Re: [PATCH -v3] SELinux: Convert avc_audit to use lsm_audit.h
On Friday 14 August 2009 10:51:41 am Stephen Smalley wrote:
BTW, it looks to my untrained eye as if dump_common_audit_data()
allows
one to pass a separate target task in the union, in which case we'll get
two sets of pid= and comm= data in the same record, one for the subject
and one for the target/object. It appears that Smack is already using
that facility for things like ptrace, kill, etc, whereas SELinux is not.
They should not be doing that. When another process is the object, we have
specific auxiliary audit records to record this. We have to do this for CAPP so
MAC systems should not have to do this. See AUDIT_OBJ_PID.
Two questions:
1) Will the multiple pid= comm= entries get handled correctly by auditd
and the audit tools? Do we need separate names for the target vs source
pid/comm values?
Yes, we need to record the object information. But we have a record type for
that already AUDIT_OBJ_PID.
2) Should we start using ad.u.tsk in SELinux as well to capture the
target of a ptrace, kill, wait, ... in the avc audit record?
It should be captured. I thought it was for the LSPP work we did. If for some
reason its not recorded, then audit_log_pid_context() should be called.
-Steve