[PATCH] audit=0 appears not to completely disable auditing
by Steve Grubb
Hi,
There was a bz, 231371, reporting that current upstream kernels do not completely
disable auditing when boot with audit=0 and the audit daemon not configured to
run. You can reproduce the problem by:
service auditd stop
auditctl -e 0
auditctl -w /etc/passwd
and you'd get an event in syslog:
Mar 9 15:43:04 localhost kernel: audit(1173472984.321:982): auid=4294967295
subj=user_u:system_r:auditctl_t:s0 op=add rule key=(null) list=4 res=1
The patch below solves this problem by checking audit_enabled before creating
an audit event.
Signed-off-by: Steve Grubb <sgrubb(a)redhat.com>
diff -urp linux-2.6.18.x86_64.orig/kernel/audit.c linux-2.6.18.x86_64/kernel/audit.c
--- linux-2.6.18.x86_64.orig/kernel/audit.c 2007-03-09 14:08:18.000000000 -0500
+++ linux-2.6.18.x86_64/kernel/audit.c 2007-03-09 14:06:59.000000000 -0500
@@ -238,46 +238,50 @@ void audit_log_lost(const char *message)
static int audit_set_rate_limit(int limit, uid_t loginuid, u32 sid)
{
- int old = audit_rate_limit;
+ if (audit_enabled) {
+ int old = audit_rate_limit;
- if (sid) {
- char *ctx = NULL;
- u32 len;
- int rc;
- if ((rc = selinux_ctxid_to_string(sid, &ctx, &len)))
- return rc;
- else
- audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
+ if (sid) {
+ char *ctx = NULL;
+ u32 len;
+ int rc;
+ if ((rc = selinux_ctxid_to_string(sid, &ctx, &len)))
+ return rc;
+ else
+ audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
"audit_rate_limit=%d old=%d by auid=%u subj=%s",
- limit, old, loginuid, ctx);
- kfree(ctx);
- } else
- audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
- "audit_rate_limit=%d old=%d by auid=%u",
- limit, old, loginuid);
+ limit, old, loginuid, ctx);
+ kfree(ctx);
+ } else
+ audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
+ "audit_rate_limit=%d old=%d by auid=%u",
+ limit, old, loginuid);
+ }
audit_rate_limit = limit;
return 0;
}
static int audit_set_backlog_limit(int limit, uid_t loginuid, u32 sid)
{
- int old = audit_backlog_limit;
+ if (audit_enabled) {
+ int old = audit_backlog_limit;
- if (sid) {
- char *ctx = NULL;
- u32 len;
- int rc;
- if ((rc = selinux_ctxid_to_string(sid, &ctx, &len)))
- return rc;
- else
- audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
+ if (sid) {
+ char *ctx = NULL;
+ u32 len;
+ int rc;
+ if ((rc = selinux_ctxid_to_string(sid, &ctx, &len)))
+ return rc;
+ else
+ audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
"audit_backlog_limit=%d old=%d by auid=%u subj=%s",
- limit, old, loginuid, ctx);
- kfree(ctx);
- } else
- audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
- "audit_backlog_limit=%d old=%d by auid=%u",
- limit, old, loginuid);
+ limit, old, loginuid, ctx);
+ kfree(ctx);
+ } else
+ audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
+ "audit_backlog_limit=%d old=%d by auid=%u",
+ limit, old, loginuid);
+ }
audit_backlog_limit = limit;
return 0;
}
@@ -289,21 +293,23 @@ static int audit_set_enabled(int state,
if (state != 0 && state != 1)
return -EINVAL;
- if (sid) {
- char *ctx = NULL;
- u32 len;
- int rc;
- if ((rc = selinux_ctxid_to_string(sid, &ctx, &len)))
- return rc;
- else
- audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
+ if (audit_enabled || state) {
+ if (sid) {
+ char *ctx = NULL;
+ u32 len;
+ int rc;
+ if ((rc = selinux_ctxid_to_string(sid, &ctx, &len)))
+ return rc;
+ else
+ audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
"audit_enabled=%d old=%d by auid=%u subj=%s",
- state, old, loginuid, ctx);
- kfree(ctx);
- } else
- audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
- "audit_enabled=%d old=%d by auid=%u",
- state, old, loginuid);
+ state, old, loginuid, ctx);
+ kfree(ctx);
+ } else
+ audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
+ "audit_enabled=%d old=%d by auid=%u",
+ state, old, loginuid);
+ }
audit_enabled = state;
return 0;
}
@@ -317,21 +323,23 @@ static int audit_set_failure(int state,
&& state != AUDIT_FAIL_PANIC)
return -EINVAL;
- if (sid) {
- char *ctx = NULL;
- u32 len;
- int rc;
- if ((rc = selinux_ctxid_to_string(sid, &ctx, &len)))
- return rc;
- else
- audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
+ if (audit_enabled) {
+ if (sid) {
+ char *ctx = NULL;
+ u32 len;
+ int rc;
+ if ((rc = selinux_ctxid_to_string(sid, &ctx, &len)))
+ return rc;
+ else
+ audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
"audit_failure=%d old=%d by auid=%u subj=%s",
- state, old, loginuid, ctx);
- kfree(ctx);
- } else
- audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
- "audit_failure=%d old=%d by auid=%u",
- state, old, loginuid);
+ state, old, loginuid, ctx);
+ kfree(ctx);
+ } else
+ audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
+ "audit_failure=%d old=%d by auid=%u",
+ state, old, loginuid);
+ }
audit_failure = state;
return 0;
}
@@ -536,22 +544,26 @@ static int audit_receive_msg(struct sk_b
if (err < 0) return err;
}
if (status_get->mask & AUDIT_STATUS_PID) {
- int old = audit_pid;
- if (sid) {
- if ((err = selinux_ctxid_to_string(
- sid, &ctx, &len)))
- return err;
- else
+ if (audit_enabled) {
+ int old = audit_pid;
+ if (sid) {
+ if ((err = selinux_ctxid_to_string(
+ sid, &ctx, &len)))
+ return err;
+ else
+ audit_log(NULL, GFP_KERNEL,
+ AUDIT_CONFIG_CHANGE,
+ "audit_pid=%d old=%d by auid=%u subj=%s",
+ status_get->pid, old,
+ loginuid, ctx);
+ kfree(ctx);
+ } else
audit_log(NULL, GFP_KERNEL,
AUDIT_CONFIG_CHANGE,
- "audit_pid=%d old=%d by auid=%u subj=%s",
- status_get->pid, old,
- loginuid, ctx);
- kfree(ctx);
- } else
- audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
"audit_pid=%d old=%d by auid=%u",
- status_get->pid, old, loginuid);
+ status_get->pid, old,
+ loginuid);
+ }
audit_pid = status_get->pid;
}
if (status_get->mask & AUDIT_STATUS_RATE_LIMIT)
diff -urp linux-2.6.18.x86_64.orig/kernel/auditfilter.c linux-2.6.18.x86_64/kernel/auditfilter.c
--- linux-2.6.18.x86_64.orig/kernel/auditfilter.c 2007-03-09 14:08:18.000000000 -0500
+++ linux-2.6.18.x86_64/kernel/auditfilter.c 2007-03-09 14:05:54.000000000 -0500
@@ -95,6 +95,8 @@ extern struct inotify_handle *audit_ih;
/* Inotify events we care about. */
#define AUDIT_IN_WATCH IN_MOVE|IN_CREATE|IN_DELETE|IN_DELETE_SELF|IN_MOVE_SELF
+extern int audit_enabled;
+
void audit_free_parent(struct inotify_watch *i_watch)
{
struct audit_parent *parent;
@@ -897,7 +899,6 @@ static void audit_update_watch(struct au
struct audit_watch *owatch, *nwatch, *nextw;
struct audit_krule *r, *nextr;
struct audit_entry *oentry, *nentry;
- struct audit_buffer *ab;
mutex_lock(&audit_filter_mutex);
list_for_each_entry_safe(owatch, nextw, &parent->watches, wlist) {
@@ -937,13 +938,18 @@ static void audit_update_watch(struct au
call_rcu(&oentry->rcu, audit_free_rule_rcu);
}
- ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
- audit_log_format(ab, "op=updated rules specifying path=");
- audit_log_untrustedstring(ab, owatch->path);
- audit_log_format(ab, " with dev=%u ino=%lu\n", dev, ino);
- audit_log_format(ab, " list=%d res=1", r->listnr);
- audit_log_end(ab);
-
+ if (audit_enabled) {
+ struct audit_buffer *ab;
+ ab = audit_log_start(NULL, GFP_KERNEL,
+ AUDIT_CONFIG_CHANGE);
+ audit_log_format(ab,
+ "op=updated rules specifying path=");
+ audit_log_untrustedstring(ab, owatch->path);
+ audit_log_format(ab, " with dev=%u ino=%lu\n",
+ dev, ino);
+ audit_log_format(ab, " list=%d res=1", r->listnr);
+ audit_log_end(ab);
+ }
audit_remove_watch(owatch);
goto add_watch_to_parent; /* event applies to a single watch */
}
@@ -962,25 +968,28 @@ static void audit_remove_parent_watches(
struct audit_watch *w, *nextw;
struct audit_krule *r, *nextr;
struct audit_entry *e;
- struct audit_buffer *ab;
mutex_lock(&audit_filter_mutex);
parent->flags |= AUDIT_PARENT_INVALID;
list_for_each_entry_safe(w, nextw, &parent->watches, wlist) {
list_for_each_entry_safe(r, nextr, &w->rules, rlist) {
e = container_of(r, struct audit_entry, rule);
-
- ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
- audit_log_format(ab, "op=remove rule path=");
- audit_log_untrustedstring(ab, w->path);
- if (r->filterkey) {
- audit_log_format(ab, " key=");
- audit_log_untrustedstring(ab, r->filterkey);
- } else
- audit_log_format(ab, " key=(null)");
- audit_log_format(ab, " list=%d res=1", r->listnr);
- audit_log_end(ab);
-
+ if (audit_enabled) {
+ struct audit_buffer *ab;
+ ab = audit_log_start(NULL, GFP_KERNEL,
+ AUDIT_CONFIG_CHANGE);
+ audit_log_format(ab, "op=remove rule path=");
+ audit_log_untrustedstring(ab, w->path);
+ if (r->filterkey) {
+ audit_log_format(ab, " key=");
+ audit_log_untrustedstring(ab,
+ r->filterkey);
+ } else
+ audit_log_format(ab, " key=(null)");
+ audit_log_format(ab, " list=%d res=1",
+ r->listnr);
+ audit_log_end(ab);
+ }
list_del(&r->rlist);
list_del_rcu(&e->list);
call_rcu(&e->rcu, audit_free_rule_rcu);
@@ -1409,6 +1418,9 @@ static void audit_log_rule_change(uid_t
{
struct audit_buffer *ab;
+ if (!audit_enabled)
+ return;
+
ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
if (!ab)
return;
18 years, 9 months
- 4
- 5
Why aren't SYSCALLS being logged in CentOS kernel (any ideas?)
by Robert Evans
Hi,
I'm using CentOS, kernel 2.6.18-8.el5. I've compiled audit-1.5.6-1 and I'm
getting USER_AUTH events (logins, su, etc...) but I'm not seeing any syscall events.
My test audit.rules works fine in RHEL4, Suse10 and Fedora, but doesn't seem to
generate any syscall events in CentOS 5. For testing purposes, I'm using the
following in audit.rules:
# Log execute failures
-a exit,always -S execve -F success!=1 -F exit!=-2 -F exit!=-20 -F exit!=-17 -F
exit!=-6
# Log administrative functions
-a exit,always -S reboot -S clock_settime -S settimeofday -S adjtimex -S
setdomainname -S sethostname -S reboot -S mount -S umount2
-a exit,always -S swapon -S swapoff -S create_module -S delete_module -S
quotactl -F success!=1
# Log Read/Write functions
-a exit,always -S open -S creat -S link -S symlink -S truncate -S ftruncate -S
mknod -S rename -F success!=1 -F exit!=-2 -F exit!=-20 -F exit!=-17 -F exit!=-6
# Log file removal failures
-a exit,always -S unlink -S rmdir -F success!=1 -F exit!=-2 -F exit!=-20 -F
exit!=-17 -F exit!=-6
# Log file modification failures
-a exit,always -S chmod -S chown -S lchown -S fchmod -S fchown -F success!=1 -F
exit!=-2 -F exit!=-20 -F exit!=-17 -F exit!=-6
# Add watches for reboot stuff...
-w /sbin/init -p x -k runlevel
-w /sbin/telinit -p x -k runlevel
-w /sbin/halt -p x -k runlevel
-w /sbin/poweroff -p x -k runlevel
-w /sbin/reboot -p x -k runlevel
-w /sbin/shutdown -p x -k runlevel
Any ideas?
Bob
18 years, 9 months
- 2
- 4
[PATCH][RFC] V3 Remove SELinux dependencies from linux-audit via LSM
by Casey Schaufler
From: Casey Schaufler <casey(a)schaufler-ca.com>
This patch interposes LSM interfaces between the audit system
and SELinux. This helps make SELinux a cleaner LSM and clarifies
the interfaces provided by the audit system. The audit system
no longer requires SELinux functions or data structures, making
it available for use by other LSMs.
The audit system interfaces should now be useful to any LSM that
can provide secids and text string representations that match them.
The audit system uses secids only to map to those strings and
treats them as opaque data otherwise. Audit rule information that
is specific to an LSM is maintained through a void *.
The SELinux code uses LSM interfaces to access the audit system,
with the exception of audit_rule_update_callout(), which is
intended to be called at the descretion of an LSM to update the
LSM specific rules.
The LSM interface includes six new entries, four for audit and two
that supply secids from the LSM to networking and audit subsystems.
Also, there were several cases where SELinux code was being called
where LSM interfaces were more appropriate. These uses have been
repaired and the SELinux interfaces are no longer exported.
These changes expose the secid as an LSM interface. SELinux
already uses secids. Other LSMs that expect to interface with
audit, xfrm, and USB will have to support the notion of secids.
Smack has been adjusted to support this scheme.
This patch is relative to 2.6.23-rc4. It will not apply to 2.6.22.
Signed-off-by: Casey Schaufler <casey(a)schaufler-ca.com>
---
I have approached the elimination of secids from three different
directions and while I would accept the changes required I would
not expect all parties to buy into them because of the code
disruption. The approach I am putting forward has the advantage
of directly addressing the issue at hand, which is to make it
possible for an LSM that is not SELinux to use the audit system.
As I've suggested elsewhere, maybe cleaning up the LSM interface
is a task for Linux 3.0.
include/linux/audit.h | 55 +++++++++-
include/linux/security.h | 113 +++++++++++++++++++++
include/linux/selinux.h | 138 --------------------------
kernel/audit.c | 43 +++-----
kernel/audit.h | 41 -------
kernel/auditfilter.c | 70 ++++---------
kernel/auditsc.c | 45 ++++----
net/netlink/af_netlink.c | 3
security/selinux/exports.c | 42 -------
security/selinux/hooks.c | 51 +++++++++
security/selinux/include/security.h | 38 +++++++
security/selinux/ss/services.c | 19 +--
12 files changed, 323 insertions(+), 335 deletions(-)
diff -uprN -X linux-2.6.23-rc4-base/Documentation/dontdiff linux-2.6.23-rc4-base/include/linux/audit.h linux-2.6.23-rc4-audit/include/linux/audit.h
--- linux-2.6.23-rc4-base/include/linux/audit.h 2007-08-26 23:51:46.000000000 -0700
+++ linux-2.6.23-rc4-audit/include/linux/audit.h 2007-08-27 00:52:10.000000000 -0700
@@ -333,20 +333,63 @@ struct audit_rule { /* for AUDIT_LIST,
#ifdef __KERNEL__
#include <linux/sched.h>
-struct audit_sig_info {
- uid_t uid;
- pid_t pid;
- char ctx[0];
-};
-
struct audit_buffer;
struct audit_context;
+struct audit_parent;
struct inode;
struct netlink_skb_parms;
struct linux_binprm;
struct mq_attr;
struct mqstat;
+struct audit_sig_info {
+ uid_t uid;
+ pid_t pid;
+ char ctx[0];
+};
+
+struct audit_watch {
+ atomic_t count; /* reference count */
+ char *path; /* insertion path */
+ dev_t dev; /* associated superblock device */
+ unsigned long ino; /* associated inode number */
+ struct audit_parent *parent; /* associated parent */
+ struct list_head wlist; /* entry in parent->watches list */
+ struct list_head rules; /* associated rules */
+};
+
+struct audit_field {
+ u32 type;
+ u32 val;
+ u32 op;
+ char *se_str;
+ void *se_rule;
+};
+
+struct audit_krule {
+ int vers_ops;
+ u32 flags;
+ u32 listnr;
+ u32 action;
+ u32 mask[AUDIT_BITMASK_SIZE];
+ u32 buflen; /* for data alloc on list rules */
+ u32 field_count;
+ char *filterkey; /* ties events to rules */
+ struct audit_field *fields;
+ struct audit_field *arch_f; /* quick access to arch field */
+ struct audit_field *inode_f; /* quick access to an inode field */
+ struct audit_watch *watch; /* associated watch */
+ struct list_head rlist; /* entry in audit_watch.rules list */
+};
+
+struct audit_entry {
+ struct list_head list;
+ struct rcu_head rcu;
+ struct audit_krule rule;
+};
+
+extern int audit_rule_update_callout(void);
+
#define AUDITSC_INVALID 0
#define AUDITSC_SUCCESS 1
#define AUDITSC_FAILURE 2
diff -uprN -X linux-2.6.23-rc4-base/Documentation/dontdiff linux-2.6.23-rc4-base/include/linux/security.h linux-2.6.23-rc4-audit/include/linux/security.h
--- linux-2.6.23-rc4-base/include/linux/security.h 2007-08-26 23:51:46.000000000 -0700
+++ linux-2.6.23-rc4-audit/include/linux/security.h 2007-08-29 20:24:19.000000000 -0700
@@ -35,6 +35,7 @@
#include <net/flow.h>
struct ctl_table;
+struct audit_krule;
/*
* These functions are in security/capability.c and are used
@@ -1138,6 +1139,8 @@ struct request_sock;
* @name contains the name of the security module being unstacked.
* @ops contains a pointer to the struct security_operations of the module to unstack.
*
+ * Hooks for the export of secids
+ *
* @secid_to_secctx:
* Convert secid to security context.
* @secid contains the security ID.
@@ -1148,6 +1151,38 @@ struct request_sock;
* @secdata contains the security context.
* @seclen contains the length of the security context.
*
+ * @inode_getsecid:
+ * get the secid associated with the inode
+ * @inode contains a pointer to the inode
+ * @secid contains a pointer to the location to store the result
+ *
+ * @ipc_getsecid:
+ * get the secid associated with the ipc object
+ * @inode contains a pointer to the ipc object
+ * @secid contains a pointer to the location to store the result
+ *
+ * Security hooks for the audit system
+ *
+ * @audit_rule_supplied:
+ * identify audit rules interesting to this LSM
+ * @rule contains a pointer to the rule in question
+ * @audit_rule_match:
+ * checks if the LSM would have a record generated
+ * @sid contains the secid in question
+ * @field contains what to check
+ * @op contains the operation
+ * @rule contains a pointer to the audit rule
+ * @actx contains a pointer to the audit context
+ * @audit_rule_init:
+ * establish an audit rule
+ * @field contains the action of interest
+ * @op contains the operation
+ * @rulestr contains a pointer to the rule string
+ * @rule contains a pointer to receive the result
+ * @audit_rule_free:
+ * reclaim the rule
+ * @rule the data to free
+ *
* This is the main security structure.
*/
struct security_operations {
@@ -1331,6 +1366,14 @@ struct security_operations {
int (*setprocattr)(struct task_struct *p, char *name, void *value, size_t size);
int (*secid_to_secctx)(u32 secid, char **secdata, u32 *seclen);
void (*release_secctx)(char *secdata, u32 seclen);
+ void (*inode_getsecid) (const struct inode *inode, u32 *secid);
+ void (*ipc_getsecid) (const struct kern_ipc_perm *p, u32 *secid);
+ int (*audit_rule_supplied) (struct audit_krule *rule);
+ int (*audit_rule_match) (u32 sid, u32 field, u32 op, void *rule,
+ struct audit_context *actx);
+ int (*audit_rule_init) (u32 field, u32 op, char *rulestr, void **rule);
+ void (*audit_rule_free) (void *rule);
+
#ifdef CONFIG_SECURITY_NETWORK
int (*unix_stream_connect) (struct socket * sock,
@@ -2132,6 +2175,43 @@ static inline void security_release_secc
return security_ops->release_secctx(secdata, seclen);
}
+static inline void security_inode_getsecid(const struct inode *inode,
+ u32 *secid)
+{
+ security_ops->inode_getsecid(inode, secid);
+ return;
+}
+
+static inline void security_ipc_getsecid(struct kern_ipc_perm *p, u32 *secid)
+{
+ security_ops->ipc_getsecid(p, secid);
+ return;
+}
+
+static inline int security_audit_rule_supplied(struct audit_krule *rule)
+{
+ return security_ops->audit_rule_supplied(rule);
+}
+
+static inline int security_audit_rule_match(u32 sid, u32 field, u32 op,
+ void *rule,
+ struct audit_context *actx)
+{
+ return security_ops->audit_rule_match(sid, field, op, rule, actx);
+}
+
+static inline int security_audit_rule_init(u32 field, u32 op, char *rulestr,
+ void **rule)
+{
+ return security_ops->audit_rule_init(field, op, rulestr, rule);
+}
+
+static inline void security_audit_rule_free(void *rule)
+{
+ security_ops->audit_rule_free(rule);
+ return;
+}
+
/* prototypes */
extern int security_init (void);
extern int register_security (struct security_operations *ops);
@@ -2813,6 +2893,39 @@ static inline int security_secid_to_secc
static inline void security_release_secctx(char *secdata, u32 seclen)
{
}
+
+static inline void security_inode_getsecid(const struct inode *inode,
+ u32 *secid);
+{
+}
+
+static inline void security_ipc_getsecid(struct kern_ipc_perm *p, u32 *secid)
+{
+}
+
+static inline int security_audit_rule_supplied(struct audit_krule *rule)
+{
+ return 0;
+}
+
+static inline int security_audit_rule_match(u32 sid, u32 field, u32 op,
+ void *rule,
+ struct audit_context *actx)
+{
+ return;
+}
+
+static inline int security_audit_rule_init(u32 field, u32 op, char *rulestr,
+ void **rule)
+{
+ return 0;
+}
+
+static inline void security_audit_rule_free(void *rule)
+{
+ return;
+}
+
#endif /* CONFIG_SECURITY */
#ifdef CONFIG_SECURITY_NETWORK
diff -uprN -X linux-2.6.23-rc4-base/Documentation/dontdiff linux-2.6.23-rc4-base/include/linux/selinux.h linux-2.6.23-rc4-audit/include/linux/selinux.h
--- linux-2.6.23-rc4-base/include/linux/selinux.h 2007-07-08 16:32:17.000000000 -0700
+++ linux-2.6.23-rc4-audit/include/linux/selinux.h 2007-08-27 00:52:10.000000000 -0700
@@ -14,101 +14,9 @@
#ifndef _LINUX_SELINUX_H
#define _LINUX_SELINUX_H
-struct selinux_audit_rule;
-struct audit_context;
-struct inode;
-struct kern_ipc_perm;
-
#ifdef CONFIG_SECURITY_SELINUX
/**
- * selinux_audit_rule_init - alloc/init an selinux audit rule structure.
- * @field: the field this rule refers to
- * @op: the operater the rule uses
- * @rulestr: the text "target" of the rule
- * @rule: pointer to the new rule structure returned via this
- *
- * Returns 0 if successful, -errno if not. On success, the rule structure
- * will be allocated internally. The caller must free this structure with
- * selinux_audit_rule_free() after use.
- */
-int selinux_audit_rule_init(u32 field, u32 op, char *rulestr,
- struct selinux_audit_rule **rule);
-
-/**
- * selinux_audit_rule_free - free an selinux audit rule structure.
- * @rule: pointer to the audit rule to be freed
- *
- * This will free all memory associated with the given rule.
- * If @rule is NULL, no operation is performed.
- */
-void selinux_audit_rule_free(struct selinux_audit_rule *rule);
-
-/**
- * selinux_audit_rule_match - determine if a context ID matches a rule.
- * @sid: the context ID to check
- * @field: the field this rule refers to
- * @op: the operater the rule uses
- * @rule: pointer to the audit rule to check against
- * @actx: the audit context (can be NULL) associated with the check
- *
- * Returns 1 if the context id matches the rule, 0 if it does not, and
- * -errno on failure.
- */
-int selinux_audit_rule_match(u32 sid, u32 field, u32 op,
- struct selinux_audit_rule *rule,
- struct audit_context *actx);
-
-/**
- * selinux_audit_set_callback - set the callback for policy reloads.
- * @callback: the function to call when the policy is reloaded
- *
- * This sets the function callback function that will update the rules
- * upon policy reloads. This callback should rebuild all existing rules
- * using selinux_audit_rule_init().
- */
-void selinux_audit_set_callback(int (*callback)(void));
-
-/**
- * selinux_sid_to_string - map a security context ID to a string
- * @sid: security context ID to be converted.
- * @ctx: address of context string to be returned
- * @ctxlen: length of returned context string.
- *
- * Returns 0 if successful, -errno if not. On success, the context
- * string will be allocated internally, and the caller must call
- * kfree() on it after use.
- */
-int selinux_sid_to_string(u32 sid, char **ctx, u32 *ctxlen);
-
-/**
- * selinux_get_inode_sid - get the inode's security context ID
- * @inode: inode structure to get the sid from.
- * @sid: pointer to security context ID to be filled in.
- *
- * Returns nothing
- */
-void selinux_get_inode_sid(const struct inode *inode, u32 *sid);
-
-/**
- * selinux_get_ipc_sid - get the ipc security context ID
- * @ipcp: ipc structure to get the sid from.
- * @sid: pointer to security context ID to be filled in.
- *
- * Returns nothing
- */
-void selinux_get_ipc_sid(const struct kern_ipc_perm *ipcp, u32 *sid);
-
-/**
- * selinux_get_task_sid - return the SID of task
- * @tsk: the task whose SID will be returned
- * @sid: pointer to security context ID to be filled in.
- *
- * Returns nothing
- */
-void selinux_get_task_sid(struct task_struct *tsk, u32 *sid);
-
-/**
* selinux_string_to_sid - map a security context string to a security ID
* @str: the security context string to be mapped
* @sid: ID value returned via this.
@@ -132,52 +40,6 @@ int selinux_relabel_packet_permission(u3
#else
-static inline int selinux_audit_rule_init(u32 field, u32 op,
- char *rulestr,
- struct selinux_audit_rule **rule)
-{
- return -ENOTSUPP;
-}
-
-static inline void selinux_audit_rule_free(struct selinux_audit_rule *rule)
-{
- return;
-}
-
-static inline int selinux_audit_rule_match(u32 sid, u32 field, u32 op,
- struct selinux_audit_rule *rule,
- struct audit_context *actx)
-{
- return 0;
-}
-
-static inline void selinux_audit_set_callback(int (*callback)(void))
-{
- return;
-}
-
-static inline int selinux_sid_to_string(u32 sid, char **ctx, u32 *ctxlen)
-{
- *ctx = NULL;
- *ctxlen = 0;
- return 0;
-}
-
-static inline void selinux_get_inode_sid(const struct inode *inode, u32 *sid)
-{
- *sid = 0;
-}
-
-static inline void selinux_get_ipc_sid(const struct kern_ipc_perm *ipcp, u32 *sid)
-{
- *sid = 0;
-}
-
-static inline void selinux_get_task_sid(struct task_struct *tsk, u32 *sid)
-{
- *sid = 0;
-}
-
static inline int selinux_string_to_sid(const char *str, u32 *sid)
{
*sid = 0;
diff -uprN -X linux-2.6.23-rc4-base/Documentation/dontdiff linux-2.6.23-rc4-base/kernel/audit.c linux-2.6.23-rc4-audit/kernel/audit.c
--- linux-2.6.23-rc4-base/kernel/audit.c 2007-08-26 23:51:47.000000000 -0700
+++ linux-2.6.23-rc4-audit/kernel/audit.c 2007-08-27 00:52:10.000000000 -0700
@@ -55,7 +55,6 @@
#include <net/netlink.h>
#include <linux/skbuff.h>
#include <linux/netlink.h>
-#include <linux/selinux.h>
#include <linux/inotify.h>
#include <linux/freezer.h>
#include <linux/tty.h>
@@ -253,12 +252,12 @@ static int audit_set_rate_limit(int limi
if (sid) {
char *ctx = NULL;
u32 len;
- if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) {
+ if ((rc = security_secid_to_secctx(sid, &ctx, &len)) == 0) {
audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
"audit_rate_limit=%d old=%d by auid=%u"
" subj=%s res=%d",
limit, old, loginuid, ctx, res);
- kfree(ctx);
+ security_release_secctx(ctx, len);
} else
res = 0; /* Something weird, deny request */
}
@@ -288,12 +287,12 @@ static int audit_set_backlog_limit(int l
if (sid) {
char *ctx = NULL;
u32 len;
- if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) {
+ if ((rc = security_secid_to_secctx(sid, &ctx, &len)) == 0) {
audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
"audit_backlog_limit=%d old=%d by auid=%u"
" subj=%s res=%d",
limit, old, loginuid, ctx, res);
- kfree(ctx);
+ security_release_secctx(ctx, len);
} else
res = 0; /* Something weird, deny request */
}
@@ -326,12 +325,12 @@ static int audit_set_enabled(int state,
if (sid) {
char *ctx = NULL;
u32 len;
- if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) {
+ if ((rc = security_secid_to_secctx(sid, &ctx, &len)) == 0) {
audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
"audit_enabled=%d old=%d by auid=%u"
" subj=%s res=%d",
state, old, loginuid, ctx, res);
- kfree(ctx);
+ security_release_secctx(ctx, len);
} else
res = 0; /* Something weird, deny request */
}
@@ -366,12 +365,12 @@ static int audit_set_failure(int state,
if (sid) {
char *ctx = NULL;
u32 len;
- if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) {
+ if ((rc = security_secid_to_secctx(sid, &ctx, &len)) == 0) {
audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
"audit_failure=%d old=%d by auid=%u"
" subj=%s res=%d",
state, old, loginuid, ctx, res);
- kfree(ctx);
+ security_release_secctx(ctx, len);
} else
res = 0; /* Something weird, deny request */
}
@@ -619,7 +618,7 @@ static int audit_receive_msg(struct sk_b
if (status_get->mask & AUDIT_STATUS_PID) {
int old = audit_pid;
if (sid) {
- if ((err = selinux_sid_to_string(
+ if ((err = security_secid_to_secctx(
sid, &ctx, &len)))
return err;
else
@@ -628,7 +627,7 @@ static int audit_receive_msg(struct sk_b
"audit_pid=%d old=%d by auid=%u subj=%s",
status_get->pid, old,
loginuid, ctx);
- kfree(ctx);
+ security_release_secctx(ctx, len);
} else
audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
"audit_pid=%d old=%d by auid=%u",
@@ -662,7 +661,7 @@ static int audit_receive_msg(struct sk_b
"user pid=%d uid=%u auid=%u",
pid, uid, loginuid);
if (sid) {
- if (selinux_sid_to_string(
+ if (security_secid_to_secctx(
sid, &ctx, &len)) {
audit_log_format(ab,
" ssid=%u", sid);
@@ -670,7 +669,7 @@ static int audit_receive_msg(struct sk_b
} else
audit_log_format(ab,
" subj=%s", ctx);
- kfree(ctx);
+ security_release_secctx(ctx, len);
}
if (msg_type != AUDIT_USER_TTY)
audit_log_format(ab, " msg='%.1024s'",
@@ -700,7 +699,7 @@ static int audit_receive_msg(struct sk_b
"pid=%d uid=%u auid=%u",
pid, uid, loginuid);
if (sid) {
- if (selinux_sid_to_string(
+ if (security_secid_to_secctx(
sid, &ctx, &len)) {
audit_log_format(ab,
" ssid=%u", sid);
@@ -708,7 +707,7 @@ static int audit_receive_msg(struct sk_b
} else
audit_log_format(ab,
" subj=%s", ctx);
- kfree(ctx);
+ security_release_secctx(ctx, len);
}
audit_log_format(ab, " audit_enabled=%d res=0",
audit_enabled);
@@ -734,7 +733,7 @@ static int audit_receive_msg(struct sk_b
"pid=%d uid=%u auid=%u",
pid, uid, loginuid);
if (sid) {
- if (selinux_sid_to_string(
+ if (security_secid_to_secctx(
sid, &ctx, &len)) {
audit_log_format(ab,
" ssid=%u", sid);
@@ -742,7 +741,7 @@ static int audit_receive_msg(struct sk_b
} else
audit_log_format(ab,
" subj=%s", ctx);
- kfree(ctx);
+ security_release_secctx(ctx, len);
}
audit_log_format(ab, " audit_enabled=%d res=0",
audit_enabled);
@@ -757,18 +756,18 @@ static int audit_receive_msg(struct sk_b
loginuid, sid);
break;
case AUDIT_SIGNAL_INFO:
- err = selinux_sid_to_string(audit_sig_sid, &ctx, &len);
+ err = security_secid_to_secctx(audit_sig_sid, &ctx, &len);
if (err)
return err;
sig_data = kmalloc(sizeof(*sig_data) + len, GFP_KERNEL);
if (!sig_data) {
- kfree(ctx);
+ security_release_secctx(ctx, len);
return -ENOMEM;
}
sig_data->uid = audit_sig_uid;
sig_data->pid = audit_sig_pid;
memcpy(sig_data->ctx, ctx, len);
- kfree(ctx);
+ security_release_secctx(ctx, len);
audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_SIGNAL_INFO,
0, 0, sig_data, sizeof(*sig_data) + len);
kfree(sig_data);
@@ -887,10 +886,6 @@ static int __init audit_init(void)
audit_initialized = 1;
audit_enabled = audit_default;
- /* Register the callback with selinux. This callback will be invoked
- * when a new policy is loaded. */
- selinux_audit_set_callback(&selinux_audit_rule_update);
-
audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized");
#ifdef CONFIG_AUDITSYSCALL
diff -uprN -X linux-2.6.23-rc4-base/Documentation/dontdiff linux-2.6.23-rc4-base/kernel/auditfilter.c linux-2.6.23-rc4-audit/kernel/auditfilter.c
--- linux-2.6.23-rc4-base/kernel/auditfilter.c 2007-08-26 23:51:47.000000000 -0700
+++ linux-2.6.23-rc4-audit/kernel/auditfilter.c 2007-08-27 00:52:10.000000000 -0700
@@ -28,7 +28,7 @@
#include <linux/netlink.h>
#include <linux/sched.h>
#include <linux/inotify.h>
-#include <linux/selinux.h>
+#include <linux/security.h>
#include "audit.h"
/*
@@ -38,7 +38,7 @@
* Synchronizes writes and blocking reads of audit's filterlist
* data. Rcu is used to traverse the filterlist and access
* contents of structs audit_entry, audit_watch and opaque
- * selinux rules during filtering. If modified, these structures
+ * LSM rules during filtering. If modified, these structures
* must be copied and replace their counterparts in the filterlist.
* An audit_parent struct is not accessed during filtering, so may
* be written directly provided audit_filter_mutex is held.
@@ -138,7 +138,7 @@ static inline void audit_free_rule(struc
for (i = 0; i < e->rule.field_count; i++) {
struct audit_field *f = &e->rule.fields[i];
kfree(f->se_str);
- selinux_audit_rule_free(f->se_rule);
+ security_audit_rule_free(f->se_rule);
}
kfree(e->rule.fields);
kfree(e->rule.filterkey);
@@ -595,12 +595,12 @@ static struct audit_entry *audit_data_to
goto exit_free;
entry->rule.buflen += f->val;
- err = selinux_audit_rule_init(f->type, f->op, str,
+ err = security_audit_rule_init(f->type, f->op, str,
&f->se_rule);
/* Keep currently invalid fields around in case they
* become valid after a policy reload. */
if (err == -EINVAL) {
- printk(KERN_WARNING "audit rule for selinux "
+ printk(KERN_WARNING "audit rule for LSM "
"\'%s\' is invalid\n", str);
err = 0;
}
@@ -839,10 +839,10 @@ out:
return new;
}
-/* Duplicate selinux field information. The se_rule is opaque, so must be
- * re-initialized. */
-static inline int audit_dupe_selinux_field(struct audit_field *df,
- struct audit_field *sf)
+/* Duplicate security module field information.
+ * The se_rule is opaque, so must be re-initialized. */
+static inline int audit_dupe_security_field(struct audit_field *df,
+ struct audit_field *sf)
{
int ret = 0;
char *se_str;
@@ -854,12 +854,12 @@ static inline int audit_dupe_selinux_fie
df->se_str = se_str;
/* our own (refreshed) copy of se_rule */
- ret = selinux_audit_rule_init(df->type, df->op, df->se_str,
- &df->se_rule);
+ ret = security_audit_rule_init(df->type, df->op, df->se_str,
+ &df->se_rule);
/* Keep currently invalid fields around in case they
* become valid after a policy reload. */
if (ret == -EINVAL) {
- printk(KERN_WARNING "audit rule for selinux \'%s\' is "
+ printk(KERN_WARNING "audit rule for LSM \'%s\' is "
"invalid\n", df->se_str);
ret = 0;
}
@@ -868,7 +868,7 @@ static inline int audit_dupe_selinux_fie
}
/* Duplicate an audit rule. This will be a deep copy with the exception
- * of the watch - that pointer is carried over. The selinux specific fields
+ * of the watch - that pointer is carried over. The LSM specific fields
* will be updated in the copy. The point is to be able to replace the old
* rule with the new rule in the filterlist, then free the old rule.
* The rlist element is undefined; list manipulations are handled apart from
@@ -913,8 +913,8 @@ static struct audit_entry *audit_dupe_ru
case AUDIT_OBJ_TYPE:
case AUDIT_OBJ_LEV_LOW:
case AUDIT_OBJ_LEV_HIGH:
- err = audit_dupe_selinux_field(&new->fields[i],
- &old->fields[i]);
+ err = audit_dupe_security_field(&new->fields[i],
+ &old->fields[i]);
break;
case AUDIT_FILTERKEY:
fk = kstrdup(old->filterkey, GFP_KERNEL);
@@ -1456,11 +1456,11 @@ static void audit_log_rule_change(uid_t
if (sid) {
char *ctx = NULL;
u32 len;
- if (selinux_sid_to_string(sid, &ctx, &len))
+ if (security_secid_to_secctx(sid, &ctx, &len))
audit_log_format(ab, " ssid=%u", sid);
else
audit_log_format(ab, " subj=%s", ctx);
- kfree(ctx);
+ security_release_secctx(ctx, len);
}
audit_log_format(ab, " op=%s rule key=", action);
if (rule->filterkey)
@@ -1702,38 +1702,12 @@ unlock_and_return:
return result;
}
-/* Check to see if the rule contains any selinux fields. Returns 1 if there
- are selinux fields specified in the rule, 0 otherwise. */
-static inline int audit_rule_has_selinux(struct audit_krule *rule)
-{
- int i;
-
- for (i = 0; i < rule->field_count; i++) {
- struct audit_field *f = &rule->fields[i];
- switch (f->type) {
- case AUDIT_SUBJ_USER:
- case AUDIT_SUBJ_ROLE:
- case AUDIT_SUBJ_TYPE:
- case AUDIT_SUBJ_SEN:
- case AUDIT_SUBJ_CLR:
- case AUDIT_OBJ_USER:
- case AUDIT_OBJ_ROLE:
- case AUDIT_OBJ_TYPE:
- case AUDIT_OBJ_LEV_LOW:
- case AUDIT_OBJ_LEV_HIGH:
- return 1;
- }
- }
-
- return 0;
-}
-
/* This function will re-initialize the se_rule field of all applicable rules.
- * It will traverse the filter lists serarching for rules that contain selinux
+ * It will traverse the filter lists serarching for rules that contain LSM
* specific filter fields. When such a rule is found, it is copied, the
- * selinux field is re-initialized, and the old rule is replaced with the
+ * LSM field is re-initialized, and the old rule is replaced with the
* updated rule. */
-int selinux_audit_rule_update(void)
+int audit_rule_update_callout(void)
{
struct audit_entry *entry, *n, *nentry;
struct audit_watch *watch;
@@ -1744,7 +1718,7 @@ int selinux_audit_rule_update(void)
for (i = 0; i < AUDIT_NR_FILTERS; i++) {
list_for_each_entry_safe(entry, n, &audit_filter_list[i], list) {
- if (!audit_rule_has_selinux(&entry->rule))
+ if (!security_audit_rule_supplied(&entry->rule))
continue;
watch = entry->rule.watch;
@@ -1754,7 +1728,7 @@ int selinux_audit_rule_update(void)
* return value */
if (!err)
err = PTR_ERR(nentry);
- audit_panic("error updating selinux filters");
+ audit_panic("error updating LSM filters");
if (watch)
list_del(&entry->rule.rlist);
list_del_rcu(&entry->list);
diff -uprN -X linux-2.6.23-rc4-base/Documentation/dontdiff linux-2.6.23-rc4-base/kernel/audit.h linux-2.6.23-rc4-audit/kernel/audit.h
--- linux-2.6.23-rc4-base/kernel/audit.h 2007-08-26 23:51:47.000000000 -0700
+++ linux-2.6.23-rc4-audit/kernel/audit.h 2007-08-27 00:52:10.000000000 -0700
@@ -55,46 +55,6 @@ enum audit_state {
/* Rule lists */
struct audit_parent;
-struct audit_watch {
- atomic_t count; /* reference count */
- char *path; /* insertion path */
- dev_t dev; /* associated superblock device */
- unsigned long ino; /* associated inode number */
- struct audit_parent *parent; /* associated parent */
- struct list_head wlist; /* entry in parent->watches list */
- struct list_head rules; /* associated rules */
-};
-
-struct audit_field {
- u32 type;
- u32 val;
- u32 op;
- char *se_str;
- struct selinux_audit_rule *se_rule;
-};
-
-struct audit_krule {
- int vers_ops;
- u32 flags;
- u32 listnr;
- u32 action;
- u32 mask[AUDIT_BITMASK_SIZE];
- u32 buflen; /* for data alloc on list rules */
- u32 field_count;
- char *filterkey; /* ties events to rules */
- struct audit_field *fields;
- struct audit_field *arch_f; /* quick access to arch field */
- struct audit_field *inode_f; /* quick access to an inode field */
- struct audit_watch *watch; /* associated watch */
- struct list_head rlist; /* entry in audit_watch.rules list */
-};
-
-struct audit_entry {
- struct list_head list;
- struct rcu_head rcu;
- struct audit_krule rule;
-};
-
extern int audit_pid;
#define AUDIT_INODE_BUCKETS 32
@@ -128,7 +88,6 @@ struct inotify_watch;
extern void audit_free_parent(struct inotify_watch *);
extern void audit_handle_ievent(struct inotify_watch *, u32, u32, u32,
const char *, struct inode *);
-extern int selinux_audit_rule_update(void);
#ifdef CONFIG_AUDITSYSCALL
extern int __audit_signal_info(int sig, struct task_struct *t);
diff -uprN -X linux-2.6.23-rc4-base/Documentation/dontdiff linux-2.6.23-rc4-base/kernel/auditsc.c linux-2.6.23-rc4-audit/kernel/auditsc.c
--- linux-2.6.23-rc4-base/kernel/auditsc.c 2007-08-26 23:51:47.000000000 -0700
+++ linux-2.6.23-rc4-audit/kernel/auditsc.c 2007-08-27 00:52:10.000000000 -0700
@@ -62,7 +62,6 @@
#include <linux/security.h>
#include <linux/list.h>
#include <linux/tty.h>
-#include <linux/selinux.h>
#include <linux/binfmts.h>
#include <linux/highmem.h>
#include <linux/syscalls.h>
@@ -397,10 +396,10 @@ static int audit_filter_rules(struct tas
logged upon error */
if (f->se_rule) {
if (need_sid) {
- selinux_get_task_sid(tsk, &sid);
+ security_task_getsecid(tsk, &sid);
need_sid = 0;
}
- result = selinux_audit_rule_match(sid, f->type,
+ result = security_audit_rule_match(sid, f->type,
f->op,
f->se_rule,
ctx);
@@ -416,12 +415,12 @@ static int audit_filter_rules(struct tas
if (f->se_rule) {
/* Find files that match */
if (name) {
- result = selinux_audit_rule_match(
+ result = security_audit_rule_match(
name->osid, f->type, f->op,
f->se_rule, ctx);
} else if (ctx) {
for (j = 0; j < ctx->name_count; j++) {
- if (selinux_audit_rule_match(
+ if (security_audit_rule_match(
ctx->names[j].osid,
f->type, f->op,
f->se_rule, ctx)) {
@@ -437,7 +436,7 @@ static int audit_filter_rules(struct tas
aux = aux->next) {
if (aux->type == AUDIT_IPC) {
struct audit_aux_data_ipcctl *axi = (void *)aux;
- if (selinux_audit_rule_match(axi->osid, f->type, f->op, f->se_rule, ctx)) {
+ if (security_audit_rule_match(axi->osid, f->type, f->op, f->se_rule, ctx)) {
++result;
break;
}
@@ -744,11 +743,11 @@ void audit_log_task_context(struct audit
int error;
u32 sid;
- selinux_get_task_sid(current, &sid);
+ security_task_getsecid(current, &sid);
if (!sid)
return;
- error = selinux_sid_to_string(sid, &ctx, &len);
+ error = security_secid_to_secctx(sid, &ctx, &len);
if (error) {
if (error != -EINVAL)
goto error_path;
@@ -756,7 +755,7 @@ void audit_log_task_context(struct audit
}
audit_log_format(ab, " subj=%s", ctx);
- kfree(ctx);
+ security_release_secctx(ctx, len);
return;
error_path:
@@ -808,7 +807,7 @@ static int audit_log_pid_context(struct
if (!ab)
return 1;
- if (selinux_sid_to_string(sid, &s, &len)) {
+ if (security_secid_to_secctx(sid, &s, &len)) {
audit_log_format(ab, "opid=%d obj=(none)", pid);
rc = 1;
} else
@@ -990,14 +989,14 @@ static void audit_log_exit(struct audit_
if (axi->osid != 0) {
char *ctx = NULL;
u32 len;
- if (selinux_sid_to_string(
+ if (security_secid_to_secctx(
axi->osid, &ctx, &len)) {
audit_log_format(ab, " osid=%u",
axi->osid);
call_panic = 1;
} else
audit_log_format(ab, " obj=%s", ctx);
- kfree(ctx);
+ security_release_secctx(ctx, len);
}
break; }
@@ -1106,13 +1105,13 @@ static void audit_log_exit(struct audit_
if (n->osid != 0) {
char *ctx = NULL;
u32 len;
- if (selinux_sid_to_string(
+ if (security_secid_to_secctx(
n->osid, &ctx, &len)) {
audit_log_format(ab, " osid=%u", n->osid);
call_panic = 2;
} else
audit_log_format(ab, " obj=%s", ctx);
- kfree(ctx);
+ security_release_secctx(ctx, len);
}
audit_log_end(ab);
@@ -1394,7 +1393,7 @@ static void audit_copy_inode(struct audi
name->uid = inode->i_uid;
name->gid = inode->i_gid;
name->rdev = inode->i_rdev;
- selinux_get_inode_sid(inode, &name->osid);
+ security_inode_getsecid(inode, &name->osid);
}
/**
@@ -1812,7 +1811,7 @@ int __audit_ipc_obj(struct kern_ipc_perm
ax->uid = ipcp->uid;
ax->gid = ipcp->gid;
ax->mode = ipcp->mode;
- selinux_get_ipc_sid(ipcp, &ax->osid);
+ security_ipc_getsecid(ipcp, &ax->osid);
ax->d.type = AUDIT_IPC;
ax->d.next = context->aux;
@@ -1972,7 +1971,7 @@ void __audit_ptrace(struct task_struct *
struct audit_context *context = current->audit_context;
context->target_pid = t->pid;
- selinux_get_task_sid(t, &context->target_sid);
+ security_task_getsecid(t, &context->target_sid);
}
/**
@@ -1999,7 +1998,7 @@ int __audit_signal_info(int sig, struct
audit_sig_uid = ctx->loginuid;
else
audit_sig_uid = tsk->uid;
- selinux_get_task_sid(tsk, &audit_sig_sid);
+ security_task_getsecid(tsk, &audit_sig_sid);
}
if (!audit_signals || audit_dummy_context())
return 0;
@@ -2009,7 +2008,7 @@ int __audit_signal_info(int sig, struct
* in audit_context */
if (!ctx->target_pid) {
ctx->target_pid = t->tgid;
- selinux_get_task_sid(t, &ctx->target_sid);
+ security_task_getsecid(t, &ctx->target_sid);
return 0;
}
@@ -2026,7 +2025,7 @@ int __audit_signal_info(int sig, struct
BUG_ON(axp->pid_count >= AUDIT_AUX_PIDS);
axp->target_pid[axp->pid_count] = t->tgid;
- selinux_get_task_sid(t, &axp->target_sid[axp->pid_count]);
+ security_task_getsecid(t, &axp->target_sid[axp->pid_count]);
axp->pid_count++;
return 0;
@@ -2054,16 +2053,16 @@ void audit_core_dumps(long signr)
audit_log_format(ab, "auid=%u uid=%u gid=%u",
audit_get_loginuid(current->audit_context),
current->uid, current->gid);
- selinux_get_task_sid(current, &sid);
+ security_task_getsecid(current, &sid);
if (sid) {
char *ctx = NULL;
u32 len;
- if (selinux_sid_to_string(sid, &ctx, &len))
+ if (security_secid_to_secctx(sid, &ctx, &len))
audit_log_format(ab, " ssid=%u", sid);
else
audit_log_format(ab, " subj=%s", ctx);
- kfree(ctx);
+ security_release_secctx(ctx, len);
}
audit_log_format(ab, " pid=%d comm=", current->pid);
audit_log_untrustedstring(ab, current->comm);
diff -uprN -X linux-2.6.23-rc4-base/Documentation/dontdiff linux-2.6.23-rc4-base/net/netlink/af_netlink.c linux-2.6.23-rc4-audit/net/netlink/af_netlink.c
--- linux-2.6.23-rc4-base/net/netlink/af_netlink.c 2007-08-26 23:51:49.000000000 -0700
+++ linux-2.6.23-rc4-audit/net/netlink/af_netlink.c 2007-08-27 00:52:10.000000000 -0700
@@ -54,7 +54,6 @@
#include <linux/mm.h>
#include <linux/types.h>
#include <linux/audit.h>
-#include <linux/selinux.h>
#include <linux/mutex.h>
#include <net/sock.h>
@@ -1190,7 +1189,7 @@ static int netlink_sendmsg(struct kiocb
NETLINK_CB(skb).pid = nlk->pid;
NETLINK_CB(skb).dst_group = dst_group;
NETLINK_CB(skb).loginuid = audit_get_loginuid(current->audit_context);
- selinux_get_task_sid(current, &(NETLINK_CB(skb).sid));
+ security_task_getsecid(current, &(NETLINK_CB(skb).sid));
memcpy(NETLINK_CREDS(skb), &siocb->scm->creds, sizeof(struct ucred));
/* What can I do? Netlink is asynchronous, so that
diff -uprN -X linux-2.6.23-rc4-base/Documentation/dontdiff linux-2.6.23-rc4-base/security/selinux/exports.c linux-2.6.23-rc4-audit/security/selinux/exports.c
--- linux-2.6.23-rc4-base/security/selinux/exports.c 2007-07-08 16:32:17.000000000 -0700
+++ linux-2.6.23-rc4-audit/security/selinux/exports.c 2007-08-27 00:52:10.000000000 -0700
@@ -21,48 +21,6 @@
#include "security.h"
#include "objsec.h"
-int selinux_sid_to_string(u32 sid, char **ctx, u32 *ctxlen)
-{
- if (selinux_enabled)
- return security_sid_to_context(sid, ctx, ctxlen);
- else {
- *ctx = NULL;
- *ctxlen = 0;
- }
-
- return 0;
-}
-
-void selinux_get_inode_sid(const struct inode *inode, u32 *sid)
-{
- if (selinux_enabled) {
- struct inode_security_struct *isec = inode->i_security;
- *sid = isec->sid;
- return;
- }
- *sid = 0;
-}
-
-void selinux_get_ipc_sid(const struct kern_ipc_perm *ipcp, u32 *sid)
-{
- if (selinux_enabled) {
- struct ipc_security_struct *isec = ipcp->security;
- *sid = isec->sid;
- return;
- }
- *sid = 0;
-}
-
-void selinux_get_task_sid(struct task_struct *tsk, u32 *sid)
-{
- if (selinux_enabled) {
- struct task_security_struct *tsec = tsk->security;
- *sid = tsec->sid;
- return;
- }
- *sid = 0;
-}
-
int selinux_string_to_sid(char *str, u32 *sid)
{
if (selinux_enabled)
diff -uprN -X linux-2.6.23-rc4-base/Documentation/dontdiff linux-2.6.23-rc4-base/security/selinux/hooks.c linux-2.6.23-rc4-audit/security/selinux/hooks.c
--- linux-2.6.23-rc4-base/security/selinux/hooks.c 2007-08-26 23:51:49.000000000 -0700
+++ linux-2.6.23-rc4-audit/security/selinux/hooks.c 2007-08-27 00:52:10.000000000 -0700
@@ -2722,6 +2722,13 @@ static int selinux_file_receive(struct f
/* task security operations */
+static void selinux_get_task_sid(struct task_struct *tsk, u32 *sid)
+{
+ struct task_security_struct *tsec = tsk->security;
+ *sid = tsec->sid;
+ return;
+}
+
static int selinux_task_create(unsigned long clone_flags)
{
int rc;
@@ -3688,6 +3695,13 @@ out:
return err;
}
+static void selinux_get_inode_sid(const struct inode *inode, u32 *sid)
+{
+ struct inode_security_struct *isec = inode->i_security;
+ *sid = isec->sid;
+ return;
+}
+
static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
{
u32 peer_secid = SECSID_NULL;
@@ -4020,6 +4034,13 @@ static int selinux_netlink_recv(struct s
SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
}
+static void selinux_get_ipc_sid(const struct kern_ipc_perm *ipcp, u32 *sid)
+{
+ struct ipc_security_struct *isec = ipcp->security;
+ *sid = isec->sid;
+ return;
+}
+
static int ipc_alloc_security(struct task_struct *task,
struct kern_ipc_perm *perm,
u16 sclass)
@@ -4661,6 +4682,30 @@ static void selinux_release_secctx(char
kfree(secdata);
}
+static int selinux_audit_rule_supplied(struct audit_krule *rule)
+{
+ int i;
+
+ for (i = 0; i < rule->field_count; i++) {
+ struct audit_field *f = &rule->fields[i];
+ switch (f->type) {
+ case AUDIT_SUBJ_USER:
+ case AUDIT_SUBJ_ROLE:
+ case AUDIT_SUBJ_TYPE:
+ case AUDIT_SUBJ_SEN:
+ case AUDIT_SUBJ_CLR:
+ case AUDIT_OBJ_USER:
+ case AUDIT_OBJ_ROLE:
+ case AUDIT_OBJ_TYPE:
+ case AUDIT_OBJ_LEV_LOW:
+ case AUDIT_OBJ_LEV_HIGH:
+ return 1;
+ }
+ }
+
+ return 0;
+}
+
#ifdef CONFIG_KEYS
static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
@@ -4843,6 +4888,12 @@ static struct security_operations selinu
.secid_to_secctx = selinux_secid_to_secctx,
.release_secctx = selinux_release_secctx,
+ .inode_getsecid = selinux_get_inode_sid,
+ .ipc_getsecid = selinux_get_ipc_sid,
+ .audit_rule_supplied = selinux_audit_rule_supplied,
+ .audit_rule_match = selinux_audit_rule_match,
+ .audit_rule_init = selinux_audit_rule_init,
+ .audit_rule_free = selinux_audit_rule_free,
.unix_stream_connect = selinux_socket_unix_stream_connect,
.unix_may_send = selinux_socket_unix_may_send,
diff -uprN -X linux-2.6.23-rc4-base/Documentation/dontdiff linux-2.6.23-rc4-base/security/selinux/include/security.h linux-2.6.23-rc4-audit/security/selinux/include/security.h
--- linux-2.6.23-rc4-base/security/selinux/include/security.h 2007-08-26 23:51:50.000000000 -0700
+++ linux-2.6.23-rc4-audit/security/selinux/include/security.h 2007-08-27 00:52:10.000000000 -0700
@@ -129,5 +129,43 @@ static inline int security_netlbl_sid_to
const char *security_get_initial_sid_context(u32 sid);
+/**
+ * selinux_audit_rule_init - alloc/init an selinux audit rule structure.
+ * @field: the field this rule refers to
+ * @op: the operater the rule uses
+ * @rulestr: the text "target" of the rule
+ * @vpp: pointer to the new rule structure returned via this
+ *
+ * Returns 0 if successful, -errno if not. On success, the rule structure
+ * will be allocated internally. The caller must free this structure with
+ * selinux_audit_rule_free() after use.
+ */
+int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vpp);
+
+/**
+ * selinux_audit_rule_free - free an selinux audit rule structure.
+ * @vp: pointer to the audit rule to be freed
+ *
+ * This will free all memory associated with the given rule.
+ * If @rule is NULL, no operation is performed.
+ */
+void selinux_audit_rule_free(void *vp);
+
+struct audit_context;
+/**
+ * selinux_audit_rule_match - determine if a context ID matches a rule.
+ * @sid: the context ID to check
+ * @field: the field this rule refers to
+ * @op: the operater the rule uses
+ * @vp: pointer to the audit rule to check against
+ * @actx: the audit context (can be NULL) associated with the check
+ *
+ * Returns 1 if the context id matches the rule, 0 if it does not, and
+ * -errno on failure.
+ */
+int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *vp,
+ struct audit_context *actx);
+
+
#endif /* _SELINUX_SECURITY_H_ */
diff -uprN -X linux-2.6.23-rc4-base/Documentation/dontdiff linux-2.6.23-rc4-base/security/selinux/ss/services.c linux-2.6.23-rc4-audit/security/selinux/ss/services.c
--- linux-2.6.23-rc4-base/security/selinux/ss/services.c 2007-08-26 23:51:50.000000000 -0700
+++ linux-2.6.23-rc4-audit/security/selinux/ss/services.c 2007-08-27 00:52:10.000000000 -0700
@@ -2107,17 +2107,19 @@ struct selinux_audit_rule {
struct context au_ctxt;
};
-void selinux_audit_rule_free(struct selinux_audit_rule *rule)
+void selinux_audit_rule_free(void *vp)
{
+ struct selinux_audit_rule *rule = (struct selinux_audit_rule*)vp;
+
if (rule) {
context_destroy(&rule->au_ctxt);
kfree(rule);
}
}
-int selinux_audit_rule_init(u32 field, u32 op, char *rulestr,
- struct selinux_audit_rule **rule)
+int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vpp)
{
+ struct selinux_audit_rule **rule = (struct selinux_audit_rule**)vpp;
struct selinux_audit_rule *tmprule;
struct role_datum *roledatum;
struct type_datum *typedatum;
@@ -2208,10 +2210,10 @@ int selinux_audit_rule_init(u32 field, u
return rc;
}
-int selinux_audit_rule_match(u32 sid, u32 field, u32 op,
- struct selinux_audit_rule *rule,
+int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *vp,
struct audit_context *actx)
{
+ struct selinux_audit_rule *rule = (struct selinux_audit_rule*)vp;
struct context *ctxt;
struct mls_level *level;
int match = 0;
@@ -2320,7 +2322,7 @@ out:
return match;
}
-static int (*aurule_callback)(void) = NULL;
+static int (*aurule_callback)(void) = audit_rule_update_callout;
static int aurule_avc_callback(u32 event, u32 ssid, u32 tsid,
u16 class, u32 perms, u32 *retained)
@@ -2345,11 +2347,6 @@ static int __init aurule_init(void)
}
__initcall(aurule_init);
-void selinux_audit_set_callback(int (*callback)(void))
-{
- aurule_callback = callback;
-}
-
#ifdef CONFIG_NETLABEL
/*
* NetLabel cache structure
18 years, 9 months
- 1
- 0
Audit rules keys
by Henning, Arthur C. (CSL)
Using system-config-audit getting key (-k) configuration errors when
saving changes.
[root@localhost ~]# Stopping auditd: [ OK ]
Starting auditd: [ OK ]
key option needs a watch or syscall given prior to it
There was an error in line 9 of /etc/audit/audit.rules
cat /etc/audit/audit.rules
-e 1
-f 2
-b 8192
-r 0
-D
-a entry,always -S adjtimex -S settimeofday
-a entry,always -S clock_settime
-a entry,always -k kill -S kill
-a exit,always -k system-locale -S sethostname
-a exit,always -F exit=-13 -k creation -S creat -S mkdir -S mknod -S
link -S symlink
-a exit,always -F exit=-13 -k creation -S mkdirat -S mknodat -S linkat
-S symlinkat
If I remove the key from line 9 and save, get error reported line 10,
etc.
Started with NISPOM.rules contrib file.
Art Henning (CSL)
Enterprise IT Solutions
Northrop Grumman Corp
art.henning(a)ngc.com
18 years, 9 months
- 4
- 5
audit 1.6 released
by Steve Grubb
Hi,
I've just released a new version of the audit daemon. It can be downloaded
from http://people.redhat.com/sgrubb/audit It will also be in rawhide
soon. The Changelog is:
- Adding perm field should not set syscall added flag in auditctl
- Fix segfault when aureport -if option is used
- Fix auditctl to better check keys on rule lines
- Add support for audit by TTY and other new event types
- Auditd config option for group permission of audit logs
- Swig messed up a variable in ppc's libaudit python bindings causing crashes.
(#251327)
- New audit event dispatcher
- Update syscall tables for 2.6.23 kernel
This release introduces a new multi-threaded event dispatcher. Its working
according to my testing, but still needs some work to fill out all the
features. Right now, it only runs internal plugins. They are af_unix and
syslog.
-Steve
18 years, 10 months
- 1
- 0
[PATCH] dist target fixes
by John D. Ramsdell
Steve,
I discovered a few more files that are being mistakenly omitted when
using the dist target.
John
Only in b/audit-1.5.6: ab.diff
Only in b/audit-1.5.6: ac.diff
Only in b/audit-1.5.6: aclocal.m4
Only in b/audit-1.5.6/audisp: Makefile
Only in b/audit-1.5.6/audisp: Makefile.in
Only in b/audit-1.5.6: audit-1.5.6.tar.gz
Only in b/audit-1.5.6/auparse: .deps
Only in b/audit-1.5.6/auparse: Makefile
Only in b/audit-1.5.6/auparse: Makefile.in
Only in b/audit-1.5.6/auparse/test: .deps
Only in b/audit-1.5.6/auparse/test: Makefile
diff -ur a/audit-1.5.6/auparse/test/Makefile.am b/audit-1.5.6/auparse/test/Makefile.am
--- a/audit-1.5.6/auparse/test/Makefile.am 2007-05-17 15:26:49.000000000 -0400
+++ b/audit-1.5.6/auparse/test/Makefile.am 2007-07-30 07:20:28.000000000 -0400
@@ -50,6 +50,4 @@
../../bindings/python/build/*/auparse.so: ../../bindings/python/auparse_python.c
cd ../../bindings/python && make
-
-
-
+EXTRA_DIST = auparse_test.py auparse_test.ref
diff -ur a/audit-1.5.6/auparse/test/Makefile.in b/audit-1.5.6/auparse/test/Makefile.in
--- a/audit-1.5.6/auparse/test/Makefile.in 2007-07-25 14:23:12.000000000 -0400
+++ b/audit-1.5.6/auparse/test/Makefile.in 2007-07-30 07:54:28.000000000 -0400
@@ -213,6 +213,7 @@
auparse_test_LDFLAGS = -static
auparse_test_LDADD = -L../.libs/ -L../../lib/.libs -lauparse -laudit
auparse_test_DEPENDENCIES = ../.libs/libauparse.a ../*.c ../*.h
+EXTRA_DIST = auparse_test.py auparse_test.ref
all: all-am
.SUFFIXES:
Only in b/audit-1.5.6: autom4te.cache
Only in b/audit-1.5.6/bindings: Makefile
Only in b/audit-1.5.6/bindings: Makefile.in
Only in b/audit-1.5.6/bindings/python: Makefile
Only in b/audit-1.5.6/bindings/python: Makefile.in
Only in b/audit-1.5.6: b.txt
Only in b/audit-1.5.6: config.h
Only in b/audit-1.5.6: config.h.in
Only in b/audit-1.5.6: config.log
Only in b/audit-1.5.6: config.status
Only in b/audit-1.5.6: configure
Only in b/audit-1.5.6: c.txt
Only in b/audit-1.5.6/docs: Makefile
Only in b/audit-1.5.6/docs: Makefile.in
Only in b/audit-1.5.6/init.d: Makefile
diff -ur a/audit-1.5.6/init.d/Makefile.am b/audit-1.5.6/init.d/Makefile.am
--- a/audit-1.5.6/init.d/Makefile.am 2007-07-25 14:10:53.000000000 -0400
+++ b/audit-1.5.6/init.d/Makefile.am 2007-07-30 07:25:54.000000000 -0400
@@ -22,7 +22,7 @@
CONFIG_CLEAN_FILES = Makefile.in *.rej *.orig
EXTRA_DIST = auditd.init auditd.sysconfig auditd.conf audit.rules \
- auditd.cron libaudit.conf
+ auditd.cron libaudit.conf audispd.conf
libconfig = libaudit.conf
dispconfig = audispd.conf
dispconfigdir = $(sysconfdir)/audisp
Only in b/audit-1.5.6/init.d: Makefile.am~
Only in b/audit-1.5.6/init.d: Makefile.in
Only in b/audit-1.5.6/lib: .deps
Only in b/audit-1.5.6/lib: Makefile
Only in b/audit-1.5.6/lib: Makefile.in
Only in b/audit-1.5.6: libtool
Only in b/audit-1.5.6: Makefile
diff -ur a/audit-1.5.6/Makefile.am b/audit-1.5.6/Makefile.am
--- a/audit-1.5.6/Makefile.am 2007-06-27 06:19:18.000000000 -0400
+++ b/audit-1.5.6/Makefile.am 2007-07-30 07:53:45.000000000 -0400
@@ -21,9 +21,14 @@
# Rickard E. (Rik) Faith <faith(a)redhat.com>
#
-SUBDIRS = lib auparse src/mt src audisp swig bindings init.d docs system-config-audit
-EXTRA_DIST = ChangeLog AUTHORS NEWS README sample.rules contrib/capp.rules contrib/nispom.rules contrib/lspp.rules contrib/skeleton.c README-install audit.spec
-CONFIG_CLEAN_FILES = Makefile.in aclocal.m4* config.h.* configure debug*.list config/*
+SUBDIRS = lib auparse src/mt src audisp swig bindings init.d docs \
+system-config-audit
+EXTRA_DIST = ChangeLog AUTHORS NEWS README sample.rules \
+contrib/capp.rules contrib/nispom.rules contrib/lspp.rules \
+contrib/skeleton.c contrib/avc_snap contrib/avc_syslog \
+system-config-audit.lang README-install audit.spec
+CONFIG_CLEAN_FILES = Makefile.in aclocal.m4* config.h.* configure \
+debug*.list config/*
clean-generic:
rm -rf autom4te*.cache
Only in b/audit-1.5.6: Makefile.am~
Only in b/audit-1.5.6: Makefile.in
Only in b/audit-1.5.6: oaudit-1.5.6.tar.gz
Only in b/audit-1.5.6/src: Makefile
Only in b/audit-1.5.6/src: Makefile.in
Only in b/audit-1.5.6/src/mt: audit_logging.c
Only in b/audit-1.5.6/src/mt: deprecated.c
Only in b/audit-1.5.6/src/mt: libaudit.c
Only in b/audit-1.5.6/src/mt: libaudit.h
Only in b/audit-1.5.6/src/mt: lookup_table.c
Only in b/audit-1.5.6/src/mt: Makefile
Only in b/audit-1.5.6/src/mt: Makefile.in
Only in b/audit-1.5.6/src/mt: message.c
Only in b/audit-1.5.6/src/mt: netlink.c
Only in b/audit-1.5.6/src/mt: private.h
Only in b/audit-1.5.6: stamp-h1
Only in b/audit-1.5.6/swig: audit.py
Only in b/audit-1.5.6/swig: audit_wrap.c
Only in b/audit-1.5.6/swig: .deps
Only in b/audit-1.5.6/swig: Makefile
Only in b/audit-1.5.6/swig: Makefile.in
Only in b/audit-1.5.6/system-config-audit: config.log
Only in b/audit-1.5.6/system-config-audit: config.status
Only in b/audit-1.5.6/system-config-audit: intltool-extract
Only in b/audit-1.5.6/system-config-audit: intltool-merge
Only in b/audit-1.5.6/system-config-audit: intltool-update
Only in b/audit-1.5.6/system-config-audit: libtool
Only in b/audit-1.5.6/system-config-audit: m4.txt
Only in b/audit-1.5.6/system-config-audit: Makefile
diff -ur a/audit-1.5.6/system-config-audit/Makefile.am b/audit-1.5.6/system-config-audit/Makefile.am
--- a/audit-1.5.6/system-config-audit/Makefile.am 2007-07-25 14:25:05.000000000 -0400
+++ b/audit-1.5.6/system-config-audit/Makefile.am 2007-07-30 07:49:09.000000000 -0400
@@ -58,11 +58,21 @@
CLEANFILES = $(applications_DATA) $(bin_SCRIPTS) $(nodist_pkgdata_PYTHON) \
admin/system-config-audit-server.console
DISTCLEANFILES = intltool-extract intltool-merge intltool-update
-EXTRA_DIST = admin/intltool-extract.in admin/intltool-merge.in \
- admin/intltool-update.in admin/system-config-audit-server.console.in \
- admin/system-config-audit-server.pam \
- src/settings.py.in src/system-config-audit.in \
- system-config-audit.desktop.in
+EXTRA_DIST = admin/intltool-extract.in admin/intltool-merge.in \
+ admin/intltool-update.in \
+ admin/system-config-audit-server.console.in \
+ admin/system-config-audit-server.pam src/settings.py.in \
+ src/system-config-audit.in system-config-audit.desktop.in \
+ m4/codeset.m4 m4/gettext.m4 m4/glibc21.m4 m4/glibc2.m4 \
+ m4/iconv.m4 m4/intdiv0.m4 m4/intldir.m4 m4/intl.m4 \
+ m4/intmax.m4 m4/inttypes_h.m4 m4/inttypes.m4 \
+ m4/inttypes-pri.m4 m4/isc-posix.m4 m4/lcmessage.m4 \
+ m4/lib-ld.m4 m4/lib-link.m4 m4/lib-prefix.m4 m4/lock.m4 \
+ m4/longdouble.m4 m4/longlong.m4 m4/nls.m4 m4/po.m4 \
+ m4/printf-posix.m4 m4/progtest.m4 m4/signed.m4 m4/size_max.m4 \
+ m4/stdint_h.m4 m4/uintmax_t.m4 m4/ulonglong.m4 \
+ m4/visibility.m4 m4/wchar_t.m4 m4/wint_t.m4 m4/xsize.m4
+
src_system_config_audit_server_SOURCES = src/server.c src/server.h
src_system_config_audit_server_CPPFLAGS = $(AM_CPPFLAGS) \
Only in b/audit-1.5.6/system-config-audit: Makefile.am~
diff -ur a/audit-1.5.6/system-config-audit/Makefile.in b/audit-1.5.6/system-config-audit/Makefile.in
--- a/audit-1.5.6/system-config-audit/Makefile.in 2007-07-25 14:23:56.000000000 -0400
+++ b/audit-1.5.6/system-config-audit/Makefile.in 2007-07-30 07:50:07.000000000 -0400
@@ -314,12 +314,21 @@
CLEANFILES = $(applications_DATA) $(bin_SCRIPTS) $(nodist_pkgdata_PYTHON) \
admin/system-config-audit-server.console
-DISTCLEANFILES = intltool-extract intltool-merge intltool-update src/.libs
-EXTRA_DIST = admin/intltool-extract.in admin/intltool-merge.in \
- admin/intltool-update.in admin/system-config-audit-server.console.in \
- admin/system-config-audit-server.pam \
- src/settings.py.in src/system-config-audit.in \
- system-config-audit.desktop.in
+DISTCLEANFILES = intltool-extract intltool-merge intltool-update
+EXTRA_DIST = admin/intltool-extract.in admin/intltool-merge.in \
+ admin/intltool-update.in \
+ admin/system-config-audit-server.console.in \
+ admin/system-config-audit-server.pam src/settings.py.in \
+ src/system-config-audit.in system-config-audit.desktop.in \
+ m4/codeset.m4 m4/gettext.m4 m4/glibc21.m4 m4/glibc2.m4 \
+ m4/iconv.m4 m4/intdiv0.m4 m4/intldir.m4 m4/intl.m4 \
+ m4/intmax.m4 m4/inttypes_h.m4 m4/inttypes.m4 \
+ m4/inttypes-pri.m4 m4/isc-posix.m4 m4/lcmessage.m4 \
+ m4/lib-ld.m4 m4/lib-link.m4 m4/lib-prefix.m4 m4/lock.m4 \
+ m4/longdouble.m4 m4/longlong.m4 m4/nls.m4 m4/po.m4 \
+ m4/printf-posix.m4 m4/progtest.m4 m4/signed.m4 m4/size_max.m4 \
+ m4/stdint_h.m4 m4/uintmax_t.m4 m4/ulonglong.m4 \
+ m4/visibility.m4 m4/wchar_t.m4 m4/wint_t.m4 m4/xsize.m4
src_system_config_audit_server_SOURCES = src/server.c src/server.h
src_system_config_audit_server_CPPFLAGS = $(AM_CPPFLAGS) \
Only in b/audit-1.5.6/system-config-audit/po: Makefile
Only in b/audit-1.5.6/system-config-audit/po: Makefile.in
Only in b/audit-1.5.6/system-config-audit/po: POTFILES
Only in b/audit-1.5.6/system-config-audit/po: stamp-it
Only in b/audit-1.5.6/system-config-audit/src: config.h
Only in b/audit-1.5.6/system-config-audit/src: .deps
Only in b/audit-1.5.6/system-config-audit/src: stamp-h1
18 years, 10 months
- 3
- 10
Re: [PATCH] improved xfrm_audit_log() patch
by Joy Latten
On Tue, 2007-08-07 at 18:32 -0700, David Miller wrote:
>From: Joy Latten <latten(a)austin.ibm.com>
>Date: Thu, 2 Aug 2007 15:56:47 -0500
>
>> @@ -426,10 +426,15 @@ struct xfrm_audit
>> };
>>
>> #ifdef CONFIG_AUDITSYSCALL
>> -extern void xfrm_audit_log(uid_t auid, u32 secid, int type, int result,
>> - struct xfrm_policy *xp, struct xfrm_state *x);
>> +extern void xfrm_audit_log(struct xfrm_audit audit_info, int result,
>> + __be32 flowid, struct xfrm_policy *xp,
>> + struct xfrm_state *x, char *buf);
>
>Passing audit_info as an aggregate argument puts them into
>previous argument registers, or if they are not enough it
>goes either partially of wholly onto the stack, depending
>upon architecture.
>
>In fact you've made the argument register usage worse than
>in your previous revision. :-/
>
>Perhaps you meant to pass "struct xfrm_audit *" instead?
Revised patch to pass pointer to struct xfrm_audit.
Sorry, I missed that.
Signed-off-by: Joy Latten <latten(a)austin.ibm.com>
diff -urpN linux-2.6.22/include/linux/audit.h linux-2.6.22.patch/include/linux/audit.h
--- linux-2.6.22/include/linux/audit.h 2007-08-14 18:13:53.000000000 -0500
+++ linux-2.6.22.patch/include/linux/audit.h 2007-08-14 19:08:42.000000000 -0500
@@ -112,6 +112,7 @@
#define AUDIT_MAC_IPSEC_DELSA 1412 /* Delete a XFRM state */
#define AUDIT_MAC_IPSEC_ADDSPD 1413 /* Add a XFRM policy */
#define AUDIT_MAC_IPSEC_DELSPD 1414 /* Delete a XFRM policy */
+#define AUDIT_MAC_IPSEC_EVENT 1415 /* Audit IPSec events */
#define AUDIT_FIRST_KERN_ANOM_MSG 1700
#define AUDIT_LAST_KERN_ANOM_MSG 1799
diff -urpN linux-2.6.22/include/net/xfrm.h linux-2.6.22.patch/include/net/xfrm.h
--- linux-2.6.22/include/net/xfrm.h 2007-08-14 18:13:53.000000000 -0500
+++ linux-2.6.22.patch/include/net/xfrm.h 2007-08-14 19:08:42.000000000 -0500
@@ -426,10 +426,15 @@ struct xfrm_audit
};
#ifdef CONFIG_AUDITSYSCALL
-extern void xfrm_audit_log(uid_t auid, u32 secid, int type, int result,
- struct xfrm_policy *xp, struct xfrm_state *x);
+extern void xfrm_audit_log(struct xfrm_audit *audit_info, int result,
+ __be32 flowid, struct xfrm_policy *xp,
+ struct xfrm_state *x, char *buf);
+
+extern void xfrm_get_auditinfo(struct sk_buff *skb,
+ struct xfrm_audit *audit_info);
#else
-#define xfrm_audit_log(a,s,t,r,p,x) do { ; } while (0)
+#define xfrm_audit_log(a,r,f,p,s,b) do { ; } while (0)
+#define xfrm_get_auditinfo(s, a) do { ; } while (0)
#endif /* CONFIG_AUDITSYSCALL */
static inline void xfrm_pol_hold(struct xfrm_policy *policy)
diff -urpN linux-2.6.22/net/key/af_key.c linux-2.6.22.patch/net/key/af_key.c
--- linux-2.6.22/net/key/af_key.c 2007-08-14 18:13:53.000000000 -0500
+++ linux-2.6.22.patch/net/key/af_key.c 2007-08-14 19:08:42.000000000 -0500
@@ -1450,6 +1450,7 @@ static int pfkey_add(struct sock *sk, st
struct xfrm_state *x;
int err;
struct km_event c;
+ struct xfrm_audit audit_info;
x = pfkey_msg2xfrm_state(hdr, ext_hdrs);
if (IS_ERR(x))
@@ -1461,8 +1462,8 @@ static int pfkey_add(struct sock *sk, st
else
err = xfrm_state_update(x);
- xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
- AUDIT_MAC_IPSEC_ADDSA, err ? 0 : 1, NULL, x);
+ xfrm_get_auditinfo(0, &audit_info);
+ xfrm_audit_log(&audit_info, err ? 0 : 1, 0, 0, x, "SAD-add");
if (err < 0) {
x->km.state = XFRM_STATE_DEAD;
@@ -1487,6 +1488,7 @@ static int pfkey_delete(struct sock *sk,
struct xfrm_state *x;
struct km_event c;
int err;
+ struct xfrm_audit audit_info;
if (!ext_hdrs[SADB_EXT_SA-1] ||
!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
@@ -1515,8 +1517,9 @@ static int pfkey_delete(struct sock *sk,
c.event = XFRM_MSG_DELSA;
km_state_notify(x, &c);
out:
- xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
- AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x);
+ xfrm_get_auditinfo(0, &audit_info);
+ xfrm_audit_log(&audit_info, err ? 0 : 1, 0, 0, x, "SAD-delete");
+
xfrm_state_put(x);
return err;
@@ -1691,8 +1694,7 @@ static int pfkey_flush(struct sock *sk,
if (proto == 0)
return -EINVAL;
- audit_info.loginuid = audit_get_loginuid(current->audit_context);
- audit_info.secid = 0;
+ xfrm_get_auditinfo(0, &audit_info);
err = xfrm_state_flush(proto, &audit_info);
if (err)
return err;
@@ -2182,6 +2184,7 @@ static int pfkey_spdadd(struct sock *sk,
struct xfrm_policy *xp;
struct km_event c;
struct sadb_x_sec_ctx *sec_ctx;
+ struct xfrm_audit audit_info;
if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
ext_hdrs[SADB_EXT_ADDRESS_DST-1]) ||
@@ -2268,8 +2271,8 @@ static int pfkey_spdadd(struct sock *sk,
err = xfrm_policy_insert(pol->sadb_x_policy_dir-1, xp,
hdr->sadb_msg_type != SADB_X_SPDUPDATE);
- xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
- AUDIT_MAC_IPSEC_ADDSPD, err ? 0 : 1, xp, NULL);
+ xfrm_get_auditinfo(0, &audit_info);
+ xfrm_audit_log(&audit_info, err ? 0 : 1, 0, xp, 0, "SPD-add");
if (err)
goto out;
@@ -2301,6 +2304,7 @@ static int pfkey_spddelete(struct sock *
struct xfrm_selector sel;
struct km_event c;
struct sadb_x_sec_ctx *sec_ctx;
+ struct xfrm_audit audit_info;
if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
ext_hdrs[SADB_EXT_ADDRESS_DST-1]) ||
@@ -2352,8 +2356,8 @@ static int pfkey_spddelete(struct sock *
if (xp == NULL)
return -ENOENT;
- xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
- AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
+ xfrm_get_auditinfo(0, &audit_info);
+ xfrm_audit_log(&audit_info, err ? 0 : 1, 0, xp, 0, "SPD-delete");
if (err)
goto out;
@@ -2613,8 +2617,10 @@ static int pfkey_spdget(struct sock *sk,
return -ENOENT;
if (delete) {
- xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
- AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
+ struct xfrm_audit audit_info;
+
+ xfrm_get_auditinfo(0, &audit_info);
+ xfrm_audit_log(&audit_info, err ? 0 : 1, 0, xp, 0, "SPD-delete");
if (err)
goto out;
@@ -2691,8 +2697,7 @@ static int pfkey_spdflush(struct sock *s
struct xfrm_audit audit_info;
int err;
- audit_info.loginuid = audit_get_loginuid(current->audit_context);
- audit_info.secid = 0;
+ xfrm_get_auditinfo(0, &audit_info);
err = xfrm_policy_flush(XFRM_POLICY_TYPE_MAIN, &audit_info);
if (err)
return err;
diff -urpN linux-2.6.22/net/xfrm/xfrm_policy.c linux-2.6.22.patch/net/xfrm/xfrm_policy.c
--- linux-2.6.22/net/xfrm/xfrm_policy.c 2007-08-14 18:14:51.000000000 -0500
+++ linux-2.6.22.patch/net/xfrm/xfrm_policy.c 2007-08-14 19:08:42.000000000 -0500
@@ -850,10 +850,8 @@ xfrm_policy_flush_secctx_check(u8 type,
continue;
err = security_xfrm_policy_delete(pol);
if (err) {
- xfrm_audit_log(audit_info->loginuid,
- audit_info->secid,
- AUDIT_MAC_IPSEC_DELSPD, 0,
- pol, NULL);
+ xfrm_audit_log(audit_info, 0, 0,
+ pol, 0, "SPD-delete");
return err;
}
}
@@ -865,10 +863,8 @@ xfrm_policy_flush_secctx_check(u8 type,
continue;
err = security_xfrm_policy_delete(pol);
if (err) {
- xfrm_audit_log(audit_info->loginuid,
- audit_info->secid,
- AUDIT_MAC_IPSEC_DELSPD,
- 0, pol, NULL);
+ xfrm_audit_log(audit_info, 0, 0,
+ pol, 0, "SPD-delete");
return err;
}
}
@@ -909,8 +905,7 @@ int xfrm_policy_flush(u8 type, struct xf
hlist_del(&pol->byidx);
write_unlock_bh(&xfrm_policy_lock);
- xfrm_audit_log(audit_info->loginuid, audit_info->secid,
- AUDIT_MAC_IPSEC_DELSPD, 1, pol, NULL);
+ xfrm_audit_log(audit_info, 1, 0, pol, 0, "SPD-delete");
xfrm_policy_kill(pol);
killed++;
@@ -930,10 +925,8 @@ int xfrm_policy_flush(u8 type, struct xf
hlist_del(&pol->byidx);
write_unlock_bh(&xfrm_policy_lock);
- xfrm_audit_log(audit_info->loginuid,
- audit_info->secid,
- AUDIT_MAC_IPSEC_DELSPD, 1,
- pol, NULL);
+ xfrm_audit_log(audit_info, 1, 0, pol, 0,
+ "SPD-delete");
xfrm_policy_kill(pol);
killed++;
@@ -2151,114 +2144,88 @@ int xfrm_bundle_ok(struct xfrm_policy *p
EXPORT_SYMBOL(xfrm_bundle_ok);
#ifdef CONFIG_AUDITSYSCALL
-/* Audit addition and deletion of SAs and ipsec policy */
+/* Audit ipsec events */
-void xfrm_audit_log(uid_t auid, u32 sid, int type, int result,
- struct xfrm_policy *xp, struct xfrm_state *x)
+void xfrm_get_auditinfo(struct sk_buff *skb, struct xfrm_audit *audit_info)
{
+ if (skb) {
+ audit_info->secid = NETLINK_CB(skb).sid;
+ audit_info->loginuid = NETLINK_CB(skb).loginuid;
+ } else {
+ audit_info->loginuid =
+ audit_get_loginuid(current->audit_context);
+ audit_info->secid = 0;
+ }
+}
+
+EXPORT_SYMBOL(xfrm_get_auditinfo);
+
+static void do_xfrm_audit_log(struct audit_buffer *audit_buf,
+ u16 family, xfrm_address_t saddr,
+ xfrm_address_t daddr, struct xfrm_sec_ctx *sctx,
+ __be32 spi)
+{
+ if (sctx)
+ audit_log_format(audit_buf,
+ " sec_alg=%u sec_doi=%u sec_obj=%s",
+ sctx->ctx_alg, sctx->ctx_doi, sctx->ctx_str);
+
+ switch(family) {
+ case AF_INET:
+ audit_log_format(audit_buf,
+ " src=" NIPQUAD_FMT " dst=" NIPQUAD_FMT,
+ NIPQUAD(saddr.a4), NIPQUAD(daddr.a4));
+ break;
+ case AF_INET6:
+ audit_log_format(audit_buf, " src=" NIP6_FMT " dst=" NIP6_FMT,
+ NIP6(*((struct in6_addr *)&saddr.a6)),
+ NIP6(*((struct in6_addr *)&daddr.a6)));
+ break;
+ }
+
+ if (spi)
+ audit_log_format(audit_buf, " spi=%lu(0x%lx)",
+ (unsigned long)ntohl(spi),
+ (unsigned long)ntohl(spi));
+}
+void xfrm_audit_log(struct xfrm_audit *audit_info, int result,
+ __be32 flowlabel, struct xfrm_policy *xp,
+ struct xfrm_state *x, char *buf)
+{
char *secctx;
u32 secctx_len;
- struct xfrm_sec_ctx *sctx = NULL;
struct audit_buffer *audit_buf;
- int family;
extern int audit_enabled;
if (audit_enabled == 0)
return;
- BUG_ON((type == AUDIT_MAC_IPSEC_ADDSA ||
- type == AUDIT_MAC_IPSEC_DELSA) && !x);
- BUG_ON((type == AUDIT_MAC_IPSEC_ADDSPD ||
- type == AUDIT_MAC_IPSEC_DELSPD) && !xp);
-
- audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC, type);
+ audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC,
+ AUDIT_MAC_IPSEC_EVENT);
if (audit_buf == NULL)
return;
- switch(type) {
- case AUDIT_MAC_IPSEC_ADDSA:
- audit_log_format(audit_buf, "SAD add: auid=%u", auid);
- break;
- case AUDIT_MAC_IPSEC_DELSA:
- audit_log_format(audit_buf, "SAD delete: auid=%u", auid);
- break;
- case AUDIT_MAC_IPSEC_ADDSPD:
- audit_log_format(audit_buf, "SPD add: auid=%u", auid);
- break;
- case AUDIT_MAC_IPSEC_DELSPD:
- audit_log_format(audit_buf, "SPD delete: auid=%u", auid);
- break;
- default:
- return;
- }
+ audit_log_format(audit_buf, "op=%s auid=%u", buf, audit_info->loginuid);
- if (sid != 0 &&
- security_secid_to_secctx(sid, &secctx, &secctx_len) == 0) {
+ if (audit_info->secid != 0 &&
+ security_secid_to_secctx(audit_info->secid, &secctx,
+ &secctx_len) == 0)
audit_log_format(audit_buf, " subj=%s", secctx);
- security_release_secctx(secctx, secctx_len);
- } else
+ else
audit_log_task_context(audit_buf);
- if (xp) {
- family = xp->selector.family;
- if (xp->security)
- sctx = xp->security;
- } else {
- family = x->props.family;
- if (x->security)
- sctx = x->security;
- }
-
- if (sctx)
- audit_log_format(audit_buf,
- " sec_alg=%u sec_doi=%u sec_obj=%s",
- sctx->ctx_alg, sctx->ctx_doi, sctx->ctx_str);
-
- switch(family) {
- case AF_INET:
- {
- struct in_addr saddr, daddr;
- if (xp) {
- saddr.s_addr = xp->selector.saddr.a4;
- daddr.s_addr = xp->selector.daddr.a4;
- } else {
- saddr.s_addr = x->props.saddr.a4;
- daddr.s_addr = x->id.daddr.a4;
- }
- audit_log_format(audit_buf,
- " src=%u.%u.%u.%u dst=%u.%u.%u.%u",
- NIPQUAD(saddr), NIPQUAD(daddr));
- }
- break;
- case AF_INET6:
- {
- struct in6_addr saddr6, daddr6;
- if (xp) {
- memcpy(&saddr6, xp->selector.saddr.a6,
- sizeof(struct in6_addr));
- memcpy(&daddr6, xp->selector.daddr.a6,
- sizeof(struct in6_addr));
- } else {
- memcpy(&saddr6, x->props.saddr.a6,
- sizeof(struct in6_addr));
- memcpy(&daddr6, x->id.daddr.a6,
- sizeof(struct in6_addr));
- }
- audit_log_format(audit_buf,
- " src=" NIP6_FMT " dst=" NIP6_FMT,
- NIP6(saddr6), NIP6(daddr6));
- }
- break;
- }
+ if (xp)
+ do_xfrm_audit_log(audit_buf, xp->selector.family,
+ xp->selector.saddr, xp->selector.daddr,
+ xp->security, 0);
if (x)
- audit_log_format(audit_buf, " spi=%lu(0x%lx) protocol=%s",
- (unsigned long)ntohl(x->id.spi),
- (unsigned long)ntohl(x->id.spi),
- x->id.proto == IPPROTO_AH ? "AH" :
- (x->id.proto == IPPROTO_ESP ?
- "ESP" : "IPCOMP"));
+ do_xfrm_audit_log(audit_buf, x->props.family, x->props.saddr,
+ x->id.daddr, x->security, x->id.spi);
+
+ if (flowlabel)
+ audit_log_format(audit_buf, " flowlabel=%u", flowlabel);
audit_log_format(audit_buf, " res=%u", result);
audit_log_end(audit_buf);
diff -urpN linux-2.6.22/net/xfrm/xfrm_state.c linux-2.6.22.patch/net/xfrm/xfrm_state.c
--- linux-2.6.22/net/xfrm/xfrm_state.c 2007-08-14 18:14:51.000000000 -0500
+++ linux-2.6.22.patch/net/xfrm/xfrm_state.c 2007-08-14 19:08:42.000000000 -0500
@@ -239,6 +239,7 @@ static void xfrm_timer_handler(unsigned
long next = LONG_MAX;
int warn = 0;
int err = 0;
+ struct xfrm_audit audit_info;
spin_lock(&x->lock);
if (x->km.state == XFRM_STATE_DEAD)
@@ -301,8 +302,9 @@ expired:
if (!err && x->id.spi)
km_state_expired(x, 1, 0);
- xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
- AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x);
+
+ xfrm_get_auditinfo(0, &audit_info);
+ xfrm_audit_log(&audit_info, err ? 0 : 1, 0, 0, x, "SAD-delete");
out:
spin_unlock(&x->lock);
@@ -403,11 +405,8 @@ xfrm_state_flush_secctx_check(u8 proto,
hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
if (xfrm_id_proto_match(x->id.proto, proto) &&
(err = security_xfrm_state_delete(x)) != 0) {
- xfrm_audit_log(audit_info->loginuid,
- audit_info->secid,
- AUDIT_MAC_IPSEC_DELSA,
- 0, NULL, x);
-
+ xfrm_audit_log(audit_info, 0, 0, 0, x,
+ "SAD-delete");
return err;
}
}
@@ -443,10 +442,8 @@ restart:
spin_unlock_bh(&xfrm_state_lock);
err = xfrm_state_delete(x);
- xfrm_audit_log(audit_info->loginuid,
- audit_info->secid,
- AUDIT_MAC_IPSEC_DELSA,
- err ? 0 : 1, NULL, x);
+ xfrm_audit_log(audit_info, err ? 0 : 1, 0,
+ 0, x, "SAD-delete");
xfrm_state_put(x);
spin_lock_bh(&xfrm_state_lock);
diff -urpN linux-2.6.22/net/xfrm/xfrm_user.c linux-2.6.22.patch/net/xfrm/xfrm_user.c
--- linux-2.6.22/net/xfrm/xfrm_user.c 2007-08-14 18:13:54.000000000 -0500
+++ linux-2.6.22.patch/net/xfrm/xfrm_user.c 2007-08-14 19:09:14.000000000 -0500
@@ -447,6 +447,7 @@ static int xfrm_add_sa(struct sk_buff *s
struct xfrm_state *x;
int err;
struct km_event c;
+ struct xfrm_audit audit_info;
err = verify_newsa_info(p, xfrma);
if (err)
@@ -462,8 +463,8 @@ static int xfrm_add_sa(struct sk_buff *s
else
err = xfrm_state_update(x);
- xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
- AUDIT_MAC_IPSEC_ADDSA, err ? 0 : 1, NULL, x);
+ xfrm_get_auditinfo(skb, &audit_info);
+ xfrm_audit_log(&audit_info, err ? 0 : 1, 0, 0, x, "SAD-add");
if (err < 0) {
x->km.state = XFRM_STATE_DEAD;
@@ -521,6 +522,7 @@ static int xfrm_del_sa(struct sk_buff *s
int err = -ESRCH;
struct km_event c;
struct xfrm_usersa_id *p = NLMSG_DATA(nlh);
+ struct xfrm_audit audit_info;
x = xfrm_user_state_lookup(p, xfrma, &err);
if (x == NULL)
@@ -545,8 +547,8 @@ static int xfrm_del_sa(struct sk_buff *s
km_state_notify(x, &c);
out:
- xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
- AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x);
+ xfrm_get_auditinfo(skb, &audit_info);
+ xfrm_audit_log(&audit_info, err ? 0 : 1, 0, 0, x, "SAD-delete");
xfrm_state_put(x);
return err;
}
@@ -1137,6 +1139,7 @@ static int xfrm_add_policy(struct sk_buf
struct km_event c;
int err;
int excl;
+ struct xfrm_audit audit_info;
err = verify_newpolicy_info(p);
if (err)
@@ -1155,8 +1158,8 @@ static int xfrm_add_policy(struct sk_buf
* a type XFRM_MSG_UPDPOLICY - JHS */
excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY;
err = xfrm_policy_insert(p->dir, xp, excl);
- xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
- AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
+ xfrm_get_auditinfo(skb, &audit_info);
+ xfrm_audit_log(&audit_info, err ? 0 : 1, 0, xp, 0, "SPD-add");
if (err) {
security_xfrm_policy_free(xp);
@@ -1401,8 +1404,11 @@ static int xfrm_get_policy(struct sk_buf
MSG_DONTWAIT);
}
} else {
- xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
- AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
+ struct xfrm_audit audit_info;
+
+ xfrm_get_auditinfo(skb, &audit_info);
+ xfrm_audit_log(&audit_info, err ? 0 : 1, 0,
+ xp, 0, "SPD-delete");
if (err != 0)
goto out;
@@ -1427,8 +1433,7 @@ static int xfrm_flush_sa(struct sk_buff
struct xfrm_audit audit_info;
int err;
- audit_info.loginuid = NETLINK_CB(skb).loginuid;
- audit_info.secid = NETLINK_CB(skb).sid;
+ xfrm_get_auditinfo(skb, &audit_info);
err = xfrm_state_flush(p->proto, &audit_info);
if (err)
return err;
@@ -1590,8 +1595,7 @@ static int xfrm_flush_policy(struct sk_b
if (err)
return err;
- audit_info.loginuid = NETLINK_CB(skb).loginuid;
- audit_info.secid = NETLINK_CB(skb).sid;
+ xfrm_get_auditinfo(skb, &audit_info);
err = xfrm_policy_flush(type, &audit_info);
if (err)
return err;
@@ -1649,10 +1653,11 @@ static int xfrm_add_pol_expire(struct sk
read_unlock(&xp->lock);
err = 0;
if (up->hard) {
- xfrm_policy_delete(xp, p->dir);
- xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
- AUDIT_MAC_IPSEC_DELSPD, 1, xp, NULL);
+ struct xfrm_audit audit_info;
+ xfrm_policy_delete(xp, p->dir);
+ xfrm_get_auditinfo(skb, &audit_info);
+ xfrm_audit_log(&audit_info, 1, 0, xp, 0, "SPD-delete");
} else {
// reset the timers here?
printk("Dont know what to do with soft policy expire\n");
@@ -1685,9 +1690,11 @@ static int xfrm_add_sa_expire(struct sk_
km_state_expired(x, ue->hard, current->pid);
if (ue->hard) {
+ struct xfrm_audit audit_info;
+
__xfrm_state_delete(x);
- xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
- AUDIT_MAC_IPSEC_DELSA, 1, NULL, x);
+ xfrm_get_auditinfo(skb, &audit_info);
+ xfrm_audit_log(&audit_info, 1, 0, 0, x, "SAD-delete");
}
err = 0;
out:
18 years, 10 months
- 2
- 6
[Announce] RHEL5 LSPP/EAL4 Certification Testsuite has been released again
by Subrata Modak
The Red Hat Enterprise Linux 5 LSPP/EAL4 Certification Testsuite
(rhel5_ibm_eal4_cert_suite2.tgz) has been released again and can be
found at http://ltp.sourceforge.net/ or
http://sourceforge.net/project/showfiles.php?group_id=3382. More details
about this testsuite can be found @'lspp/README' inside the package.
Regards & Thanks--
Subrata Modak
18 years, 10 months
- 2
- 1
linux pam audit
by Thomas Wang
Hi all,
Is it possible to redirect the log messages of a certain
PAM Service into a special file.
I have for example a PAM service "cdsrv" whose messages
are all going to /var/log/messages. But i want all the
messages of the PAM service "cdsrv" (and only these)
in a file /var/log/cdsrv.log.
Is that possible, some magic with /etc/syslog.conf maybe?
Thanks in advance,
tom
18 years, 10 months
- 2
- 1
Auditing failed kill events
by Henning, Arthur C. (CSL)
RHEL kernel 2.6.18-8.el5xen
Audit 1.5.6-1.i386
Audit.rules entry:
-a entry,always -S kill
Attempt to kill a process which is not owned by that user.
$ kill -9 nnnn
bash: kill: (nnnn) - Operation not permitted
$
Get log entry of the failed attempt
# ausearch -i -sv no
type=SYSCALL msg=audit(08/21/2007 09:40:36.832:1458) : arch=i386
syscall=kill success=no exit=-1(Operation not permitted) a0=f8c a1=9
a2=f8c a3=f8c items=0 ppid=3391 pid=3402 auid=art uid=art gid=art
euid=art suid=art fsuid=art egid=art sgid=art fsgid=art tty=pts2
comm=bash exe=/bin/bash subj=user_u:system_r:unconfined_t:s0 key=(null)
Is there a way to indentify the process which the user attempted to
kill? Or by whom the process is owned? The ppid and pid reported are
those of the user attempting to kill a process.
Art Henning (CSL)
Enterprise IT Solutions
Northrop Grumman Corp
art.henning(a)ngc.com
18 years, 10 months
- 7
- 15