Re: [PATCH 3/6 RFC] netfilter: audit only on xtables and ebtables syscall rule or standalone

There were syscall events unsolicited by any audit rule caused by a missing !audit_dummy_context() check before creating an iptables/ip6tables/arptables/ebtables NETFILTER_CFG record. Check !audit_dummy_context() before creating the NETFILTER_CFG record. The vast majority of observed unaccompanied records are caused by the fedora default rule: "-a never,task" and the occasional early startup one is I believe caused by the iptables filter table module hard linked into the kernel rather than a loadable module. The !audit_dummy_context() check above should avoid them. Audit only when there is an existing syscall audit rule, otherwise issue a standalone record only on table modification rather than empty table creation. Add subject attributes to the new standalone NETFILTER_CFGSOLO record using a newly exported audit_log_task().

diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h index 0714a66..8bee3f5 100644 --- a/include/uapi/linux/audit.h +++ b/include/uapi/linux/audit.h @@ -112,6 +112,7 @@ #define AUDIT_FEATURE_CHANGE 1328 /* audit log listing feature changes */ #define AUDIT_REPLACE 1329 /* Replace auditd if this packet unanswerd */ #define AUDIT_KERN_MODULE 1330 /* Kernel Module events */ +#define AUDIT_NETFILTER_CFGSOLO 1331 /* Netfilter chain modifications standalone */ #define AUDIT_AVC 1400 /* SE Linux avc denial or grant */ #define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */ diff --git a/kernel/auditsc.c b/kernel/auditsc.c index b2dcbe6..8ac38e6 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -2383,7 +2383,7 @@ void __audit_log_kern_module(char *name) context->type = AUDIT_KERN_MODULE; } -static void audit_log_task(struct audit_buffer *ab) +void audit_log_task(struct audit_buffer *ab) { kuid_t auid, uid; kgid_t gid; @@ -2404,6 +2404,7 @@ static void audit_log_task(struct audit_buffer *ab) audit_log_untrustedstring(ab, get_task_comm(comm, current)); audit_log_d_path_exe(ab, current->mm); } +EXPORT_SYMBOL_GPL(audit_log_task); /** * audit_core_dumps - record information about processes that end abnormally diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c index 13d7fe2..743f9e6 100644 --- a/net/bridge/netfilter/ebtables.c +++ b/net/bridge/netfilter/ebtables.c @@ -1071,12 +1071,25 @@ static int do_replace_finish(struct net *net, struct ebt_replace *repl, if (audit_enabled) { struct audit_buffer *ab; - ab = audit_log_start(current->audit_context, GFP_KERNEL, - AUDIT_NETFILTER_CFG); - if (ab) { - audit_log_format(ab, "table=%s family=%u entries=%u", - repl->name, AF_BRIDGE, repl->nentries); - audit_log_end(ab); + if(!audit_dummy_context()) { + ab = audit_log_start(current->audit_context, GFP_KERNEL, + AUDIT_NETFILTER_CFG); + if (ab) { + audit_log_format(ab, "family=%u table=%s entries=%u", + AF_BRIDGE, repl->name, + repl->nentries); + audit_log_end(ab); + } + } else if(repl->nentries) { + ab = audit_log_start(NULL, GFP_KERNEL, + AUDIT_NETFILTER_CFGSOLO); + if (ab) { + audit_log_task(ab); + audit_log_format(ab, " family=%u table=%s entries=%u", + AF_BRIDGE, repl->name, + repl->nentries); + audit_log_end(ab); + }