November 2019 - Linux-audit - Linux-Audit List Archives

[PATCH] audit: mark expected switch fall-through

by Gustavo A. R. Silva

In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. This patch fixes the following warning: kernel/auditfilter.c: In function ‘audit_krule_to_data’: kernel/auditfilter.c:668:7: warning: this statement may fall through [-Wimplicit-fallthrough=] if (krule->pflags & AUDIT_LOGINUID_LEGACY && !f->val) { ^ kernel/auditfilter.c:674:3: note: here default: ^~~~~~~ Warning level 3 was used: -Wimplicit-fallthrough=3 Notice that, in this particular case, the code comment is modified in accordance with what GCC is expecting to find. This patch is part of the ongoing efforts to enable -Wimplicit-fallthrough. Signed-off-by: Gustavo A. R. Silva <gustavo(a)embeddedor.com> --- kernel/auditfilter.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index add360b46b38..63f8b3f26fab 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -670,7 +670,7 @@ static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule) data->values[i] = AUDIT_UID_UNSET; break; } - /* fallthrough if set */ + /* fall through - if set */ default: data->values[i] = f->val; } -- 2.20.1

4 years, 7 months

3
3
0 / 0

Re: [PATCH v2] kernel: audit.c: Add __rcu notation to RCU pointer

by Joel Fernandes

On Thu, Nov 28, 2019 at 09:02:03PM +0530, Amol Grover wrote: > add __rcu notation to RCU protected global pointer auditd_conn Again, please use proper punctuation and captilization. This is unacceptable. Please put more effort into changelog. Otherwise the patch diff itself looks good to me, with the above nit corrected, you could add my tag to the next revision: Reviewed-by: Joel Fernandes (Google) <joel(a)joelfernandes.org> thanks, - Joel > > Fixes multiple instances of sparse error: > error: incompatible types in comparison expression > (different address spaces) > > Signed-off-by: Amol Grover <frextrite(a)gmail.com> > --- > v2: > - fix erroneous RCU pointer initialization > > kernel/audit.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/kernel/audit.c b/kernel/audit.c > index da8dc0db5bd3..ff7cfc61f53d 100644 > --- a/kernel/audit.c > +++ b/kernel/audit.c > @@ -102,12 +102,13 @@ struct audit_net { > * This struct is RCU protected; you must either hold the RCU lock for reading > * or the associated spinlock for writing. > */ > -static struct auditd_connection { > +struct auditd_connection { > struct pid *pid; > u32 portid; > struct net *net; > struct rcu_head rcu; > -} *auditd_conn = NULL; > +}; > +static struct auditd_connection __rcu *auditd_conn; > static DEFINE_SPINLOCK(auditd_conn_lock); > > /* If audit_rate_limit is non-zero, limit the rate of sending audit records > -- > 2.24.0 >

4 years, 8 months

4
5
0 / 0

[PATCH ghak90 V7 00/21] audit: implement container identifier

by Richard Guy Briggs

Implement kernel audit container identifier. This patchset is a seventh based on the proposal document (V3) posted: https://www.redhat.com/archives/linux-audit/2018-January/msg00014.html The first patch was the last patch from ghak81 that was absorbed into this patchset since its primary justification is the rest of this patchset. The second patch implements the proc fs write to set the audit container identifier of a process, emitting an AUDIT_CONTAINER_OP record to announce the registration of that audit container identifier on that process. This patch requires userspace support for record acceptance and proper type display. The third implements reading the audit container identifier from the proc filesystem for debugging. This patch wasn't planned for upstream inclusion but is starting to become more likely. The fourth converts over from a simple u64 to a list member that includes owner information to check for descendancy, allow process injection into a container and prevent id reuse by other orchestrators. The fifth logs the drop of an audit container identifier once all tasks using that audit container identifier have exited. The 6th limits the total number of containers on a system. The 7th implements the auxiliary record AUDIT_CONTAINER_ID if an audit container identifier is associated with an event. This patch requires userspace support for proper type display. The 8th adds audit daemon signalling provenance through audit_sig_info2. The 9th creates a local audit context to be able to bind a standalone record with a locally created auxiliary record. The 10th patch adds audit container identifier records to the user standalone records. The 11th adds audit container identifier filtering to the exit, exclude and user lists. This patch adds the AUDIT_CONTID field and requires auditctl userspace support for the --contid option. The 12th adds network namespace audit container identifier labelling based on member tasks' audit container identifier labels. The 13th adds audit container identifier support to standalone netfilter records that don't have a task context and lists each container to which that net namespace belongs. The 14th checks that the target is a descendant for nesting and the 15th refactors to avoid a duplicate of the copied function. The 16th and 17th add audit netlink interfaces for the /proc audit_containerid, loginuid and sessionid. The 18th adds tracking and reporting for container nesting. This patch could be split up and the chunks applied to earlier patches if this nesting tracking and reporting approach is acceptable. Arguably this is the only way to be able to report activity in a nested container that also affects its parent containers. The 19th limits the container nesting depth. The 20th adds a mechanism to allow a process to be designated as a container orchestrator/engine in non-init user namespaces and the 21st adds a /proc interface for testing only. Example: Set an audit container identifier of 123456 to the "sleep" task: sleep 2& child=$! echo 123456 > /proc/$child/audit_containerid; echo $? ausearch -ts recent -m container_op echo child:$child contid:$( cat /proc/$child/audit_containerid) This should produce a record such as: type=CONTAINER_OP msg=audit(2018-06-06 12:39:29.636:26949) : op=set opid=2209 contid=123456 old-contid=18446744073709551615 pid=628 auid=root uid=root tty=ttyS0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 comm=bash exe=/usr/bin/bash res=yes Example: Set a filter on an audit container identifier 123459 on /tmp/tmpcontainerid: contid=123459 key=tmpcontainerid auditctl -a exit,always -F dir=/tmp -F perm=wa -F contid=$contid -F key=$key perl -e "sleep 1; open(my \$tmpfile, '>', \"/tmp/$key\"); close(\$tmpfile);" & child=$! echo $contid > /proc/$child/audit_containerid sleep 2 ausearch -i -ts recent -k $key auditctl -d exit,always -F dir=/tmp -F perm=wa -F contid=$contid -F key=$key rm -f /tmp/$key This should produce an event such as: type=CONTAINER_ID msg=audit(2018-06-06 12:46:31.707:26953) : contid=123459 type=PROCTITLE msg=audit(2018-06-06 12:46:31.707:26953) : proctitle=perl -e sleep 1; open(my $tmpfile, '>', "/tmp/tmpcontainerid"); close($tmpfile); type=PATH msg=audit(2018-06-06 12:46:31.707:26953) : item=1 name=/tmp/tmpcontainerid inode=25656 dev=00:26 mode=file,644 ouid=root ogid=root rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 type=PATH msg=audit(2018-06-06 12:46:31.707:26953) : item=0 name=/tmp/ inode=8985 dev=00:26 mode=dir,sticky,777 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:tmp_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 type=CWD msg=audit(2018-06-06 12:46:31.707:26953) : cwd=/root type=SYSCALL msg=audit(2018-06-06 12:46:31.707:26953) : arch=x86_64 syscall=openat success=yes exit=3 a0=0xffffffffffffff9c a1=0x5621f2b81900 a2=O_WRONLY|O_CREAT|O_TRUNC a3=0x1b6 items=2 ppid=628 pid=2232 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=perl exe=/usr/bin/perl subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=tmpcontainerid Example: Test multiple containers on one netns: sleep 5 & child1=$! containerid1=123451 echo $containerid1 > /proc/$child1/audit_containerid sleep 5 & child2=$! containerid2=123452 echo $containerid2 > /proc/$child2/audit_containerid iptables -I INPUT -i lo -p icmp --icmp-type echo-request -j AUDIT --type accept iptables -I INPUT -t mangle -i lo -p icmp --icmp-type echo-request -j MARK --set-mark 0x12345555 sleep 1; bash -c "ping -q -c 1 127.0.0.1 >/dev/null 2>&1" sleep 1; ausearch -i -m NETFILTER_PKT -ts boot|grep mark=0x12345555 ausearch -i -m NETFILTER_PKT -ts boot|grep contid=|grep $containerid1|grep $containerid2 This should produce an event such as: type=NETFILTER_PKT msg=audit(03/15/2019 14:16:13.369:244) : mark=0x12345555 saddr=127.0.0.1 daddr=127.0.0.1 proto=icmp type=CONTAINER_ID msg=audit(03/15/2019 14:16:13.369:244) : contid=123452,123451 Includes the last patch of https://github.com/linux-audit/audit-kernel/issues/81 Please see the github audit kernel issue for the main feature: https://github.com/linux-audit/audit-kernel/issues/90 and the kernel filter code: https://github.com/linux-audit/audit-kernel/issues/91 and the network support: https://github.com/linux-audit/audit-kernel/issues/92 Please see the github audit userspace issue for supporting record types: https://github.com/linux-audit/audit-userspace/issues/51 and filter code: https://github.com/linux-audit/audit-userspace/issues/40 Please see the github audit testsuiite issue for the test case: https://github.com/linux-audit/audit-testsuite/issues/64 Please see the github audit wiki for the feature overview: https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID Changelog: v7 - remove BUG() in audit_comparator64() - rebase on v5.2-rc1 audit/next - resolve merge conflict with ghak111 (signal_info regardless syscall) - resolve merge conflict with ghak73 (audit_field_valid) - resolve merge conflict with ghak64 (saddr_fam filter) - resolve merge conflict with ghak10 (ntp audit) change AUDIT_CONTAINER_ID from 1332 to 1334 - rebase on v5.3-rc1 audit/next - track container owner - only permit setting contid of descendants for nesting - track drop of contid and permit reuse - track and report container nesting - permit filtering on any nested contid - set/get contid and loginuid/sessionid via netlink - implement capcontid to enable orchestrators in non-init user namespaces - limit number of containers - limit depth of container nesting v6 - change TMPBUFLEN from 11 to 21 to cover the decimal value of contid u64 (nhorman) - fix bug overwriting ctx in struct audit_sig_info, move cid above ctx[0] (nhorman) - fix bug skipping remaining fields and not advancing bufp when copying out contid in audit_krule_to_data (omosnacec) - add acks, tidy commit descriptions, other formatting fixes (checkpatch wrong on audit_log_lost) - cast ull for u64 prints - target_cid tracking was moved from the ptrace/signal patch to container_op - target ptrace and signal records were moved from the ptrace/signal patch to container_id - auditd signaller tracking was moved to a new AUDIT_SIGNAL_INFO2 request and record - ditch unnecessary list_empty() checks - check for null net and aunet in audit_netns_contid_add() - swap CONTAINER_OP contid/old-contid order to ease parsing v5 - address loginuid and sessionid syscall scope in ghak104 - address audit_context in CONFIG_AUDIT vs CONFIG_AUDITSYSCALL in ghak105 - remove tty patch, addressed in ghak106 - rebase on audit/next v5.0-rc1 w/ghak59/ghak104/ghak103/ghak100/ghak107/ghak105/ghak106/ghak105sup - update CONTAINER_ID to CONTAINER_OP in patch description - move audit_context in audit_task_info to CONFIG_AUDITSYSCALL - move audit_alloc() and audit_free() out of CONFIG_AUDITSYSCALL and into CONFIG_AUDIT and create audit_{alloc,free}_syscall - use plain kmem_cache_alloc() rather than kmem_cache_zalloc() in audit_alloc() - fix audit_get_contid() declaration type error - move audit_set_contid() from auditsc.c to audit.c - audit_log_contid() returns void - audit_log_contid() handed contid rather than tsk - switch from AUDIT_CONTAINER to AUDIT_CONTAINER_ID for aux record - move audit_log_contid(tsk/contid) & audit_contid_set(tsk)/audit_contid_valid(contid) - switch from tsk to current - audit_alloc_local() calls audit_log_lost() on failure to allocate a context - add AUDIT_USER* non-syscall contid record - cosmetic cleanup double parens, goto out on err - ditch audit_get_ns_contid_list_lock(), fix aunet lock race - switch from all-cpu read spinlock to rcu, keep spinlock for write - update audit_alloc_local() to use ktime_get_coarse_real_ts64() - add nft_log support - add call from do_exit() in audit_free() to remove contid from netns - relegate AUDIT_CONTAINER ref= field (was op=) to debug patch v4 - preface set with ghak81:"collect audit task parameters" - add shallyn and sgrubb acks - rename feature bitmap macro - rename cid_valid() to audit_contid_valid() - rename AUDIT_CONTAINER_ID to AUDIT_CONTAINER_OP - delete audit_get_contid_list() from headers - move work into inner if, delete "found" - change netns contid list function names - move exports for audit_log_contid audit_alloc_local audit_free_context to non-syscall patch - list contids CSV - pass in gfp flags to audit_alloc_local() (fix audit_alloc_context callers) - use "local" in lieu of abusing in_syscall for auditsc_get_stamp() - read_lock(&tasklist_lock) around children and thread check - task_lock(tsk) should be taken before first check of tsk->audit - add spin lock to contid list in aunet - restrict /proc read to CAP_AUDIT_CONTROL - remove set again prohibition and inherited flag - delete contidion spelling fix from patchset, send to netdev/linux-wireless v3 - switched from containerid in task_struct to audit_task_info (depends on ghak81) - drop INVALID_CID in favour of only AUDIT_CID_UNSET - check for !audit_task_info, throw -ENOPROTOOPT on set - changed -EPERM to -EEXIST for parent check - return AUDIT_CID_UNSET if !audit_enabled - squash child/thread check patch into AUDIT_CONTAINER_ID patch - changed -EPERM to -EBUSY for child check - separate child and thread checks, use -EALREADY for latter - move addition of op= from ptrace/signal patch to AUDIT_CONTAINER patch - fix && to || bashism in ptrace/signal patch - uninline and export function for audit_free_context() - drop CONFIG_CHANGE, FEATURE_CHANGE, ANOM_ABEND, ANOM_SECCOMP patches - move audit_enabled check (xt_AUDIT) - switched from containerid list in struct net to net_generic's struct audit_net - move containerid list iteration into audit (xt_AUDIT) - create function to move namespace switch into audit - switched /proc/PID/ entry from containerid to audit_containerid - call kzalloc with GFP_ATOMIC on in_atomic() in audit_alloc_context() - call kzalloc with GFP_ATOMIC on in_atomic() in audit_log_container_info() - use xt_net(par) instead of sock_net(skb->sk) to get net - switched record and field names: initial CONTAINER_ID, aux CONTAINER, field CONTID - allow to set own contid - open code audit_set_containerid - add contid inherited flag - ccontainerid and pcontainerid eliminated due to inherited flag - change name of container list funcitons - rename containerid to contid - convert initial container record to syscall aux - fix spelling mistake of contidion in net/rfkill/core.c to avoid contid name collision v2 - add check for children and threads - add network namespace container identifier list - add NETFILTER_PKT audit container identifier logging - patch description and documentation clean-up and example - reap unused ppid Richard Guy Briggs (21): audit: collect audit task parameters audit: add container id audit: read container ID of a process audit: convert to contid list to check for orch/engine ownership audit: log drop of contid on exit of last task audit: contid limit of 32k imposed to avoid DoS audit: log container info of syscalls audit: add contid support for signalling the audit daemon audit: add support for non-syscall auxiliary records audit: add containerid support for user records audit: add containerid filtering audit: add support for containerid to network namespaces audit: NETFILTER_PKT: record each container ID associated with a netNS audit: contid check descendancy and nesting sched: pull task_is_descendant into kernel/sched/core.c audit: add support for contid set/get by netlink audit: add support for loginuid/sessionid set/get by netlink audit: track container nesting audit: check cont depth audit: add capcontid to set contid outside init_user_ns audit: add proc interface for capcontid fs/proc/base.c | 112 ++++++- include/linux/audit.h | 148 ++++++++- include/linux/sched.h | 10 +- include/uapi/linux/audit.h | 16 +- init/init_task.c | 3 +- init/main.c | 2 + kernel/audit.c | 728 +++++++++++++++++++++++++++++++++++++++++++- kernel/audit.h | 38 +++ kernel/auditfilter.c | 64 ++++ kernel/auditsc.c | 91 ++++-- kernel/fork.c | 1 - kernel/nsproxy.c | 4 + kernel/sched/core.c | 33 ++ net/netfilter/nft_log.c | 11 +- net/netfilter/xt_AUDIT.c | 11 +- security/selinux/nlmsgtab.c | 1 + security/yama/yama_lsm.c | 33 -- 17 files changed, 1210 insertions(+), 96 deletions(-) -- 1.8.3.1

5 years

5
71
0 / 0

[RFC PATCH v2] security,lockdown,selinux: implement SELinux lockdown

by Stephen Smalley

Implement a SELinux hook for lockdown. If the lockdown module is also enabled, then a denial by the lockdown module will take precedence over SELinux, so SELinux can only further restrict lockdown decisions. The SELinux hook only distinguishes at the granularity of integrity versus confidentiality similar to the lockdown module, but includes the full lockdown reason as part of the audit record as a hint in diagnosing what triggered the denial. To support this auditing, move the lockdown_reasons[] string array from being private to the lockdown module to the security framework so that it can be used by the lsm audit code and so that it is always available even when the lockdown module is disabled. Note that the SELinux implementation allows the integrity and confidentiality reasons to be controlled independently from one another. Thus, in an SELinux policy, one could allow operations that specify an integrity reason while blocking operations that specify a confidentiality reason. The SELinux hook implementation is stricter than the lockdown module in validating the provided reason value. Sample AVC audit output from denials: avc: denied { integrity } for pid=3402 comm="fwupd" lockdown_reason="/dev/mem,kmem,port" scontext=system_u:system_r:fwupd_t:s0 tcontext=system_u:system_r:fwupd_t:s0 tclass=lockdown permissive=0 avc: denied { confidentiality } for pid=4628 comm="cp" lockdown_reason="/proc/kcore access" scontext=unconfined_u:unconfined_r:test_lockdown_integrity_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:test_lockdown_integrity_t:s0-s0:c0.c1023 tclass=lockdown permissive=0 Signed-off-by: Stephen Smalley <sds(a)tycho.nsa.gov> --- include/linux/lsm_audit.h | 2 ++ include/linux/security.h | 2 ++ security/lockdown/lockdown.c | 24 ----------------------- security/lsm_audit.c | 5 +++++ security/security.c | 30 +++++++++++++++++++++++++++++ security/selinux/hooks.c | 30 +++++++++++++++++++++++++++++ security/selinux/include/classmap.h | 2 ++ 7 files changed, 71 insertions(+), 24 deletions(-) diff --git a/include/linux/lsm_audit.h b/include/linux/lsm_audit.h index 915330abf6e5..99d629fd9944 100644 --- a/include/linux/lsm_audit.h +++ b/include/linux/lsm_audit.h @@ -74,6 +74,7 @@ struct common_audit_data { #define LSM_AUDIT_DATA_FILE 12 #define LSM_AUDIT_DATA_IBPKEY 13 #define LSM_AUDIT_DATA_IBENDPORT 14 +#define LSM_AUDIT_DATA_LOCKDOWN 15 union { struct path path; struct dentry *dentry; @@ -93,6 +94,7 @@ struct common_audit_data { struct file *file; struct lsm_ibpkey_audit *ibpkey; struct lsm_ibendport_audit *ibendport; + int reason; } u; /* this union contains LSM specific data */ union { diff --git a/include/linux/security.h b/include/linux/security.h index a8d59d612d27..df7a4d293fe8 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -125,6 +125,8 @@ enum lockdown_reason { LOCKDOWN_CONFIDENTIALITY_MAX, }; +extern const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1]; + /* These functions are in security/commoncap.c */ extern int cap_capable(const struct cred *cred, struct user_namespace *ns, int cap, unsigned int opts); diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c index 8a10b43daf74..5a952617a0eb 100644 --- a/security/lockdown/lockdown.c +++ b/security/lockdown/lockdown.c @@ -16,30 +16,6 @@ static enum lockdown_reason kernel_locked_down; -static const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = { - [LOCKDOWN_NONE] = "none", - [LOCKDOWN_MODULE_SIGNATURE] = "unsigned module loading", - [LOCKDOWN_DEV_MEM] = "/dev/mem,kmem,port", - [LOCKDOWN_KEXEC] = "kexec of unsigned images", - [LOCKDOWN_HIBERNATION] = "hibernation", - [LOCKDOWN_PCI_ACCESS] = "direct PCI access", - [LOCKDOWN_IOPORT] = "raw io port access", - [LOCKDOWN_MSR] = "raw MSR access", - [LOCKDOWN_ACPI_TABLES] = "modifying ACPI tables", - [LOCKDOWN_PCMCIA_CIS] = "direct PCMCIA CIS storage", - [LOCKDOWN_TIOCSSERIAL] = "reconfiguration of serial port IO", - [LOCKDOWN_MODULE_PARAMETERS] = "unsafe module parameters", - [LOCKDOWN_MMIOTRACE] = "unsafe mmio", - [LOCKDOWN_DEBUGFS] = "debugfs access", - [LOCKDOWN_INTEGRITY_MAX] = "integrity", - [LOCKDOWN_KCORE] = "/proc/kcore access", - [LOCKDOWN_KPROBES] = "use of kprobes", - [LOCKDOWN_BPF_READ] = "use of bpf to read kernel RAM", - [LOCKDOWN_PERF] = "unsafe use of perf", - [LOCKDOWN_TRACEFS] = "use of tracefs", - [LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality", -}; - static const enum lockdown_reason lockdown_levels[] = {LOCKDOWN_NONE, LOCKDOWN_INTEGRITY_MAX, LOCKDOWN_CONFIDENTIALITY_MAX}; diff --git a/security/lsm_audit.c b/security/lsm_audit.c index e40874373f2b..2d2bf49016f4 100644 --- a/security/lsm_audit.c +++ b/security/lsm_audit.c @@ -27,6 +27,7 @@ #include <linux/dccp.h> #include <linux/sctp.h> #include <linux/lsm_audit.h> +#include <linux/security.h> /** * ipv4_skb_to_auditdata : fill auditdata from skb @@ -425,6 +426,10 @@ static void dump_common_audit_data(struct audit_buffer *ab, a->u.ibendport->dev_name, a->u.ibendport->port); break; + case LSM_AUDIT_DATA_LOCKDOWN: + audit_log_format(ab, " lockdown_reason="); + audit_log_string(ab, lockdown_reasons[a->u.reason]); + break; } /* switch (a->type) */ } diff --git a/security/security.c b/security/security.c index 1bc000f834e2..f439c1102b1a 100644 --- a/security/security.c +++ b/security/security.c @@ -35,6 +35,36 @@ #define LSM_COUNT (__end_lsm_info - __start_lsm_info) #define EARLY_LSM_COUNT (__end_early_lsm_info - __start_early_lsm_info) +/* + * These are descriptions of the reasons that can be passed to the + * security_locked_down() LSM hook. Placing this array here allows + * all security modules to use the same descriptions for auditing + * purposes. + */ +const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = { + [LOCKDOWN_NONE] = "none", + [LOCKDOWN_MODULE_SIGNATURE] = "unsigned module loading", + [LOCKDOWN_DEV_MEM] = "/dev/mem,kmem,port", + [LOCKDOWN_KEXEC] = "kexec of unsigned images", + [LOCKDOWN_HIBERNATION] = "hibernation", + [LOCKDOWN_PCI_ACCESS] = "direct PCI access", + [LOCKDOWN_IOPORT] = "raw io port access", + [LOCKDOWN_MSR] = "raw MSR access", + [LOCKDOWN_ACPI_TABLES] = "modifying ACPI tables", + [LOCKDOWN_PCMCIA_CIS] = "direct PCMCIA CIS storage", + [LOCKDOWN_TIOCSSERIAL] = "reconfiguration of serial port IO", + [LOCKDOWN_MODULE_PARAMETERS] = "unsafe module parameters", + [LOCKDOWN_MMIOTRACE] = "unsafe mmio", + [LOCKDOWN_DEBUGFS] = "debugfs access", + [LOCKDOWN_INTEGRITY_MAX] = "integrity", + [LOCKDOWN_KCORE] = "/proc/kcore access", + [LOCKDOWN_KPROBES] = "use of kprobes", + [LOCKDOWN_BPF_READ] = "use of bpf to read kernel RAM", + [LOCKDOWN_PERF] = "unsafe use of perf", + [LOCKDOWN_TRACEFS] = "use of tracefs", + [LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality", +}; + struct security_hook_heads security_hook_heads __lsm_ro_after_init; static BLOCKING_NOTIFIER_HEAD(blocking_lsm_notifier_chain); diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 36e531b91df2..ca8a9d1b3ffd 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -6799,6 +6799,34 @@ static void selinux_bpf_prog_free(struct bpf_prog_aux *aux) } #endif +static int selinux_lockdown(enum lockdown_reason what) +{ + struct common_audit_data ad; + u32 sid = current_sid(); + int invalid_reason = (what <= LOCKDOWN_NONE) || + (what == LOCKDOWN_INTEGRITY_MAX) || + (what >= LOCKDOWN_CONFIDENTIALITY_MAX); + + if (WARN(invalid_reason, "Invalid lockdown reason")) { + audit_log(audit_context(), + GFP_ATOMIC, AUDIT_SELINUX_ERR, + "lockdown_reason=invalid"); + return -EINVAL; + } + + ad.type = LSM_AUDIT_DATA_LOCKDOWN; + ad.u.reason = what; + + if (what <= LOCKDOWN_INTEGRITY_MAX) + return avc_has_perm(&selinux_state, + sid, sid, SECCLASS_LOCKDOWN, + LOCKDOWN__INTEGRITY, &ad); + else + return avc_has_perm(&selinux_state, + sid, sid, SECCLASS_LOCKDOWN, + LOCKDOWN__CONFIDENTIALITY, &ad); +} + struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = { .lbs_cred = sizeof(struct task_security_struct), .lbs_file = sizeof(struct file_security_struct), @@ -7042,6 +7070,8 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free), LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free), #endif + + LSM_HOOK_INIT(locked_down, selinux_lockdown), }; static __init int selinux_init(void) diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h index 32e9b03be3dd..594c32febcd8 100644 --- a/security/selinux/include/classmap.h +++ b/security/selinux/include/classmap.h @@ -244,6 +244,8 @@ struct security_class_mapping secclass_map[] = { {"map_create", "map_read", "map_write", "prog_load", "prog_run"} }, { "xdp_socket", { COMMON_SOCK_PERMS, NULL } }, + { "lockdown", + { "integrity", "confidentiality", NULL } }, { NULL } }; -- 2.23.0

5 years

3
2
0 / 0

[RFC] bpf: Emit audit messages upon successful prog load and unload

by Jiri Olsa

From: Daniel Borkmann <daniel(a)iogearbox.net> Allow for audit messages to be emitted upon BPF program load and unload for having a timeline of events. The load itself is in syscall context, so additional info about the process initiating the BPF prog creation can be logged and later directly correlated to the unload event. The only info really needed from BPF side is the globally unique prog ID where then audit user space tooling can query / dump all info needed about the specific BPF program right upon load event and enrich the record, thus these changes needed here can be kept small and non-intrusive to the core. Raw example output: # auditctl -D # auditctl -a always,exit -F arch=x86_64 -S bpf # ausearch --start recent -m 1334 ... ---- time->Wed Nov 27 16:04:13 2019 type=PROCTITLE msg=audit(1574867053.120:84664): proctitle="./bpf" type=SYSCALL msg=audit(1574867053.120:84664): arch=c000003e syscall=321 \ success=yes exit=3 a0=5 a1=7ffea484fbe0 a2=70 a3=0 items=0 ppid=7477 \ pid=12698 auid=1001 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 \ egid=1001 sgid=1001 fsgid=1001 tty=pts2 ses=4 comm="bpf" \ exe="/home/jolsa/auditd/audit-testsuite/tests/bpf/bpf" \ subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) type=UNKNOWN[1334] msg=audit(1574867053.120:84664): prog-id=76 op=LOAD ---- time->Wed Nov 27 16:04:13 2019 type=UNKNOWN[1334] msg=audit(1574867053.120:84665): prog-id=76 op=UNLOAD ... Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Co-developed-by: Jiri Olsa <jolsa(a)kernel.org> Signed-off-by: Jiri Olsa <jolsa(a)kernel.org> --- include/uapi/linux/audit.h | 1 + kernel/bpf/syscall.c | 27 +++++++++++++++++++++++++++ 2 files changed, 28 insertions(+) diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h index c89c6495983d..32a5db900f47 100644 --- a/include/uapi/linux/audit.h +++ b/include/uapi/linux/audit.h @@ -116,6 +116,7 @@ #define AUDIT_FANOTIFY 1331 /* Fanotify access decision */ #define AUDIT_TIME_INJOFFSET 1332 /* Timekeeping offset injected */ #define AUDIT_TIME_ADJNTPVAL 1333 /* NTP value adjustment */ +#define AUDIT_BPF 1334 /* BPF subsystem */ #define AUDIT_AVC 1400 /* SE Linux avc denial or grant */ #define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */ diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index e3461ec59570..20826aad247c 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -23,6 +23,7 @@ #include <linux/timekeeping.h> #include <linux/ctype.h> #include <linux/nospec.h> +#include <linux/audit.h> #include <uapi/linux/btf.h> #define IS_FD_ARRAY(map) ((map)->map_type == BPF_MAP_TYPE_PERF_EVENT_ARRAY || \ @@ -1306,6 +1307,30 @@ static int find_prog_type(enum bpf_prog_type type, struct bpf_prog *prog) return 0; } +enum bpf_audit { + BPF_AUDIT_LOAD, + BPF_AUDIT_UNLOAD, +}; + +static const char * const bpf_audit_str[] = { + [BPF_AUDIT_LOAD] = "LOAD", + [BPF_AUDIT_UNLOAD] = "UNLOAD", +}; + +static void bpf_audit_prog(const struct bpf_prog *prog, enum bpf_audit op) +{ + struct audit_buffer *ab; + + if (audit_enabled == AUDIT_OFF) + return; + ab = audit_log_start(audit_context(), GFP_ATOMIC, AUDIT_BPF); + if (unlikely(!ab)) + return; + audit_log_format(ab, "prog-id=%u op=%s", + prog->aux->id, bpf_audit_str[op]); + audit_log_end(ab); +} + int __bpf_prog_charge(struct user_struct *user, u32 pages) { unsigned long memlock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; @@ -1421,6 +1446,7 @@ static void __bpf_prog_put(struct bpf_prog *prog, bool do_idr_lock) { if (atomic64_dec_and_test(&prog->aux->refcnt)) { perf_event_bpf_event(prog, PERF_BPF_EVENT_PROG_UNLOAD, 0); + bpf_audit_prog(prog, BPF_AUDIT_UNLOAD); /* bpf_prog_free_id() must be called first */ bpf_prog_free_id(prog, do_idr_lock); __bpf_prog_put_noref(prog, true); @@ -1830,6 +1856,7 @@ static int bpf_prog_load(union bpf_attr *attr, union bpf_attr __user *uattr) */ bpf_prog_kallsyms_add(prog); perf_event_bpf_event(prog, PERF_BPF_EVENT_PROG_LOAD, 0); + bpf_audit_prog(prog, BPF_AUDIT_LOAD); err = bpf_prog_new_fd(prog); if (err < 0) -- 2.23.0

5 years

4
10
0 / 0

[GIT PULL] Audit patches for v5.5

by Paul Moore

Hi Linus, Audit is back for v5.5, albeit with only two patches. Both patches pass our test suite and are listed below, please merge for v5.5. - Allow for the auditing of suspicious O_CREAT usage via the new AUDIT_ANOM_CREAT record. - Remove a redundant if-conditional check found during code analysis. It's a minor change, but when the pull request is only two patches long, you need filler in the pull request email. Thanks, -Paul -- The following changes since commit 54ecb8f7028c5eb3d740bb82b0f1d90f2df63c5c: Linux 5.4-rc1 (2019-09-30 10:35:40 -0700) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git tags/audit-pr-20191126 for you to fetch changes up to c34c78dfc1fc68a1f5403f996de8ca62f298d7b2: audit: remove redundant condition check in kauditd_thread() (2019-10-25 11:48:14 -0400) ---------------------------------------------------------------- audit/stable-5.5 PR 20191126 ---------------------------------------------------------------- Kees Cook (1): audit: Report suspicious O_CREAT usage Yunfeng Ye (1): audit: remove redundant condition check in kauditd_thread() fs/namei.c | 8 ++++++-- include/linux/audit.h | 5 +++-- include/uapi/linux/audit.h | 1 + kernel/audit.c | 15 ++++++++------- 4 files changed, 18 insertions(+), 11 deletions(-) -- paul moore www.paul-moore.com

5 years

2
1
0 / 0

Re: [PATCH] kernel: audit.c: Add __rcu notation to RCU pointer

by Joel Fernandes

On Thu, Nov 28, 2019 at 08:39:49PM +0530, Amol Grover wrote: > On Wed, Nov 27, 2019 at 10:25:57AM -0500, Joel Fernandes wrote: > > On Wed, Nov 27, 2019 at 12:29 AM Amol Grover <frextrite(a)gmail.com> wrote: > > > > > > On Tue, Nov 26, 2019 at 09:29:25PM -0500, Joel Fernandes wrote: > > > > On Tue, Nov 26, 2019 at 10:57:23PM +0530, Amol Grover wrote: > > > > > add __rcu notation to RCU protected global pointer auditd_conn > > > > > > > > > > Fixes multiple instances of sparse error: > > > > > error: incompatible types in comparison expression > > > > > (different address spaces) > > > > > > > > > > Signed-off-by: Amol Grover <frextrite(a)gmail.com> > > > > > --- > > > > > kernel/audit.c | 6 ++++-- > > > > > 1 file changed, 4 insertions(+), 2 deletions(-) > > > > > > > > > > diff --git a/kernel/audit.c b/kernel/audit.c > > > > > index da8dc0db5bd3..30e7fc9b8da2 100644 > > > > > --- a/kernel/audit.c > > > > > +++ b/kernel/audit.c > > > > > @@ -102,12 +102,14 @@ struct audit_net { > > > > > * This struct is RCU protected; you must either hold the RCU lock for reading > > > > > * or the associated spinlock for writing. > > > > > */ > > > > > -static struct auditd_connection { > > > > > +struct auditd_connection { > > > > > struct pid *pid; > > > > > u32 portid; > > > > > struct net *net; > > > > > struct rcu_head rcu; > > > > > -} *auditd_conn = NULL; > > > > > +}; > > > > > +static struct auditd_connection __rcu *auditd_conn; > > > > > +RCU_INIT_POINTER(auditd_conn); > > > > > > > > Looks like this causes a build error. Always please build test your patches > > > > in the very least. And I also did not understand how RCU_INIT_POINTER can > > > > even be used outside of a function. In C, executable code cannot be outside > > > > functions. > > > > > > > > Is doing the following not sufficient to fix the sparse issue? > > > > > > > > thanks, > > > > > > > > - Joel > > > > > > > > ---8<----------------------- > > > > > > > > diff --git a/kernel/audit.c b/kernel/audit.c > > > > index 49b6049b26ac..c5d4b5a2dea1 100644 > > > > --- a/kernel/audit.c > > > > +++ b/kernel/audit.c > > > > @@ -108,8 +108,8 @@ struct auditd_connection { > > > > struct net *net; > > > > struct rcu_head rcu; > > > > }; > > > > -static struct auditd_connection __rcu *auditd_conn; > > > > -RCU_INIT_POINTER(auditd_conn); > > > > +static struct auditd_connection __rcu *auditd_conn = NULL; > > > > > > I ran a quick checkpatch and it gave me this error: > > > ERROR: do not initialise statics to NULL > > > > > > So in order to fix it I decided to INIT the pointer (and failed) > > > > Well, try to understand the checkpatch error then, and do the right thing :) > > I read-up a few articles about this. I think I've understood the problem. I'm > sending in the ammended patch now. Sorry for this. Won't happen again. Oh, no need apology. You are learning. But yeah always do a thorough job before sending patches. thanks, - Joel

5 years

1
0
0 / 0

Re: [PATCH] kernel: audit.c: Add __rcu notation to RCU pointer

by Joel Fernandes

On Wed, Nov 27, 2019 at 12:29 AM Amol Grover <frextrite(a)gmail.com> wrote: > > On Tue, Nov 26, 2019 at 09:29:25PM -0500, Joel Fernandes wrote: > > On Tue, Nov 26, 2019 at 10:57:23PM +0530, Amol Grover wrote: > > > add __rcu notation to RCU protected global pointer auditd_conn > > > > > > Fixes multiple instances of sparse error: > > > error: incompatible types in comparison expression > > > (different address spaces) > > > > > > Signed-off-by: Amol Grover <frextrite(a)gmail.com> > > > --- > > > kernel/audit.c | 6 ++++-- > > > 1 file changed, 4 insertions(+), 2 deletions(-) > > > > > > diff --git a/kernel/audit.c b/kernel/audit.c > > > index da8dc0db5bd3..30e7fc9b8da2 100644 > > > --- a/kernel/audit.c > > > +++ b/kernel/audit.c > > > @@ -102,12 +102,14 @@ struct audit_net { > > > * This struct is RCU protected; you must either hold the RCU lock for reading > > > * or the associated spinlock for writing. > > > */ > > > -static struct auditd_connection { > > > +struct auditd_connection { > > > struct pid *pid; > > > u32 portid; > > > struct net *net; > > > struct rcu_head rcu; > > > -} *auditd_conn = NULL; > > > +}; > > > +static struct auditd_connection __rcu *auditd_conn; > > > +RCU_INIT_POINTER(auditd_conn); > > > > Looks like this causes a build error. Always please build test your patches > > in the very least. And I also did not understand how RCU_INIT_POINTER can > > even be used outside of a function. In C, executable code cannot be outside > > functions. > > > > Is doing the following not sufficient to fix the sparse issue? > > > > thanks, > > > > - Joel > > > > ---8<----------------------- > > > > diff --git a/kernel/audit.c b/kernel/audit.c > > index 49b6049b26ac..c5d4b5a2dea1 100644 > > --- a/kernel/audit.c > > +++ b/kernel/audit.c > > @@ -108,8 +108,8 @@ struct auditd_connection { > > struct net *net; > > struct rcu_head rcu; > > }; > > -static struct auditd_connection __rcu *auditd_conn; > > -RCU_INIT_POINTER(auditd_conn); > > +static struct auditd_connection __rcu *auditd_conn = NULL; > > I ran a quick checkpatch and it gave me this error: > ERROR: do not initialise statics to NULL > > So in order to fix it I decided to INIT the pointer (and failed) Well, try to understand the checkpatch error then, and do the right thing :) - Joel

5 years, 1 month

1
0
0 / 0

Re: [PATCH] kernel: audit.c: Add __rcu notation to RCU pointer

by Joel Fernandes

On Tue, Nov 26, 2019 at 10:57:23PM +0530, Amol Grover wrote: > add __rcu notation to RCU protected global pointer auditd_conn > > Fixes multiple instances of sparse error: > error: incompatible types in comparison expression > (different address spaces) > > Signed-off-by: Amol Grover <frextrite(a)gmail.com> > --- > kernel/audit.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/kernel/audit.c b/kernel/audit.c > index da8dc0db5bd3..30e7fc9b8da2 100644 > --- a/kernel/audit.c > +++ b/kernel/audit.c > @@ -102,12 +102,14 @@ struct audit_net { > * This struct is RCU protected; you must either hold the RCU lock for reading > * or the associated spinlock for writing. > */ > -static struct auditd_connection { > +struct auditd_connection { > struct pid *pid; > u32 portid; > struct net *net; > struct rcu_head rcu; > -} *auditd_conn = NULL; > +}; > +static struct auditd_connection __rcu *auditd_conn; > +RCU_INIT_POINTER(auditd_conn); Looks like this causes a build error. Always please build test your patches in the very least. And I also did not understand how RCU_INIT_POINTER can even be used outside of a function. In C, executable code cannot be outside functions. Is doing the following not sufficient to fix the sparse issue? thanks, - Joel ---8<----------------------- diff --git a/kernel/audit.c b/kernel/audit.c index 49b6049b26ac..c5d4b5a2dea1 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -108,8 +108,8 @@ struct auditd_connection { struct net *net; struct rcu_head rcu; }; -static struct auditd_connection __rcu *auditd_conn; -RCU_INIT_POINTER(auditd_conn); +static struct auditd_connection __rcu *auditd_conn = NULL; + static DEFINE_SPINLOCK(auditd_conn_lock); /* If audit_rate_limit is non-zero, limit the rate of sending audit records

5 years, 1 month

1
0
0 / 0

Security audit rules

by Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)

Hi, In one of the VM I find audit.rules defined under /etc/audit as well as /etc/audit/rules.d. What is the significance as well as difference between the files found in 2 places. Also please let me know what is the correct location where audit.rules need to be places. Regards, Vezhavendan K

5 years, 1 month

3
6
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Linux-audit November 2019