Re: [PATCH ghak25 v2 0/9] Address NETFILTER_CFG issues

On Thu, Jan 16, 2020 at 10:05 AM Pablo Neira Ayuso <pablo(a)netfilter.org&gt; wrote: > On Mon, Jan 06, 2020 at 01:54:01PM -0500, Richard Guy Briggs wrote: > > There were questions about the presence and cause of unsolicited syscall events > > in the logs containing NETFILTER_CFG records and sometimes unaccompanied > > NETFILTER_CFG records. > > > > During testing at least the following list of events trigger NETFILTER_CFG > > records and the syscalls related (There may be more events that will trigger > > this message type.): > > init_module, finit_module: modprobe > > setsockopt: iptables-restore, ip6tables-restore, ebtables-restore > > unshare: (h?)ostnamed > > clone: libvirtd > > > > The syscall events unsolicited by any audit rule were found to be caused by a > > missing !audit_dummy_context() check before creating a NETFILTER_CFG > > record and issuing the record immediately rather than saving the > > information to create the record at syscall exit. > > Check !audit_dummy_context() before creating the NETFILTER_CFG record. > > > > The vast majority of unaccompanied records are caused by the fedora default > > rule: "-a never,task" and the occasional early startup one is I believe caused > > by the iptables filter table module hard linked into the kernel rather than a > > loadable module. The !audit_dummy_context() check above should avoid them. > > > > A couple of other factors should help eliminate unaccompanied records > > which include commit cb74ed278f80 ("audit: always enable syscall > > auditing when supported and audit is enabled") which makes sure that > > when audit is enabled, so automatically is syscall auditing, and ghak66 > > which addressed initializing audit before PID 1. > > > > Ebtables module initialization to register tables doesn't generate records > > because it was never hooked in to audit. Recommend adding audit hooks to log > > this. > > > > Table unregistration was never logged, which is now covered. > > > > Seemingly duplicate records are not actually exact duplicates that are caused > > by netfilter table initialization in different network namespaces from the same > > syscall. Recommend adding the network namespace ID (proc inode and dev) > > to the record to make this obvious (address later with ghak79 after nsid > > patches). > > > > See: https://github.com/linux-audit/audit-kernel/issues/25 > > See: https://github.com/linux-audit/audit-kernel/issues/35 > > See: https://github.com/linux-audit/audit-kernel/issues/43 > > See: https://github.com/linux-audit/audit-kernel/issues/44 > > What tree is this batch targeted to? I believe Richard was targeting this for the audit tree.

paul moore