Re: [PATCH v35 26/29] Audit: Add record for multiple task security contexts

On Mon, Apr 25, 2022 at 9:08 PM John Johansen <john.johansen(a)canonical.com&gt; wrote: > On 4/18/22 07:59, Casey Schaufler wrote: >> Create a new audit record AUDIT_MAC_TASK_CONTEXTS. >> An example of the MAC_TASK_CONTEXTS (1420) record is: >> >> type=MAC_TASK_CONTEXTS[1420] >> msg=audit(1600880931.832:113) >> subj_apparmor=unconfined >> subj_smack=_ >> >> When an audit event includes a AUDIT_MAC_TASK_CONTEXTS record >> the "subj=" field in other records in the event will be "subj=?". >> An AUDIT_MAC_TASK_CONTEXTS record is supplied when the system has >> multiple security modules that may make access decisions based >> on a subject security context. >> >> Functions are created to manage the skb list in the audit_buffer. >> >> Signed-off-by: Casey Schaufler <casey(a)schaufler-ca.com&gt; > > Besides moving the aux fns, and the whining below > Reviewed-by: John Johansen <john.johansen(a)canonical.com&gt; ... >> diff --git a/kernel/audit.c b/kernel/audit.c >> index 4d44c05053b0..8ed2d717c217 100644 >> --- a/kernel/audit.c >> +++ b/kernel/audit.c >> @@ -2185,16 +2238,44 @@ int audit_log_task_context(struct audit_buffer *ab) >> if (!lsmblob_is_set(&blob)) >> return 0; >> >> - error = security_secid_to_secctx(&blob, &context, LSMBLOB_FIRST); >> + if (!lsm_multiple_contexts()) { >> + error = security_secid_to_secctx(&blob, &context, >> + LSMBLOB_FIRST); >> + if (error) { >> + if (error != -EINVAL) >> + goto error_path; >> + return 0; >> + } >> >> - if (error) { >> - if (error != -EINVAL) >> + audit_log_format(ab, " subj=%s", context.context); >> + security_release_secctx(&context); >> + } else { >> + /* Multiple LSMs provide contexts. Include an aux record. */ >> + audit_log_format(ab, " subj=?"); > > just me whining, you sure we can't just drop subj= here Have I recently given you my "the audit code is crap" speech? ;)

I more or less answered this with my comments on the earlier patch, but we need to keep this around for compatibility. It will get better in the future.