Re: [RFC PATCH ghak90 (was ghak32) V3 01/10] audit: add container id

Implement the proc fs write to set the audit container identifier of a process, emitting an AUDIT_CONTAINER_ID record to document the event. This is a write from the container orchestrator task to a proc entry of the form /proc/PID/audit_containerid where PID is the process ID of the newly created task that is to become the first task in a container, or an additional task added to a container. The write expects up to a u64 value (unset: 18446744073709551615). The writer must have capability CAP_AUDIT_CONTROL. This will produce a record such as this: type=CONTAINER_ID msg=audit(2018-06-06 12:39:29.636:26949) : op=set opid=2209 old-contid=18446744073709551615 contid=123456 pid=628 auid=root uid=root tty=ttyS0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 comm=bash exe=/usr/bin/bash res=yes The "op" field indicates an initial set. The "pid" to "ses" fields are the orchestrator while the "opid" field is the object's PID, the process being "contained". Old and new audit container identifier values are given in the "contid" fields, while res indicates its success. It is not permitted to unset or re-set the audit container identifier. A child inherits its parent's audit container identifier, but then can be set only once after. See: https://github.com/linux-audit/audit-kernel/issues/90 See: https://github.com/linux-audit/audit-userspace/issues/51 See: https://github.com/linux-audit/audit-testsuite/issues/64 See: https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; --- fs/proc/base.c | 37 ++++++++++++++++++++++++ include/linux/audit.h | 25 ++++++++++++++++ include/uapi/linux/audit.h | 2 ++ kernel/auditsc.c | 71 ++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 135 insertions(+)

--- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -606,6 +621,16 @@ static inline bool audit_loginuid_set(struct task_struct *tsk) return uid_valid(audit_get_loginuid(tsk)); } +static inline bool cid_valid(u64 contid) +{ + return contid != AUDIT_CID_UNSET; +} + +static inline bool audit_contid_set(struct task_struct *tsk) +{ + return cid_valid(audit_get_contid(tsk)); +}

diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 59ef7a81..611e926 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -956,6 +956,8 @@ int audit_alloc(struct task_struct *tsk) return -ENOMEM; info->loginuid = audit_get_loginuid(current); info->sessionid = audit_get_sessionid(current); + info->contid = audit_get_contid(current); + info->inherited = true;

tsk->audit = info; if (likely(!audit_ever_enabled)) @@ -985,6 +987,8 @@ int audit_alloc(struct task_struct *tsk) struct audit_task_info init_struct_audit = { .loginuid = INVALID_UID, .sessionid = AUDIT_SID_UNSET, + .contid = AUDIT_CID_UNSET, + .inherited = true, .ctx = NULL, }; @@ -2112,6 +2116,73 @@ int audit_set_loginuid(kuid_t loginuid) } /** + * audit_set_contid - set current task's audit_context contid + * @contid: contid value + * + * Returns 0 on success, -EPERM on permission failure. + * + * Called (set) from fs/proc/base.c::proc_contid_write(). + */ +int audit_set_contid(struct task_struct *task, u64 contid) +{ + u64 oldcontid; + int rc = 0; + struct audit_buffer *ab; + uid_t uid; + struct tty_struct *tty; + char comm[sizeof(current->comm)]; + + /* Can't set if audit disabled */ + if (!task->audit) + return -ENOPROTOOPT; + oldcontid = audit_get_contid(task); + /* Don't allow the audit containerid to be unset */ + if (!cid_valid(contid)) + rc = -EINVAL; + /* if we don't have caps, reject */ + else if (!capable(CAP_AUDIT_CONTROL)) + rc = -EPERM; + /* if task has children or is not single-threaded, deny */ + else if (!list_empty(&task->children)) + rc = -EBUSY;

+ else if (!(thread_group_leader(task) && thread_group_empty(task))) + rc = -EALREADY;

+ /* it is already set, and not inherited from the parent, reject */ + else if (cid_valid(oldcontid) && !task->audit->inherited) + rc = -EEXIST;

+ if (!rc) { + task_lock(task); + task->audit->contid = contid; + task->audit->inherited = false; + task_unlock(task);

+ } + + if (!audit_enabled) + return rc; + + ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONTAINER_ID); + if (!ab) + return rc; + + uid = from_kuid(&init_user_ns, task_uid(current)); + tty = audit_get_tty(current); + audit_log_format(ab, "op=set opid=%d old-contid=%llu contid=%llu pid=%d uid=%u auid=%u tty=%s ses=%u", + task_tgid_nr(task), oldcontid, contid, + task_tgid_nr(current), uid + from_kuid(&init_user_ns, audit_get_loginuid(current)), + tty ? tty_name(tty) : "(none)", + audit_get_sessionid(current)); + audit_put_tty(tty); + audit_log_task_context(ab); + audit_log_format(ab, " comm="); + audit_log_untrustedstring(ab, get_task_comm(comm, current)); + audit_log_d_path_exe(ab, current->mm); + audit_log_format(ab, " res=%d", !rc); + audit_log_end(ab); + return rc; +} + +/** * __audit_mq_open - record audit data for a POSIX MQ open * @oflag: open flag * @mode: mode bits