9:29 a.m.
Hello,
Having the kernel detect a signal being sent to the audit daemon is not
working. Is anyone troubleshooting this or do we take another approach?
I spent some time yesterday thinking about the shutdown. I came to the
conclusion that the only way to "do it right" is to get the credentials in
the signal handler. Everything else is racy.
THE PROBLEM
When I get the term signal, I would need to wait for the event to be logged to
disk. So that means I have to inspect each packet and wait until the shutdown
message comes through. But what if the backlog was full when that event would
have been enqueued?
Also, suppose I have a time out. When the timeout occurs, I have 2 choices:
set the audit pid to 0 and then close the socket, or just close the socket.
If I just close the socket, I get this message in the logs:
Apr 11 16:55:04 localhost kernel: audit: *NO* daemon at audit_pid=15734
This looks ugly. But if I set the pid to 0, we don't get that message in the
logs. But I am using the ack flag for positive confirmation of all netlink
communication. So what if the signal event is the first thing I read from the
socket instead of the ack? Meaning the event was delivered just after the
timeout and before the logging thread finished?
Besides, by using a timeout, we do not meet the requirements. If the timeout
occurs and we go ahead and shutdown, we simply don't have the information
about who initiated the shutdown.
I can come up with more scenarios that show we can't meet the CAPP
requirements by having an event placed into the message queue. The only way
to guarantee that we meet requirements is for the credentials to be available
*with* the signal delivery.
ALTERNATIVES
What I believe we should do is one of 2 things. Either create a SA_AUDITINFO
structure that can be delivered with the signal - or to swap the values of 2
entries in the siginfo_t structure. Between the two, I think SA_AUDITINFO is
the correct way to do it. But I would like to examine swapping values first.
We need to think about LSPP as we do this and solve both problems while we are
in this area. LSPP will require that we log the credentials of the initiator.
This would be the SE Linux sid. It is kept in kernel as a u32 data type. The
user id is kept as uid_t. So, we need to find 2 elements in the siginfo_t
structure that we can replace with our data.
The si_uid fits the loginuid perfectly. The si_uid normally indicates the user
that sent the signal. Since the audit daemon runs as root, only root
processes can send signals to it. So basically, every time we get a signal,
this element will be root which is meaningless. We can replace it with the
loginuid and now it has meaning.
The SE Linux uid is tougher to fit. Because linux is deployed on 16 bit
platforms, we cannot use any int in the siginfo_t structure and be correct.
We have to find something that is a long. In include/asm-generic/siginfo.h,
we can see the structure. A quick grep for long finds this:
#ifndef __ARCH_SI_BAND_T
#define __ARCH_SI_BAND_T long
#endif
We do not use poll in the audit daemon, so this might be a good candidate.
Another candidate would be anything with clock_t. Looking at the per arch
definition, they all seem to be long. So this means si_stime or si_utime
have the right sizes.
The only issue left is choosing which one we want to use and agreeing on that.
Since long is signed and the SE Linux sid is u32, we need to take care to
load it correctly so we don't get sign extension. It needs to be cast to
unsigned long and then long.
The other way of delivering credential with the signal is to create a new
SA_AUDITINFO flag and a new structure to hold our information:
typedef struct sigauditinfo {
int sa_signo; /* Signal number */
int sa_errno; /* An errno value */
int sa_code; /* Signal code */
pid_t sa_pid; /* Sending process ID */
sid sa_pidsid; /* Sending process sid */
uid_t sa_uid; /* Real user ID of sending process */
sid sa_uidsid; /* Real user's sid */
uid_t sa_luid; /* Login user ID of sending process */
int si_status; /* Exit value or signal */
} sigauditinfo_t;
This structure could be added to a union to ensure that it is the same size as
siginfo_t. This will keep the stack unwinders happy. The above structure
could be expanded to also include:
clock_t si_utime; /* User time consumed */
clock_t si_stime; /* System time consumed */
sigval_t si_value; /* Signal value */
int si_int; /* POSIX.1b signal */
void * si_ptr; /* POSIX.1b signal */
void * si_addr; /* Memory location which caused fault */
int si_band; /* Band event */
int si_fd; /* File descriptor */
But if we do that, we are too big to be in a union without increasing the
overall size. We could overcome this problem by using si_addr to point to a
new structure whenever there's no address fault. That address would be valid
only until the signal handler returns or is longjmp'ed out of.
NEXT STEP
The next step is to decide which way is cleanest and acceptable by upstream
developers. Are there holes in either way proposed above? Can sending an
shutdown audit event via netlink be done without races?
-Steve