4:52 a.m.
Linus has released 2.6.12 and subsequently merged a large batch of audit
patches, so I've re-ordered the patches in the RPM again accordingly.
There's now very little which isn't in the "Linus has this already"
section.
I've done the patch which wait for the backlog to clear in audit.63 with
no other changes in case it's problematic and we want to drop back to
audit.62. I think that Tim and I between us have now addressed just
about everything which was outstanding -- what did we miss?
* Mon Jun 20 2005 David Woodhouse <dwmw2(a)redhat.com> audit.63
- Wait for backlog to drain where possible
* Mon Jun 20 2005 David Woodhouse <dwmw2(a)redhat.com> audit.62
- Fix locking in auditfs_attach_wdata()
- Drop user messages if !audit_enabled
- Avoid auditing auditd in all cases
* Sun Jun 19 2005 David Woodhouse <dwmw2(a)redhat.com> audit.61
- Reorder patches again, merge auditfs patch
- Capture path_lookup() flags in audit_inode()
--
dwmw2
9:17 a.m.
On Mon, 2005-06-20 at 10:52 +0100, David Woodhouse wrote:
* Mon Jun 20 2005 David Woodhouse <dwmw2(a)redhat.com> audit.62
- Fix locking in auditfs_attach_wdata()
- Drop user messages if !audit_enabled
Sorry, I've put a few patches in without also sending them to the
list...
--- linux-2.6.9/kernel/audit.c~ 2005-06-17 16:47:40.000000000 +0100
+++ linux-2.6.9/kernel/audit.c 2005-06-20 00:14:14.000000000 +0100
@@ -446,7 +446,7 @@ static int audit_receive_msg(struct sk_b
if (!tsk)
return -ESRCH;
- if (audit_filter_user(tsk, msg_type)) {
+ if (audit_enabled && audit_filter_user(tsk, msg_type)) {
ab = audit_log_start(NULL, msg_type);
if (ab) {
audit_log_format(ab,
--
dwmw2
9:18 a.m.
On Mon, 2005-06-20 at 10:52 +0100, David Woodhouse wrote:
* Mon Jun 20 2005 David Woodhouse <dwmw2(a)redhat.com> audit.62
- Avoid auditing auditd in all cases
--- linux-2.6.9/kernel/auditsc.c.orig 2005-06-20 00:21:52.000000000 +0100
+++ linux-2.6.9/kernel/auditsc.c 2005-06-20 00:26:05.000000000 +0100
@@ -489,6 +489,9 @@ static enum audit_state audit_filter_sys
int word = AUDIT_WORD(ctx->major);
int bit = AUDIT_BIT(ctx->major);
+ if (audit_pid && ctx->pid == audit_pid)
+ return AUDIT_DISABLED;
+
rcu_read_lock();
list_for_each_entry_rcu(e, list, list) {
if ((e->rule.mask[word] & bit) == bit
@@ -506,6 +509,9 @@ int audit_filter_user(struct task_struct
struct audit_entry *e;
enum audit_state state;
+ if (audit_pid && tsk->pid == audit_pid)
+ return AUDIT_DISABLED;
+
rcu_read_lock();
list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_USER], list) {
if (audit_filter_rules(tsk, &e->rule, NULL, &state)) {
@@ -866,7 +872,7 @@ void audit_free(struct task_struct *tsk)
/* Check for system calls that do not go through the exit
* function (e.g., exit_group), then free context block. */
- if (context->in_syscall && context->auditable && context->pid
!= audit_pid)
+ if (context->in_syscall && context->auditable)
audit_log_exit(context);
audit_free_context(context);
@@ -971,7 +977,7 @@ void audit_syscall_exit(struct task_stru
if (likely(!context))
return;
- if (context->in_syscall && context->auditable && context->pid
!= audit_pid)
+ if (context->in_syscall && context->auditable)
audit_log_exit(context);
context->in_syscall = 0;
--
dwmw2
9:19 a.m.
On Mon, 2005-06-20 at 10:52 +0100, David Woodhouse wrote:
--
dwmw2
* Sun Jun 19 2005 David Woodhouse <dwmw2(a)redhat.com> audit.61
- Capture path_lookup() flags in audit_inode()
We capture the flags which may include LOOKUP_PARENT and hence indicate
the the inode being reported is actually the _parent_ of the requested
path.
--- linux-2.6.9/./fs/namei.c~ 2005-06-17 15:19:09.000000000 +0100
+++ linux-2.6.9/./fs/namei.c 2005-06-19 20:09:34.000000000 +0100
@@ -968,7 +968,7 @@ int fastcall path_lookup(const char *nam
out:
if (unlikely(current->audit_context
&& nd && nd->dentry && nd->dentry->d_inode))
- audit_inode(name, nd->dentry->d_inode);
+ audit_inode(name, nd->dentry->d_inode, flags);
return retval;
}
--- linux-2.6.9/./include/linux/audit.h~ 2005-06-19 18:53:58.000000000 +0100
+++ linux-2.6.9/./include/linux/audit.h 2005-06-19 20:10:41.000000000 +0100
@@ -271,7 +271,7 @@ extern void audit_syscall_entry(struct t
extern void audit_syscall_exit(struct task_struct *task, int failed, long return_code);
extern void audit_getname(const char *name);
extern void audit_putname(const char *name);
-extern void audit_inode(const char *name, const struct inode *inode);
+extern void audit_inode(const char *name, const struct inode *inode, unsigned flags);
/* Private API (for audit.c only) */
extern int audit_receive_filter(int type, int pid, int uid, int seq,
@@ -294,7 +294,7 @@ extern int audit_filter_user(struct task
#define audit_syscall_exit(t,f,r) do { ; } while (0)
#define audit_getname(n) do { ; } while (0)
#define audit_putname(n) do { ; } while (0)
-#define audit_inode(n,i) do { ; } while (0)
+#define audit_inode(n,i,f) do { ; } while (0)
#define auditsc_get_stamp(c,t,s) do { BUG(); } while (0)
#define audit_receive_filter(t,p,u,s,d,l) ({ -EOPNOTSUPP; })
#define audit_get_loginuid(c) ({ -1; })
--- linux-2.6.9/./kernel/auditsc.c~ 2005-06-19 18:53:58.000000000 +0100
+++ linux-2.6.9/./kernel/auditsc.c 2005-06-19 20:28:08.000000000 +0100
@@ -95,6 +95,7 @@ struct audit_names {
uid_t uid;
gid_t gid;
dev_t rdev;
+ unsigned flags;
};
struct audit_aux_data {
@@ -833,6 +834,8 @@ static void audit_log_exit(struct audit_
audit_log_format(ab, "name=");
audit_log_untrustedstring(ab, context->names[i].name);
}
+ audit_log_format(ab, " flags=%x\n", context->names[i].flags);
+
if (context->names[i].ino != (unsigned long)-1)
audit_log_format(ab, " inode=%lu dev=%02x:%02x mode=%#o"
" ouid=%u ogid=%u rdev=%02x:%02x",
@@ -1058,7 +1061,7 @@ EXPORT_SYMBOL(audit_putname);
/* Store the inode and device from a lookup. Called from
* fs/namei.c:path_lookup(). */
-void audit_inode(const char *name, const struct inode *inode)
+void audit_inode(const char *name, const struct inode *inode, unsigned flags)
{
int idx;
struct audit_context *context = current->audit_context;
@@ -1084,12 +1087,13 @@ void audit_inode(const char *name, const
++context->ino_count;
#endif
}
- context->names[idx].ino = inode->i_ino;
- context->names[idx].dev = inode->i_sb->s_dev;
- context->names[idx].mode = inode->i_mode;
- context->names[idx].uid = inode->i_uid;
- context->names[idx].gid = inode->i_gid;
- context->names[idx].rdev = inode->i_rdev;
+ context->names[idx].flags = flags;
+ context->names[idx].ino = inode->i_ino;
+ context->names[idx].dev = inode->i_sb->s_dev;
+ context->names[idx].mode = inode->i_mode;
+ context->names[idx].uid = inode->i_uid;
+ context->names[idx].gid = inode->i_gid;
+ context->names[idx].rdev = inode->i_rdev;
}
void auditsc_get_stamp(struct audit_context *ctx,
3:53 p.m.
On Monday 20 June 2005 10:19, David Woodhouse wrote:
We capture the flags which may include LOOKUP_PARENT and hence
indicate
the the inode being reported is actually the _parent_ of the requested
path.
What is the flags? Where do I find info about it? Parsers need to know.
-Steve
10:09 a.m.
On Monday 20 June 2005 05:52, David Woodhouse wrote:
I think that Tim and I between us have now addressed just
about everything which was outstanding -- what did we miss?
There is something new that I noticed...all the SYSCALL messages have items=1.
It didn't used to be this way. It used to be the number of aux records
associated with the syscall event.
-Steve
10:16 a.m.
On Mon, 2005-06-20 at 11:09 -0400, Steve Grubb wrote:
There is something new that I noticed...all the SYSCALL messages have
items=1.
It didn't used to be this way. It used to be the number of aux records
associated with the syscall event.
It's always been the number of _names_ associated with the syscall,
hasn't it? Try sys_rename().
--
dwmw2
12:42 p.m.
with 2.6.9-11.EL.audit.63smp and audit-0.9.10-1 this script causes a
repeatable oops:
#!/bin/bash -x
FILE_NAME=`mktemp /tmp/test_append.XXXXXX`
auditctl -w ${FILE_NAME} -k fk_test_append_r -p r
auditctl -w ${FILE_NAME} -k fk_test_append_w -p w
auditctl -w ${FILE_NAME} -k fk_test_append_x -p x
echo "test" >> ${FILE_NAME}
Jun 20 13:23:12 localhost kernel: ------------[ cut here ]------------
Jun 20 13:23:12 localhost kernel: kernel BUG at
include/asm/spinlock.h:109!
Jun 20 13:23:12 localhost kernel: invalid operand: 0000 [#1]
Jun 20 13:23:12 localhost kernel: SMP
Jun 20 13:23:12 localhost kernel: Modules linked in: i2c_dev i2c_core
ipt_REJECT ipt_state ip_conntrack iptable_filter ip_tables dm_mod button
battery ac joydev uhci_hcd ehci_hcd hw_random snd_intel8x0
snd_ac97_codec snd_pcm_oss snd_mixer_oss snd_pcm snd_timer
snd_page_alloc snd_mpu401_uart snd_rawmidi snd_seq_device snd soundcore
sk98lin floppy ext3 jbd i2o_block i2o_core sd_mod scsi_mod
Jun 20 13:23:12 localhost kernel: CPU: 1
Jun 20 13:23:12 localhost kernel: EIP: 0060:[<c02c905a>] Not
tainted VLI
Jun 20 13:23:12 localhost kernel: EFLAGS: 00010202
(2.6.9-11.EL.audit.63smp)
Jun 20 13:23:12 localhost kernel: EIP is at _spin_unlock+0x1c/0x27
Jun 20 13:23:12 localhost kernel: eax: 00000001 ebx: ca721c50 ecx:
ca721c01 edx: c031dc48
Jun 20 13:23:12 localhost kernel: esi: 00000000 edi: c1744a50 ebp:
cae20898 esp: cf5b2ec4
Jun 20 13:23:12 localhost kernel: ds: 007b es: 007b ss: 0068
Jun 20 13:23:12 localhost kernel: Process test-append.sh (pid: 5057,
threadinfo=cf5b2000 task=c90ea230)
Jun 20 13:23:12 localhost kernel: Stack: c013c753 c5e53a74 0000000a
cbbff918 cad06c00 cbbff90c cad06c00 0000000a
Jun 20 13:23:12 localhost kernel: cf5b2f58 c013d931 cad06c00
cad06c00 0000000a c0163db8 cad06c00 00008442
Jun 20 13:23:12 localhost kernel: cf5b2f58 0000000a c0165521
c43019e8 ffffffeb cea320fc ceafe9e8 cf5b2f58
Jun 20 13:23:12 localhost kernel: Call Trace:
Jun 20 13:23:12 localhost kernel: [<c013c753>] auditfs_attach_wdata
+0x122/0x1e8
Jun 20 13:23:12 localhost kernel: [<c013d931>] audit_notify_watch
+0x47/0x56
Jun 20 13:23:12 localhost kernel: [<c0163db8>] permission+0xf/0x4f
Jun 20 13:23:12 localhost kernel: [<c0165521>] may_open+0x53/0x21a
Jun 20 13:23:12 localhost kernel: [<c0165995>] open_namei+0x2ad/0x5b5
Jun 20 13:23:12 localhost kernel: [<c0158042>] filp_open+0x23/0x3c
Jun 20 13:23:12 localhost kernel: [<c02c8a6b>] __cond_resched+0x14/0x39
Jun 20 13:23:12 localhost kernel: [<c01bb402>] direct_strncpy_from_user
+0x3e/0x5d
Jun 20 13:23:12 localhost kernel: [<c0158354>] sys_open+0x31/0x7d
Jun 20 13:23:12 localhost kernel: [<c02ca463>] syscall_call+0x7/0xb
Jun 20 13:23:12 localhost kernel: Code: b9 2d c0 f0 83 28 01 79 05 e8 5b
ee ff ff c3 81 78 04 ad 4e ad de 89 c2 b1 01 74 08 0f 0b 6c 00 c3 b9 2d
c0 0f b6 02 84 c0 7e 08 <0f> 0b 6d 00 c3 b9 2d c0 86 0a c3 f0 81 00 00
00 00 01 c3 f0 ff
Jun 20 13:23:12 localhost kernel: <0>Fatal exception: panic in 5
seconds
rob.
1:37 p.m.
On Mon, 2005-06-20 at 13:42 -0400, Rob Myers wrote:
Jun 20 13:23:12 localhost kernel: kernel BUG at
include/asm/spinlock.h:109!
Trying to unlock a spinlock which isn't locked. Which is hardly
surprising. Will fix in audit.64 build which is just starting...
@@ -1262,8 +1306,10 @@ void auditfs_attach_wdata(struct inode *
winfo = kmalloc(sizeof(struct audit_watch_info), GFP_KERNEL);
if (!winfo)
goto auditfs_attach_wdata_fail;
- if (mask && (watch->w_perms &&
!(watch->w_perms&mask)))
+ if (mask && (watch->w_perms &&
!(watch->w_perms&mask))) {
+ spin_lock(&auditfs_lock);
continue;
+ }
winfo->watch = audit_watch_get(watch);
hlist_add_head(&winfo->node, &ax->watches);
spin_lock(&auditfs_lock);
--
dwmw2
1:43 p.m.
[resend without word wrap]
with 2.6.9-11.EL.audit.63smp and audit-0.9.10-1 this script causes a
repeatable oops:
#!/bin/bash -x
FILE_NAME=`mktemp /tmp/test_append.XXXXXX`
auditctl -w ${FILE_NAME} -k fk_test_append_r -p r
auditctl -w ${FILE_NAME} -k fk_test_append_w -p w
auditctl -w ${FILE_NAME} -k fk_test_append_x -p x
echo "test" >> ${FILE_NAME}
Jun 20 13:23:12 localhost kernel: ------------[ cut here ]------------
Jun 20 13:23:12 localhost kernel: kernel BUG at include/asm/spinlock.h:109!
Jun 20 13:23:12 localhost kernel: invalid operand: 0000 [#1]
Jun 20 13:23:12 localhost kernel: SMP
Jun 20 13:23:12 localhost kernel: Modules linked in: i2c_dev i2c_core ipt_REJECT ipt_state
ip_conntrack iptable_filter ip_tables dm_mod button battery ac joydev uhci_hcd ehci_hcd
hw_random snd_intel8x0 snd_ac97_codec snd_pcm_oss snd_mixer_oss snd_pcm snd_timer
snd_page_alloc snd_mpu401_uart snd_rawmidi snd_seq_device snd soundcore sk98lin floppy
ext3 jbd i2o_block i2o_core sd_mod scsi_mod
Jun 20 13:23:12 localhost kernel: CPU: 1
Jun 20 13:23:12 localhost kernel: EIP: 0060:[<c02c905a>] Not tainted VLI
Jun 20 13:23:12 localhost kernel: EFLAGS: 00010202 (2.6.9-11.EL.audit.63smp)
Jun 20 13:23:12 localhost kernel: EIP is at _spin_unlock+0x1c/0x27
Jun 20 13:23:12 localhost kernel: eax: 00000001 ebx: ca721c50 ecx: ca721c01 edx:
c031dc48
Jun 20 13:23:12 localhost kernel: esi: 00000000 edi: c1744a50 ebp: cae20898 esp:
cf5b2ec4
Jun 20 13:23:12 localhost kernel: ds: 007b es: 007b ss: 0068
Jun 20 13:23:12 localhost kernel: Process test-append.sh (pid: 5057, threadinfo=cf5b2000
task=c90ea230)
Jun 20 13:23:12 localhost kernel: Stack: c013c753 c5e53a74 0000000a cbbff918 cad06c00
cbbff90c cad06c00 0000000a
Jun 20 13:23:12 localhost kernel: cf5b2f58 c013d931 cad06c00 cad06c00 0000000a
c0163db8 cad06c00 00008442
Jun 20 13:23:12 localhost kernel: cf5b2f58 0000000a c0165521 c43019e8 ffffffeb
cea320fc ceafe9e8 cf5b2f58
Jun 20 13:23:12 localhost kernel: Call Trace:
Jun 20 13:23:12 localhost kernel: [<c013c753>] auditfs_attach_wdata+0x122/0x1e8
Jun 20 13:23:12 localhost kernel: [<c013d931>] audit_notify_watch+0x47/0x56
Jun 20 13:23:12 localhost kernel: [<c0163db8>] permission+0xf/0x4f
Jun 20 13:23:12 localhost kernel: [<c0165521>] may_open+0x53/0x21a
Jun 20 13:23:12 localhost kernel: [<c0165995>] open_namei+0x2ad/0x5b5
Jun 20 13:23:12 localhost kernel: [<c0158042>] filp_open+0x23/0x3c
Jun 20 13:23:12 localhost kernel: [<c02c8a6b>] __cond_resched+0x14/0x39
Jun 20 13:23:12 localhost kernel: [<c01bb402>] direct_strncpy_from_user+0x3e/0x5d
Jun 20 13:23:12 localhost kernel: [<c0158354>] sys_open+0x31/0x7d
Jun 20 13:23:12 localhost kernel: [<c02ca463>] syscall_call+0x7/0xb
Jun 20 13:23:12 localhost kernel: Code: b9 2d c0 f0 83 28 01 79 05 e8 5b ee ff ff c3 81 78
04 ad 4e ad de 89 c2 b1 01 74 08 0f 0b 6c 00 c3 b9 2d c0 0f b6 02 84 c0 7e 08 <0f>
0b 6d 00 c3 b9 2d c0 86 0a c3 f0 81 00 00 00 00 01 c3 f0 ff
Jun 20 13:23:12 localhost kernel: <0>Fatal exception: panic in 5 seconds
7125
days inactive
7125
days old
linux-audit@lists.linux-audit.osci.io
9 comments
3 participants
participants (3)
-
David Woodhouse -
Rob Myers -
Steve Grubb