINOR(file->dev),
+ MAJOR(file->rdev), MINOR(file->rdev));
Are perm_mask & perm variables in the wrong order?
I have questions about audit_wentry_free - shouldn't wentry be zero'ed when
its free instead of pointing to freed memory? I see a lot of code that
branches if wentry is non-zero. Is the way freeing works racy? Is the list
locked (I think I see 2 different locks)? Can other threads try to reference
a partially deleted audit_wentry?
What about the name audit_wentry_put? How about audit_wentry_decr_ref? put
sounds like a name that is inserting things, not potentially freeing them.
Since it sometimes frees things, doesn't this leak memory:
+ audit_wentry_put(data->wentry);
+ data->wentry = NULL;
The zeroing should be atomic and in sync with reference counts.
-Steve
7229
days inactive
7230
days old
linux-audit@lists.linux-audit.osci.io
3 comments
2 participants
participants (2)
-
Steve Grubb -
Timothy R. Chavez