Re: [PATCH ghak25 v2 0/9] Address NETFILTER_CFG issues

On Mon, Jan 06, 2020 at 01:54:01PM -0500, Richard Guy Briggs wrote: > There were questions about the presence and cause of unsolicited syscall events > in the logs containing NETFILTER_CFG records and sometimes unaccompanied > NETFILTER_CFG records. > > During testing at least the following list of events trigger NETFILTER_CFG > records and the syscalls related (There may be more events that will trigger > this message type.): > init_module, finit_module: modprobe > setsockopt: iptables-restore, ip6tables-restore, ebtables-restore > unshare: (h?)ostnamed > clone: libvirtd > > The syscall events unsolicited by any audit rule were found to be caused by a > missing !audit_dummy_context() check before creating a NETFILTER_CFG > record and issuing the record immediately rather than saving the > information to create the record at syscall exit. > Check !audit_dummy_context() before creating the NETFILTER_CFG record. > > The vast majority of unaccompanied records are caused by the fedora default > rule: "-a never,task" and the occasional early startup one is I believe caused > by the iptables filter table module hard linked into the kernel rather than a > loadable module. The !audit_dummy_context() check above should avoid them. > > A couple of other factors should help eliminate unaccompanied records > which include commit cb74ed278f80 ("audit: always enable syscall > auditing when supported and audit is enabled") which makes sure that > when audit is enabled, so automatically is syscall auditing, and ghak66 > which addressed initializing audit before PID 1. > > Ebtables module initialization to register tables doesn't generate records > because it was never hooked in to audit. Recommend adding audit hooks to log > this. > > Table unregistration was never logged, which is now covered. > > Seemingly duplicate records are not actually exact duplicates that are caused > by netfilter table initialization in different network namespaces from the same > syscall. Recommend adding the network namespace ID (proc inode and dev) > to the record to make this obvious (address later with ghak79 after nsid > patches). > > See: https://github.com/linux-audit/audit-kernel/issues/25 > See: https://github.com/linux-audit/audit-kernel/issues/35 > See: https://github.com/linux-audit/audit-kernel/issues/43 > See: https://github.com/linux-audit/audit-kernel/issues/44 What tree is this batch targeted to?