[PATCH v4 0/3] audit: add support for openat2
by Richard Guy Briggs
The openat2(2) syscall was added in v5.6. Add support for openat2 to the
audit syscall classifier and for recording openat2 parameters that cannot
be captured in the syscall parameters of the SYSCALL record.
Supporting userspace code can be found in
https://github.com/rgbriggs/audit-userspace/tree/ghau-openat2
Supporting test case can be found in
https://github.com/linux-audit/audit-testsuite/pull/103
Changelog:
v4:
- change filename include/linux/auditscm.h to auditsc_classmacros.h to avoid socket association
v3:
- re-add commit descriptions that somehow got dropped
- add new file to MAINTAINERS
v2:
- add include/linux/auditscm.h for audit syscall class macros due to syscall redefinition warnings:
arch/x86/ia32/audit.c:3:
./include/linux/audit.h:12,
./include/linux/sched.h:22,
./include/linux/seccomp.h:21,
./arch/x86/include/asm/seccomp.h:5,
./arch/x86/include/asm/unistd.h:20,
./arch/x86/include/generated/uapi/asm/unistd_64.h:4: warning: "__NR_read" redefined #define __NR_read 0
...
./arch/x86/include/generated/uapi/asm/unistd_64.h:338: warning: "__NR_rseq" redefined #define __NR_rseq 334
previous:
arch/x86/ia32/audit.c:2:
./arch/x86/include/generated/uapi/asm/unistd_32.h:7: note: this is the location of the previous definition #define __NR_read 3
...
./arch/x86/include/generated/uapi/asm/unistd_32.h:386: note: this is the location of the previous definition #define __NR_rseq 386
Richard Guy Briggs (3):
audit: replace magic audit syscall class numbers with macros
audit: add support for the openat2 syscall
audit: add OPENAT2 record to list how
MAINTAINERS | 1 +
arch/alpha/kernel/audit.c | 10 ++++++----
arch/ia64/kernel/audit.c | 10 ++++++----
arch/parisc/kernel/audit.c | 10 ++++++----
arch/parisc/kernel/compat_audit.c | 11 ++++++----
arch/powerpc/kernel/audit.c | 12 ++++++-----
arch/powerpc/kernel/compat_audit.c | 13 +++++++-----
arch/s390/kernel/audit.c | 12 ++++++-----
arch/s390/kernel/compat_audit.c | 13 +++++++-----
arch/sparc/kernel/audit.c | 12 ++++++-----
arch/sparc/kernel/compat_audit.c | 13 +++++++-----
arch/x86/ia32/audit.c | 13 +++++++-----
arch/x86/kernel/audit_64.c | 10 ++++++----
fs/open.c | 2 ++
include/linux/audit.h | 11 ++++++++++
include/linux/auditsc_classmacros.h | 24 ++++++++++++++++++++++
include/uapi/linux/audit.h | 1 +
kernel/audit.h | 2 ++
kernel/auditsc.c | 31 +++++++++++++++++++++++------
lib/audit.c | 14 ++++++++-----
lib/compat_audit.c | 15 +++++++++-----
21 files changed, 169 insertions(+), 71 deletions(-)
create mode 100644 include/linux/auditsc_classmacros.h
--
2.27.0
2 years, 3 months
[PATCH] audit: correct the AUDIT_DM_CTRL and AUDIT_DM_EVENT numbering
by Paul Moore
Due to conflict with the audit and SELinux trees the device mapper
audit record types need to be renumbered before landing in Linus'
tree.
Link: https://lore.kernel.org/lkml/CAHC9VhTLmzDQPqsj+vyBNua1X13UK_tTcixKZ7WWYEq...
Fixes: c1d7fa96e74b ("dm: introduce audit event module for device mapper")
Signed-off-by: Paul Moore <paul(a)paul-moore.com>
---
include/uapi/linux/audit.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
index 6650ab6def2a..809e4c2041b3 100644
--- a/include/uapi/linux/audit.h
+++ b/include/uapi/linux/audit.h
@@ -118,8 +118,8 @@
#define AUDIT_TIME_ADJNTPVAL 1333 /* NTP value adjustment */
#define AUDIT_BPF 1334 /* BPF subsystem */
#define AUDIT_EVENT_LISTENER 1335 /* Task joined multicast read socket */
-#define AUDIT_DM_CTRL 1336 /* Device Mapper target control */
-#define AUDIT_DM_EVENT 1337 /* Device Mapper events */
+#define AUDIT_DM_CTRL 1338 /* Device Mapper target control */
+#define AUDIT_DM_EVENT 1339 /* Device Mapper events */
#define AUDIT_AVC 1400 /* SE Linux avc denial or grant */
#define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */
2 years, 4 months
[RFC PATCH v7 00/16] Integrity Policy Enforcement (IPE)
by deven.desai＠linux.microsoft.com
From: Deven Bowers <deven.desai(a)linux.microsoft.com>
Overview:
---------
IPE is a Linux Security Module which takes a complimentary approach to
access control. Whereas existing systems approach use labels or paths
which control access to a resource, IPE controls access to a resource
based on the system's trust of said resource.
Trust requirements are established via IPE's policy, sourcing multiple
different implementations within the kernel to build a cohesive trust
model, based on how the system was built.
Trust, with respect to computing, is a concept that designates a set
of entities who will endorse a set of resources as non-malicious.
Traditionally, this is done via signatures, which is the act of endorsing
a resource.
Integrity, on the other hand, is the concept of ensuring that a resource
has not been modified since a point of time. This is typically done through
cryptographic hashes or signatures.
Trust and integrity are very closely tied together concepts, as integrity
is the way you can prove trust for a resource; otherwise it could have
been modified by an entity who is untrusted.
IPE provides a way for a user to express trust requirements of resources,
by using pre-existing systems which provide the integrity half of the
equation.
IPE is compiled under CONFIG_SECURITY_IPE.
Use Cases
---------
IPE works best in fixed-function devices: Devices in which their purpose
is clearly defined and not supposed to be changed (e.g. network firewall
device in a data center, an IoT device, etcetera), where all software and
configuration is built and provisioned by the system owner.
IPE is a long-way off for use in general-purpose computing:
the Linux community as a whole tends to follow a decentralized trust
model, known as the Web of Trust, which IPE has no support for as of yet.
Instead, IPE supports the PKI Trust Model, which generally designates a
set of entities that provide a measure absolute trust.
Additionally, while most packages are signed today, the files inside
the packages (for instance, the executables), tend to be unsigned. This
makes it difficult to utilize IPE in systems where a package manager is
expected to be functional, without major changes to the package manager
and ecosystem behind it.
Policy:
-------
IPE policy is a plain-text [#]_ policy composed of multiple statements
over several lines. There is one required line, at the top of the
policy, indicating the policy name, and the policy version, for
instance:
policy_name="Ex Policy" policy_version=0.0.0
The policy version indicates the current version of the policy (NOT the
policy syntax version). This is used to prevent roll-back of policy to
potentially insecure previous versions of the policy.
The next portion of IPE policy, are rules. Rules are formed by key=value
pairs, known as properties. IPE rules require two properties: "action",
which determines what IPE does when it encounters a match against the
policy, and "op", which determines when that rule should be evaluated.
Thus, a minimal rule is:
op=EXECUTE action=ALLOW
This example will allow any execution. Additional properties are used to
restrict attributes about the files being evaluated. These properties are
intended to be deterministic attributes that are resident in the kernel.
Available properties for IPE described in the documentation patch of this
series.
A rule is required to have the "op" property as the first token of a rule,
and the "action" as the last token of the rule. Rules are evaluated
top-to-bottom. As a result, any revocation rules, or denies should be
placed early in the file to ensure that these rules are evaluated before
a rule with "action=ALLOW" is hit.
Any unknown syntax in IPE policy will result in a fatal error to parse
the policy. User mode can interrogate the kernel to understand what
properties and the associated versions through the securityfs node,
$securityfs/ipe/config, which will return a string of form:
key1=version1
key2=version2
.
.
.
keyN=versionN
User-mode should correlate these versions with the supported values
identified in the documentation to determine whether a policy should
be accepted by the system without actually trying to deploy the policy.
Additionally, a DEFAULT operation must be set for all understood
operations within IPE. For policies to remain completely forwards
compatible, it is recommended that users add a "DEFAULT action=ALLOW"
and override the defaults on a per-operation basis.
For more information about the policy syntax, the kernel documentation
page.
Early Usermode Protection:
--------------------------
IPE can be provided with a policy at startup to load and enforce.
This is intended to be a minimal policy to get the system to a state
where userland is setup and ready to receive commands, at which
point a policy can be deployed via securityfs. This "boot policy" can be
specified via the config, SECURITY_IPE_BOOT_POLICY, which accepts a path
to a plain-text version of the IPE policy to apply. This policy will be
compiled into the kernel. If not specified, IPE will be disabled until a
policy is deployed and activated through the method above.
Policy Examples:
----------------
Allow all:
policy_name="Allow All" policy_version=0.0.0
DEFAULT action=ALLOW
Allow only initial superblock:
policy_name="Allow All Initial SB" policy_version=0.0.0
DEFAULT action=DENY
op=EXECUTE boot_verified=TRUE action=ALLOW
Allow any signed dm-verity volume and the initial superblock:
policy_name="AllowSignedAndInitial" policy_version=0.0.0
DEFAULT action=DENY
op=EXECUTE boot_verified=TRUE action=ALLOW
op=EXECUTE dmverity_signature=TRUE action=ALLOW
Prohibit execution from a specific dm-verity volume:
policy_name="AllowSignedAndInitial" policy_version=0.0.0
DEFAULT action=DENY
op=EXECUTE dmverity_roothash=401fcec5944823ae12f62726e8184407a5fa9599783f030dec146938 action=DENY
op=EXECUTE boot_verified=TRUE action=ALLOW
op=EXECUTE dmverity_signature=TRUE action=ALLOW
Allow only a specific dm-verity volume:
policy_name="AllowSignedAndInitial" policy_version=0.0.0
DEFAULT action=DENY
op=EXECUTE dmverity_roothash=401fcec5944823ae12f62726e8184407a5fa9599783f030dec146938 action=ALLOW
Deploying Policies:
-------------------
First sign a plain text policy, with a certificate that is present in
the SYSTEM_TRUSTED_KEYRING of your test machine. Through openssl, the
signing can be done via:
openssl smime -sign -in "$MY_POLICY" -signer "$MY_CERTIFICATE" \
-inkey "$MY_PRIVATE_KEY" -binary -outform der -noattr -nodetach \
-out "$MY_POLICY.p7s"
Then, simply cat the file into the IPE's "new_policy" securityfs node:
cat "$MY_POLICY.p7s" > /sys/kernel/security/ipe/new_policy
The policy should now be present under the policies/ subdirectory, under
its "policy_name" attribute.
The policy is now present in the kernel and can be marked as active,
via the securityfs node:
echo "1" > "/sys/kernel/security/ipe/$MY_POLICY_NAME/active"
This will now mark the policy as active and the system will be enforcing
$MY_POLICY_NAME.
There is one requirement when marking a policy as active, the policy_version
attribute must either increase, or remain the same as the currently running
policy.
Policies can be updated via:
cat "$MY_UPDATED_POLICY.p7s" > \
"/sys/kernel/security/ipe/policies/$MY_POLICY_NAME/update"
Additionally, policies can be deleted via the "delete" securityfs
node. Simply write "1" to the corresponding node in the policy folder:
echo "1" > "/sys/kernel/security/ipe/policies/$MY_POLICY_NAME/delete"
There is only one requirement to delete policies, the policy being
deleted must not be the active policy.
NOTE: The securityfs commands will require CAP_MAC_ADMIN.
Integrations:
-------------
This patch series adds support for fsverity via digest and signature
(fsverity_signature and fsverity_digest), dm-verity by digest and
signature (dmverity_signature and dmverity_roothash), and trust for
the initramfs (boot_verified).
Please see the documentation patch for more information about the
integrations available.
Testing:
--------
KUnit Tests are available. Recommended kunitconfig:
CONFIG_KUNIT=y
CONFIG_SECURITY=y
CONFIG_SECURITYFS=y
CONFIG_PKCS7_MESSAGE_PARSER=y
CONFIG_SYSTEM_DATA_VERIFICATION=y
CONFIG_FS_VERITY=y
CONFIG_FS_VERITY_BUILTIN_SIGNATURES=y
CONFIG_BLOCK=y
CONFIG_MD=y
CONFIG_BLK_DEV_DM=y
CONFIG_DM_VERITY=y
CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
CONFIG_SECURITY_IPE=y
CONFIG_SECURITY_IPE_KUNIT_TEST=y
CONFIG_IPE_PROP_BOOT_VERIFIED=y
CONFIG_IPE_PROP_DM_VERITY_SIGNATURE=y
CONFIG_IPE_PROP_DM_VERITY_ROOTHASH=y
CONFIG_IPE_PROP_FS_VERITY_SIGNATURE=y
CONFIG_IPE_PROP_FS_VERITY_DIGEST=y
Simply run:
make ARCH=um mrproper
./tools/testing/kunit/kunit.py run --kunitconfig <path/to/config>
And the tests will execute and report the result. For more indepth testing,
it will require you to create and mount a dm-verity volume or fs-verity
enabled file.
Documentation:
--------------
There is both documentation available on github at
https://microsoft.github.io/ipe, and Documentation in this patch series,
to be added in-tree. This includes architectural block diagrams.
Known Gaps:
-----------
IPE has two known gaps:
1. IPE cannot verify the integrity of anonymous executable memory, such as
the trampolines created by gcc closures and libffi (<3.4.2), or JIT'd code.
Unfortunately, as this is dynamically generated code, there is no way
for IPE to ensure the integrity of this code to form a trust basis. In all
cases, the return result for these operations will be whatever the admin
configures the DEFAULT action for "EXECUTE".
2. IPE cannot verify the integrity of interpreted languages' programs when
these scripts invoked via ``<interpreter> <file>``. This is because the
way interpreters execute these files, the scripts themselves are not
evaluated as executable code through one of IPE's hooks. Interpreters
can be enlightened to the usage of IPE by trying to mmap a file into
executable memory (+X), after opening the file and responding to the
error code appropriately. This also applies to included files, or high
value files, such as configuration files of critical system components.
However, there is a patchset that is looking to address this gap [1].
Appendix:
---------
A. IPE Github Repository: https://github.com/microsoft/ipe
B. IPE Users' Guide: Documentation/admin-guide/LSM/ipe.rst
References:
-----------
[1] https://lore.kernel.org/all/20211012192410.2356090-1-mic@digikod.net/
FAQ:
----
Q: What's the difference between other LSMs which provide trust-based
access control, for instance, IMA?
A: IMA is a fantastic option when needing measurement in addition to the
trust-based access model. All of IMA is centered around their measurement
hashes, so you save time when doing both actions. IPE, on the other hand,
is a highly performant system that does not rely (and explicitly prohibits),
generating its own integrity mechanisms - separating measurement and access
control. Simply put, IPE provides only the enforcement of trust, while other
subsystems provide the integrity guarantee that IPE needs to determine the
trust of a resource. IMA provides both the integrity guarantee, the
enforcement of trust, and a whole host of other features that may not be
needed.
Changelog:
----------
Changes since v1:
Split the second patch of the previous series into two.
Minor corrections in the cover-letter and documentation
comments regarding CAP_MAC_ADMIN checks in IPE.
Changes since v2:
Address various comments by Jann Horn. Highlights:
Switch various audit allocators to GFP_KERNEL.
Utilize rcu_access_pointer() in various locations.
Strip out the caching system for properties
Strip comments from headers
Move functions around in patches
Remove kernel command line parameters
Reconcile the race condition on the delete node for policy by
expanding the policy critical section.
Address a few comments by Jonathan Corbet around the documentation
pages for IPE.
Fix an issue with the initialization of IPE policy with a "-0"
version, caused by not initializing the hlist entries before
freeing.
Changes since v3:
Address a concern around IPE's behavior with unknown syntax.
Specifically, make any unknown syntax a fatal error instead of a
warning, as suggested by Mickaël Salaün.
Introduce a new securityfs node, $securityfs/ipe/property_config,
which provides a listing of what properties are enabled by the
kernel and their versions. This allows usermode to predict what
policies should be allowed.
Strip some comments from c files that I missed.
Clarify some documentation comments around 'boot_verified'.
While this currently does not functionally change the property
itself, the distinction is important when IPE can enforce verified
reads. Additionally, 'KERNEL_READ' was omitted from the documentation.
This has been corrected.
Change SecurityFS and SHA1 to a reverse dependency.
Update the cover-letter with the updated behavior of unknown syntax.
Remove all sysctls, making an equivalent function in securityfs.
Rework the active/delete mechanism to be a node under the policy in
$securityfs/ipe/policies.
The kernel command line parameters ipe.enforce and ipe.success_audit
have returned as this functionality is no longer exposed through
sysfs.
Changes since v4:
Correct some grammatical errors reported by Randy Dunlap.
Fix some warnings reported by kernel test bot.
Change convention around security_bdev_setsecurity. -ENOSYS
is now expected if an LSM does not implement a particular @name,
as suggested by Casey Schaufler.
Minor string corrections related to the move from sysfs to securityfs
Correct a spelling of an #ifdef for the permissive argument.
Add the kernel parameters re-added to the documentation.
Fix a minor bug where the mode being audited on permissive switch
was the original mode, not the mode being swapped to.
Cleanup doc comments, fix some whitespace alignment issues.
Changes since v5:
Change if statement condition in security_bdev_setsecurity to be
more concise, as suggested by Casey Schaufler and Al Viro
Drop the 6th patch in the series, "dm-verity move signature check..."
due to numerous issues, and it ultimately providing no real value.
Fix the patch tree - the previous iteration appears to have been in a
torn state (patches 8+9 were merged). This has since been corrected.
Changes since v6:
* Reword cover letter to more accurate convey IPE's purpose
and latest updates.
* Refactor series to:
1. Support a context structure, enabling:
1. Easier Testing via KUNIT
2. A better architecture for future designs
2. Make parser code cleaner
* Move patch 01/12 to [14/16] of the series
* Split up patch 02/12 into four parts:
1. context creation [01/16]
2. audit [07/16]
3. evaluation loop [03/16]
4. access control hooks [05/16]
5. permissive mode [08/16]
* Split up patch 03/12 into two parts:
1. parser [02/16]
2. userspace interface [04/16]
* Reword and refactor patch 04/12 to [09/16]
* Squash patch 05/12, 07/12, 09/12 to [10/16]
* Squash patch 08/12, 10/12 to [11/16]
* Change audit records to MAC region (14XX) from Integrity region (18XX)
* Add FSVerity Support
* Interface changes:
1. "raw" was renamed to "pkcs7" and made read only
2. "raw"'s write functionality (update a policy) moved to "update"
3. introduced "version", "policy_name" nodes.
4. "content" renamed to "policy"
5. The boot policy can now be updated like any other policy.
* Add additional developer-level documentation
* Update admin-guide docs to reflect changes.
* Kunit tests
* Dropped CONFIG_SECURITY_IPE_PERMISSIVE_SWITCH - functionality can
easily come later with a small patch.
* Use partition0 for block_device for dm-verity patch
Deven Bowers (14):
security: add ipe lsm & initial context creation
ipe: add policy parser
ipe: add evaluation loop
ipe: add userspace interface
ipe: add LSM hooks on execution and kernel read
uapi|audit: add trust audit message definitions
ipe: add auditing support
ipe: add permissive toggle
ipe: introduce 'boot_verified' as a trust provider
fs|dm-verity: add block_dev LSM blob and submit dm-verity data
ipe: add support for dm-verity as a trust provider
scripts: add boot policy generation program
ipe: kunit tests
documentation: add ipe documentation
Fan Wu (2):
fsverity|security: add security hooks to fsverity digest and signature
ipe: enable support for fs-verity as a trust provider
Documentation/admin-guide/LSM/index.rst | 1 +
Documentation/admin-guide/LSM/ipe.rst | 587 ++++++++++
.../admin-guide/kernel-parameters.txt | 12 +
Documentation/security/index.rst | 1 +
Documentation/security/ipe.rst | 339 ++++++
MAINTAINERS | 9 +
block/bdev.c | 7 +
drivers/md/dm-verity-target.c | 20 +-
drivers/md/dm-verity-verify-sig.c | 16 +-
drivers/md/dm-verity-verify-sig.h | 10 +-
fs/verity/open.c | 12 +
fs/verity/signature.c | 5 +-
include/asm-generic/vmlinux.lds.h | 16 +
include/linux/blk_types.h | 1 +
include/linux/device-mapper.h | 3 +
include/linux/fsverity.h | 3 +
include/linux/lsm_hook_defs.h | 5 +
include/linux/lsm_hooks.h | 12 +
include/linux/security.h | 22 +
include/uapi/linux/audit.h | 4 +
scripts/Makefile | 1 +
scripts/ipe/Makefile | 2 +
scripts/ipe/polgen/.gitignore | 1 +
scripts/ipe/polgen/Makefile | 6 +
scripts/ipe/polgen/polgen.c | 145 +++
security/Kconfig | 11 +-
security/Makefile | 1 +
security/ipe/.gitignore | 1 +
security/ipe/Kconfig | 100 ++
security/ipe/Makefile | 39 +
security/ipe/audit.c | 304 +++++
security/ipe/audit.h | 41 +
security/ipe/ctx.c | 381 ++++++
security/ipe/ctx.h | 43 +
security/ipe/ctx_test.c | 732 ++++++++++++
security/ipe/eval.c | 237 ++++
security/ipe/eval.h | 57 +
security/ipe/fs.c | 327 ++++++
security/ipe/fs.h | 13 +
security/ipe/hooks.c | 328 ++++++
security/ipe/hooks.h | 56 +
security/ipe/ipe.c | 143 +++
security/ipe/ipe.h | 27 +
security/ipe/ipe_parser.h | 59 +
security/ipe/modules.c | 134 +++
security/ipe/modules.h | 17 +
security/ipe/modules/Kconfig | 66 ++
security/ipe/modules/Makefile | 12 +
security/ipe/modules/boot_verified.c | 24 +
security/ipe/modules/dmverity_roothash.c | 80 ++
security/ipe/modules/dmverity_signature.c | 25 +
security/ipe/modules/fsverity_digest.c | 80 ++
security/ipe/modules/fsverity_signature.c | 33 +
security/ipe/modules/ipe_module.h | 40 +
security/ipe/parsers.c | 139 +++
security/ipe/parsers/Makefile | 12 +
security/ipe/parsers/default.c | 106 ++
security/ipe/parsers/policy_header.c | 126 ++
security/ipe/policy.c | 1037 +++++++++++++++++
security/ipe/policy.h | 113 ++
security/ipe/policy_parser_tests.c | 299 +++++
security/ipe/policyfs.c | 528 +++++++++
security/security.c | 76 +-
63 files changed, 7069 insertions(+), 18 deletions(-)
create mode 100644 Documentation/admin-guide/LSM/ipe.rst
create mode 100644 Documentation/security/ipe.rst
create mode 100644 scripts/ipe/Makefile
create mode 100644 scripts/ipe/polgen/.gitignore
create mode 100644 scripts/ipe/polgen/Makefile
create mode 100644 scripts/ipe/polgen/polgen.c
create mode 100644 security/ipe/.gitignore
create mode 100644 security/ipe/Kconfig
create mode 100644 security/ipe/Makefile
create mode 100644 security/ipe/audit.c
create mode 100644 security/ipe/audit.h
create mode 100644 security/ipe/ctx.c
create mode 100644 security/ipe/ctx.h
create mode 100644 security/ipe/ctx_test.c
create mode 100644 security/ipe/eval.c
create mode 100644 security/ipe/eval.h
create mode 100644 security/ipe/fs.c
create mode 100644 security/ipe/fs.h
create mode 100644 security/ipe/hooks.c
create mode 100644 security/ipe/hooks.h
create mode 100644 security/ipe/ipe.c
create mode 100644 security/ipe/ipe.h
create mode 100644 security/ipe/ipe_parser.h
create mode 100644 security/ipe/modules.c
create mode 100644 security/ipe/modules.h
create mode 100644 security/ipe/modules/Kconfig
create mode 100644 security/ipe/modules/Makefile
create mode 100644 security/ipe/modules/boot_verified.c
create mode 100644 security/ipe/modules/dmverity_roothash.c
create mode 100644 security/ipe/modules/dmverity_signature.c
create mode 100644 security/ipe/modules/fsverity_digest.c
create mode 100644 security/ipe/modules/fsverity_signature.c
create mode 100644 security/ipe/modules/ipe_module.h
create mode 100644 security/ipe/parsers.c
create mode 100644 security/ipe/parsers/Makefile
create mode 100644 security/ipe/parsers/default.c
create mode 100644 security/ipe/parsers/policy_header.c
create mode 100644 security/ipe/policy.c
create mode 100644 security/ipe/policy.h
create mode 100644 security/ipe/policy_parser_tests.c
create mode 100644 security/ipe/policyfs.c
--
2.33.0
2 years, 5 months
[PATCH v2 RESEND] powerpc/audit: Convert powerpc to AUDIT_ARCH_COMPAT_GENERIC
by Christophe Leroy
Commit e65e1fc2d24b ("[PATCH] syscall class hookup for all normal
targets") added generic support for AUDIT but that didn't include
support for bi-arch like powerpc.
Commit 4b58841149dc ("audit: Add generic compat syscall support")
added generic support for bi-arch.
Convert powerpc to that bi-arch generic audit support.
Cc: Paul Moore <paul(a)paul-moore.com>
Cc: Eric Paris <eparis(a)redhat.com>
Signed-off-by: Christophe Leroy <christophe.leroy(a)csgroup.eu>
---
Resending v2 with Audit people in Cc
v2:
- Missing 'git add' for arch/powerpc/include/asm/unistd32.h
- Finalised commit description
---
arch/powerpc/Kconfig | 5 +-
arch/powerpc/include/asm/unistd32.h | 7 +++
arch/powerpc/kernel/Makefile | 3 --
arch/powerpc/kernel/audit.c | 84 -----------------------------
arch/powerpc/kernel/compat_audit.c | 44 ---------------
5 files changed, 8 insertions(+), 135 deletions(-)
create mode 100644 arch/powerpc/include/asm/unistd32.h
delete mode 100644 arch/powerpc/kernel/audit.c
delete mode 100644 arch/powerpc/kernel/compat_audit.c
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 663766fbf505..5472358609d2 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -163,6 +163,7 @@ config PPC
select ARCH_WANT_IRQS_OFF_ACTIVATE_MM
select ARCH_WANT_LD_ORPHAN_WARN
select ARCH_WEAK_RELEASE_ACQUIRE
+ select AUDIT_ARCH_COMPAT_GENERIC
select BINFMT_ELF
select BUILDTIME_TABLE_SORT
select CLONE_BACKWARDS
@@ -316,10 +317,6 @@ config GENERIC_TBSYNC
bool
default y if PPC32 && SMP
-config AUDIT_ARCH
- bool
- default y
-
config GENERIC_BUG
bool
default y
diff --git a/arch/powerpc/include/asm/unistd32.h b/arch/powerpc/include/asm/unistd32.h
new file mode 100644
index 000000000000..07689897d206
--- /dev/null
+++ b/arch/powerpc/include/asm/unistd32.h
@@ -0,0 +1,7 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+#ifndef _ASM_POWERPC_UNISTD32_H_
+#define _ASM_POWERPC_UNISTD32_H_
+
+#include <asm/unistd_32.h>
+
+#endif /* _ASM_POWERPC_UNISTD32_H_ */
diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
index 7be36c1e1db6..825121eba3c2 100644
--- a/arch/powerpc/kernel/Makefile
+++ b/arch/powerpc/kernel/Makefile
@@ -125,9 +125,6 @@ obj-$(CONFIG_PCI) += pci_$(BITS).o $(pci64-y) \
pci-common.o pci_of_scan.o
obj-$(CONFIG_PCI_MSI) += msi.o
-obj-$(CONFIG_AUDIT) += audit.o
-obj64-$(CONFIG_AUDIT) += compat_audit.o
-
obj-$(CONFIG_PPC_IO_WORKAROUNDS) += io-workarounds.o
obj-y += trace/
diff --git a/arch/powerpc/kernel/audit.c b/arch/powerpc/kernel/audit.c
deleted file mode 100644
index a2dddd7f3d09..000000000000
--- a/arch/powerpc/kernel/audit.c
+++ /dev/null
@@ -1,84 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-#include <linux/init.h>
-#include <linux/types.h>
-#include <linux/audit.h>
-#include <asm/unistd.h>
-
-static unsigned dir_class[] = {
-#include <asm-generic/audit_dir_write.h>
-~0U
-};
-
-static unsigned read_class[] = {
-#include <asm-generic/audit_read.h>
-~0U
-};
-
-static unsigned write_class[] = {
-#include <asm-generic/audit_write.h>
-~0U
-};
-
-static unsigned chattr_class[] = {
-#include <asm-generic/audit_change_attr.h>
-~0U
-};
-
-static unsigned signal_class[] = {
-#include <asm-generic/audit_signal.h>
-~0U
-};
-
-int audit_classify_arch(int arch)
-{
-#ifdef CONFIG_PPC64
- if (arch == AUDIT_ARCH_PPC)
- return 1;
-#endif
- return 0;
-}
-
-int audit_classify_syscall(int abi, unsigned syscall)
-{
-#ifdef CONFIG_PPC64
- extern int ppc32_classify_syscall(unsigned);
- if (abi == AUDIT_ARCH_PPC)
- return ppc32_classify_syscall(syscall);
-#endif
- switch(syscall) {
- case __NR_open:
- return 2;
- case __NR_openat:
- return 3;
- case __NR_socketcall:
- return 4;
- case __NR_execve:
- return 5;
- default:
- return 0;
- }
-}
-
-static int __init audit_classes_init(void)
-{
-#ifdef CONFIG_PPC64
- extern __u32 ppc32_dir_class[];
- extern __u32 ppc32_write_class[];
- extern __u32 ppc32_read_class[];
- extern __u32 ppc32_chattr_class[];
- extern __u32 ppc32_signal_class[];
- audit_register_class(AUDIT_CLASS_WRITE_32, ppc32_write_class);
- audit_register_class(AUDIT_CLASS_READ_32, ppc32_read_class);
- audit_register_class(AUDIT_CLASS_DIR_WRITE_32, ppc32_dir_class);
- audit_register_class(AUDIT_CLASS_CHATTR_32, ppc32_chattr_class);
- audit_register_class(AUDIT_CLASS_SIGNAL_32, ppc32_signal_class);
-#endif
- audit_register_class(AUDIT_CLASS_WRITE, write_class);
- audit_register_class(AUDIT_CLASS_READ, read_class);
- audit_register_class(AUDIT_CLASS_DIR_WRITE, dir_class);
- audit_register_class(AUDIT_CLASS_CHATTR, chattr_class);
- audit_register_class(AUDIT_CLASS_SIGNAL, signal_class);
- return 0;
-}
-
-__initcall(audit_classes_init);
diff --git a/arch/powerpc/kernel/compat_audit.c b/arch/powerpc/kernel/compat_audit.c
deleted file mode 100644
index 55c6ccda0a85..000000000000
--- a/arch/powerpc/kernel/compat_audit.c
+++ /dev/null
@@ -1,44 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-#undef __powerpc64__
-#include <asm/unistd.h>
-
-unsigned ppc32_dir_class[] = {
-#include <asm-generic/audit_dir_write.h>
-~0U
-};
-
-unsigned ppc32_chattr_class[] = {
-#include <asm-generic/audit_change_attr.h>
-~0U
-};
-
-unsigned ppc32_write_class[] = {
-#include <asm-generic/audit_write.h>
-~0U
-};
-
-unsigned ppc32_read_class[] = {
-#include <asm-generic/audit_read.h>
-~0U
-};
-
-unsigned ppc32_signal_class[] = {
-#include <asm-generic/audit_signal.h>
-~0U
-};
-
-int ppc32_classify_syscall(unsigned syscall)
-{
- switch(syscall) {
- case __NR_open:
- return 2;
- case __NR_openat:
- return 3;
- case __NR_socketcall:
- return 4;
- case __NR_execve:
- return 5;
- default:
- return 1;
- }
-}
--
2.25.0
2 years, 6 months
[PATCH v3 0/7] Add uringop support
by Richard Guy Briggs
Audit support for iouring went into the upstream kernel with commit
5bd2182d58e9 ("audit,io_uring,io-wq: add some basic audit support to io_uring")
and commit 67daf270cebc ("audit: add filtering for io_uring records").
Add userspace support for AUDIT_URINGOP records, uringop fields and the
AUDIT_FILTER_URING_EXIT filter list.
Changelog:
v3
- rebase on openat2
- re-factor and re-order patchset
v2
- check for watch before adding perm
- update manpage to include filesystem filter
- add support for the AUDIT_URINGOP record type
- update support for the uring filter list: doc, -U op, op names
- add uringop support to ausearch
- add uringop support to aureport
- lots of bug fixes
Richard Guy Briggs (7):
add basic support for the AUDIT_URINGOP record type
add support for the uring filter list
add support for uringop names
add field support for the AUDIT_URINGOP record type
add ausearch --uringop option
add aureport --uringop option
add iouring support to the normalizer
audisp/plugins/ids/model_behavior.c | 1 +
auparse/auparse-defs.h | 2 +-
auparse/auparse-idata.h | 1 +
auparse/ellist.c | 7 ++
auparse/interpret.c | 21 ++++-
auparse/normalize.c | 1 +
auparse/normalize_record_map.h | 1 +
auparse/rnode.h | 1 +
auparse/typetab.h | 1 +
bindings/python/auparse_python.c | 1 +
contrib/plugin/audisp-example.c | 1 +
docs/audit.rules.7 | 19 +++--
docs/audit_add_rule_data.3 | 4 +
docs/auditctl.8 | 10 ++-
docs/aureport.8 | 3 +
docs/ausearch.8 | 3 +
lib/Makefile.am | 17 +++-
lib/flagtab.h | 11 +--
lib/libaudit.c | 50 ++++++++---
lib/libaudit.h | 11 +++
lib/lookup_table.c | 21 +++++
lib/msg_typetab.h | 1 +
lib/private.h | 1 +
lib/test/lookup_test.c | 17 ++++
lib/uringop_table.h | 62 ++++++++++++++
src/auditctl-listing.c | 52 ++++++++----
src/auditctl.c | 121 +++++++++++++++++++++++----
src/auditd-event.c | 1 +
src/aureport-options.c | 19 ++++-
src/aureport-options.h | 2 +-
src/aureport-output.c | 37 +++++++++
src/aureport-scan.c | 26 ++++++
src/aureport-scan.h | 2 +
src/aureport.c | 3 +-
src/ausearch-common.h | 1 +
src/ausearch-llist.c | 2 +
src/ausearch-llist.h | 1 +
src/ausearch-lookup.c | 25 ++++++
src/ausearch-lookup.h | 1 +
src/ausearch-match.c | 6 +-
src/ausearch-options.c | 36 +++++++-
src/ausearch-parse.c | 123 +++++++++++++++++++++++++++-
src/ausearch-report.c | 21 ++++-
43 files changed, 677 insertions(+), 70 deletions(-)
create mode 100644 lib/uringop_table.h
--
2.27.0
2 years, 6 months
[PATCH v1] add filesystem filter list to auditctl usage
by Richard Guy Briggs
The "filesystem" filter was added 2017-10-05 with
commit 38ec69344689ac7886812890cb3e2cc97c0c112c
("filter: add filesystem filter with fstype")
Add the list name to the usage text.
Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com>
---
docs/audit.rules.7 | 4 ++--
src/auditctl.c | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/docs/audit.rules.7 b/docs/audit.rules.7
index 0325c153772d..40263ec6807d 100644
--- a/docs/audit.rules.7
+++ b/docs/audit.rules.7
@@ -43,7 +43,7 @@ rule.
.SS System Call
The system call rules are loaded into a matching engine that intercepts each syscall that all programs on the system makes. Therefore it is very important to only use syscall rules when you have to since these affect performance. The more rules, the bigger the performance hit. You can help the performance, though, by combining syscalls into one rule whenever possible.
-The Linux kernel has 4 rule matching lists or filters as they are sometimes called. They are: task, exit, user, and exclude. The task list is checked only during the fork or clone syscalls. It is rarely used in practice.
+The Linux kernel has 5 rule matching lists or filters as they are sometimes called. They are: task, exit, user, exclude and filesystem. The task list is checked only during the fork or clone syscalls. It is rarely used in practice.
The exit filter is the place where all syscall and file system audit requests are evaluated.
@@ -71,7 +71,7 @@ option tells the kernel's rule matching engine that we want to append a rule at
.RE
The action and list are separated by a comma but no space in between. Valid lists are:
-.IR task ", " exit ", " user ", and " exclude ". Their meaning was explained earlier.
+.IR task ", " exit ", " user ", " exclude ", and " filesystem ". Their meaning was explained earlier.
Next in the rule would normally be the
.B \-S
diff --git a/src/auditctl.c b/src/auditctl.c
index 06bb747c5fd2..f9bfc2a247d2 100644
--- a/src/auditctl.c
+++ b/src/auditctl.c
@@ -110,7 +110,7 @@ static void usage(void)
" -C f=f Compare collected fields if available:\n"
" Field name, operator(=,!=), field name\n"
" -d <l,a> Delete rule from <l>ist with <a>ction\n"
- " l=task,exit,user,exclude\n"
+ " l=task,exit,user,exclude,filesystem\n"
" a=never,always\n"
" -D Delete all rules and watches\n"
" -e [0..2] Set enabled flag\n"
--
2.27.0
2 years, 6 months
[PATCH v1] auditctl: check for a watch before adding perm
by Richard Guy Briggs
The existing check would never trigger since add and del are defaulted to
AUDIT_FILTER_UNSET which is not zero.
Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com>
---
src/auditctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/auditctl.c b/src/auditctl.c
index ca6905b2884e..06bb747c5fd2 100644
--- a/src/auditctl.c
+++ b/src/auditctl.c
@@ -1020,7 +1020,7 @@ process_keys:
}
break;
case 'p':
- if (!add && !del) {
+ if (add == AUDIT_FILTER_UNSET && del == AUDIT_FILTER_UNSET) {
audit_msg(LOG_ERR,
"permission option needs a watch given prior to it");
retval = -1;
--
2.27.0
2 years, 6 months
[PATCH v1] remove unused fn audit_add_dir and decl audit_rule_syscall_data
by Richard Guy Briggs
The former has no activity since pre-1.7.4, no in-tree users and no manpage, so
remove it. The latter is only used locally, remove prototype.
Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com>
---
lib/libaudit.c | 5 -----
lib/libaudit.h | 2 --
2 files changed, 7 deletions(-)
diff --git a/lib/libaudit.c b/lib/libaudit.c
index bf3c22bc7beb..54e276156ef0 100644
--- a/lib/libaudit.c
+++ b/lib/libaudit.c
@@ -742,11 +742,6 @@ int audit_add_watch(struct audit_rule_data **rulep, const char *path)
return audit_add_watch_dir(AUDIT_WATCH, rulep, path);
}
-int audit_add_dir(struct audit_rule_data **rulep, const char *path)
-{
- return audit_add_watch_dir(AUDIT_DIR, rulep, path);
-}
-
int audit_add_watch_dir(int type, struct audit_rule_data **rulep,
const char *path)
{
diff --git a/lib/libaudit.h b/lib/libaudit.h
index 6bd1758eb9d3..4e532177aa11 100644
--- a/lib/libaudit.h
+++ b/lib/libaudit.h
@@ -656,7 +656,6 @@ extern int audit_request_signal_info(int fd);
/* AUDIT_WATCH */
extern int audit_update_watch_perms(struct audit_rule_data *rule, int perms);
extern int audit_add_watch(struct audit_rule_data **rulep, const char *path);
-extern int audit_add_dir(struct audit_rule_data **rulep, const char *path);
extern int audit_add_watch_dir(int type, struct audit_rule_data **rulep,
const char *path);
extern int audit_trim_subtrees(int fd);
@@ -701,7 +700,6 @@ extern int audit_log_user_command(int audit_fd, int type, const char *command,
extern struct audit_rule_data *audit_rule_create_data(void);
/* Initializes an existing audit_rule_data struct */
extern void audit_rule_init_data(struct audit_rule_data *rule);
-extern int audit_rule_syscall_data(struct audit_rule_data *rule, int scall);
extern int audit_rule_syscallbyname_data(struct audit_rule_data *rule,
const char *scall);
/* Note that the following function takes a **, where audit_rule_fieldpair()
--
2.27.0
2 years, 6 months
[RFC PATCH v2 0/9] Add LSM access controls and auditing to io_uring
by Paul Moore
Draft #2 of the patchset which brings auditing and proper LSM access
controls to the io_uring subsystem. The original patchset was posted
in late May and can be found via lore using the link below:
https://lore.kernel.org/linux-security-module/162163367115.8379.845901263...
This draft should incorporate all of the feedback from the original
posting as well as a few smaller things I noticed while playing
further with the code. The big change is of course the selective
auditing in the io_uring op servicing, but that has already been
discussed quite a bit in the original thread so I won't go into
detail here; the important part is that we found a way to move
forward and this draft captures that. For those of you looking to
play with these patches, they are based on Linus' v5.14-rc5 tag and
on my test system they boot and appear to function without problem;
they pass the selinux-testsuite and audit-testsuite and I have not
noticed any regressions in the normal use of the system. If you want
to get a copy of these patches straight from git you can use the
"working-io_uring" branch in the repo below:
git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git
https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git
Beyond the existing test suite tests mentioned above, I've cobbled
together some very basic, very crude tests to exercise some of the
things I care about from a LSM/audit perspective. These tests are
pretty awful (I'm not kidding), but they might be helpful for the
other LSM/audit developers who want to test things:
https://drop.paul-moore.com/90.kUgq
There are currently two tests: 'iouring.2' and 'iouring.3';
'iouring.1' was lost in a misguided and overzealous 'rm' command.
The first test is standalone and basically tests the SQPOLL
functionality while the second tests sharing io_urings across process
boundaries and the credential/personality sharing mechanism. The
console output of both tests isn't particularly useful, the more
interesting bits are in the audit and LSM specific logs. The
'iouring.2' command requires no special arguments to run but the
'iouring.3' test is split into a "server" and "client"; the server
should be run without argument:
% ./iouring.3s
>>> server started, pid = 11678
>>> memfd created, fd = 3
>>> io_uring created; fd = 5, creds = 1
... while the client should be run with two arguments: the first is
the PID of the server process, the second is the "memfd" fd number:
% ./iouring.3c 11678 3
>>> client started, server_pid = 11678 server_memfd = 3
>>> io_urings = 5 (server) / 5 (client)
>>> io_uring ops using creds = 1
>>> async op result: 36
>>> async op result: 36
>>> async op result: 36
>>> async op result: 36
>>> START file contents
What is this life if, full of care,
we have no time to stand and stare.
>>> END file contents
The tests were hacked together from various sources online,
attribution and links to additional info can be found in the test
sources, but I expect these tests to die a fiery death in the not
to distant future as I work to add some proper tests to the SELinux
and audit test suites.
As I believe these patches should spend a full -rcX cycle in
linux-next, my current plan is to continue to solicit feedback on
these patches while they undergo additional testing (next up is
verification of the audit filter code for io_uring). Assuming no
critical issues are found on the mailing lists or during testing, I
will post a proper patchset later with the idea of merging it into
selinux/next after the upcoming merge window closes.
Any comments, feedback, etc. are welcome.
---
Casey Schaufler (1):
Smack: Brutalist io_uring support with debug
Paul Moore (8):
audit: prepare audit_context for use in calling contexts beyond
syscalls
audit,io_uring,io-wq: add some basic audit support to io_uring
audit: dev/test patch to force io_uring auditing
audit: add filtering for io_uring records
fs: add anon_inode_getfile_secure() similar to
anon_inode_getfd_secure()
io_uring: convert io_uring to the secure anon inode interface
lsm,io_uring: add LSM hooks to io_uring
selinux: add support for the io_uring access controls
fs/anon_inodes.c | 29 ++
fs/io-wq.c | 4 +
fs/io_uring.c | 69 +++-
include/linux/anon_inodes.h | 4 +
include/linux/audit.h | 26 ++
include/linux/lsm_hook_defs.h | 5 +
include/linux/lsm_hooks.h | 13 +
include/linux/security.h | 16 +
include/uapi/linux/audit.h | 4 +-
kernel/audit.h | 7 +-
kernel/audit_tree.c | 3 +-
kernel/audit_watch.c | 3 +-
kernel/auditfilter.c | 15 +-
kernel/auditsc.c | 483 +++++++++++++++++++-----
security/security.c | 12 +
security/selinux/hooks.c | 34 ++
security/selinux/include/classmap.h | 2 +
security/smack/smack_lsm.c | 64 ++++
18 files changed, 678 insertions(+), 115 deletions(-)
2 years, 6 months
why no LOGOUT event record on some OSes
by Li Zhijian
Hi guys
I'm new to audit, then i observed that there is no LOGOUT event record
in audit.log
on my ubuntu 18.04 and debian 8 OSes, while the centos7.4 and fedora33
have it.
I google it but get no answer, so am I missing something about the audit
rules or
special audit configuration ?
Below are part of records of audit in my several OSes.
debian 8
lizhijian@lkp-bingo:~$ sudo aureport -e -i --summary | grep -i USER
[sudo] password for lizhijian:
6 USER_START
6 USER_END
4 USER_ACCT
4 USER_CMD
2 USER_AUTH
2 USER_LOGIN
ubuntu 18.04
lizj@FNSTPC:~$ sudo aureport -e -i --summary | grep USER
43241 USER_END
16946 USER_START
16718 USER_ACCT
658 USER_AUTH
543 USER_CMD
255 USER_LOGIN
9 USER_ROLE_CHANGE
5 USER_ERR
2 USER_CHAUTHTOK
1 ADD_USER
fedora 33
[root@iaas-rpma linux]# aureport -e -i --summary | grep USER
7356 CRYPTO_KEY_USER
2103 USER_START
1649 USER_END
1268 USER_ACCT
1108 USER_ROLE_CHANGE
1029 USER_AUTH
895 USER_LOGIN
789 USER_LOGOUT
60 USER_CMD
14 USER_ERR
3 USER_MGMT
3 USER_CHAUTHTOK
1 ADD_USER
Thanks
2 years, 6 months