11:52 a.m.
Add a parser to parse subject attributes from EVENT_LISTENER and
NETFILTER_CFG record types.
This is a new order for subject attributes for two record types that
usually occur in user context and therefore would be informed by a
SYSCALL record, but occasionally stand alone and need the subject
attributes added. In the case of the NETFILTER_CFG event, since it is
kernel-initiated, several of the subject attributes are unset and
meaningless in the kernel context and duplicates in user context, hence
removed.
Please see the upstream issues
https://github.com/linux-audit/audit-kernel/issues/28 and
https://github.com/linux-audit/audit-kernel/issues/25 .
changelog:
v6
- remove uid, auid as duplicates or unset
v1-4
- no userspace patches
Richard Guy Briggs (2):
ausearch-parse: add parser for YAASAO
ausearch-parse: mod parser for YAASAO for NETFILTER_CFG
src/ausearch-parse.c | 168 ++++++++++++++++++++++++++++++++++++++++++++++++++-
1 file changed, 167 insertions(+), 1 deletion(-)
--
1.8.3.1
11:52 a.m.
New subject: [PATCH ghak28/ghak25 user v6 1/2] ausearch-parse: add parser for YAASAO
Add a parser for Yet Another Audit Subject Attributes Order that was
introduced with ghak28 for the AUDIT_EVENT_LISTENER.
Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com>
---
src/ausearch-parse.c | 166 +++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 166 insertions(+)
diff --git a/src/ausearch-parse.c b/src/ausearch-parse.c
index a2cdb1fb5c60..be1d32cdfa5f 100644
--- a/src/ausearch-parse.c
+++ b/src/ausearch-parse.c
@@ -62,6 +62,7 @@ static int parse_kernel_anom(const lnode *n, search_items *s);
static int parse_simple_message(const lnode *n, search_items *s);
static int parse_tty(const lnode *n, search_items *s);
static int parse_pkt(const lnode *n, search_items *s);
+static int parse_yaasao(lnode *n, search_items *s);
static int audit_avc_init(search_items *s)
@@ -177,6 +178,9 @@ int extract_search_items(llist *l)
case AUDIT_REPLACE...AUDIT_BPF:
// Nothing to parse
break;
+ case AUDIT_EVENT_LISTENER:
+ ret = parse_yaasao(n, s);
+ break;
case AUDIT_TTY:
ret = parse_tty(n, s);
break;
@@ -2568,3 +2572,165 @@ static int parse_pkt(const lnode *n, search_items *s)
return 0;
}
+// parse Yet Another Audit Subject Attributes Order
+// /pid.*uid.*auid.*tty.*ses.*subj.*comm.*exe
+static int parse_yaasao(lnode *n, search_items *s)
+{
+ char *ptr, *str, *term;
+ term = n->message;
+
+ // get pid if not already filled
+ if (event_pid != -1 && s->pid == -1) {
+ str = strstr(term, " pid=");
+ if (str) {
+ ptr = str + 5;
+ term = strchr(ptr, ' ');
+ if (term == NULL)
+ return 52;
+ *term = 0;
+ errno = 0;
+ s->pid = strtoul(ptr, NULL, 10);
+ if (errno)
+ return 53;
+ *term = ' ';
+ } else
+ return 54;
+ }
+ // get uid if not already filled
+ if ((s->uid == -1 && !s->tuid) && (event_uid != -1 || event_tuid))
{
+ str = strstr(term, "uid=");
+ if (str) {
+ ptr = str + 4;
+ term = strchr(ptr, ' ');
+ if (term == NULL)
+ return 55;
+ *term = 0;
+ errno = 0;
+ s->uid = strtoul(ptr, NULL, 10);
+ if (errno)
+ return 56;
+ *term = ' ';
+ if (s->tuid) free((void *)s->tuid);
+ s->tuid = lookup_uid("uid", s->uid);
+ } else
+ return 57;
+ }
+ // get loginuid if not already filled
+ if ((s->loginuid == -2 && !s->tauid) && (event_loginuid != -2 ||
event_tauid)) {
+ str = strstr(term, "auid=");
+ if (str) {
+ ptr = str + 5;
+ term = strchr(ptr, ' ');
+ if (term == NULL)
+ return 58;
+ *term = 0;
+ errno = 0;
+ s->loginuid = strtoul(ptr, NULL, 10);
+ if (errno)
+ return 59;
+ *term = ' ';
+ if (s->tauid) free((void *)s->tauid);
+ s->tauid = lookup_uid("auid", s->loginuid);
+ } else
+ return 60;
+ }
+ // get tty if not already filled
+ if (!s->terminal && event_terminal) {
+ // dont do this search unless needed
+ str = strstr(term, "tty=");
+ if (str) {
+ str += 4;
+ term = strchr(str, ' ');
+ if (term == NULL)
+ return 61;
+ *term = 0;
+ if (s->terminal) // ANOM_NETLINK has one
+ free(s->terminal);
+ s->terminal = strdup(str);
+ *term = ' ';
+ } else
+ return 62;
+ }
+ // get ses if not already filled
+ if (s->session_id == -2 && event_session_id != -2 ) {
+ str = strstr(term, "ses=");
+ if (str) {
+ ptr = str + 4;
+ term = strchr(ptr, ' ');
+ if (term == NULL)
+ return 63;
+ *term = 0;
+ errno = 0;
+ s->session_id = strtoul(ptr, NULL, 10);
+ if (errno)
+ return 64;
+ *term = ' ';
+ } else
+ return 65
+ }
+ // get subject if not already filled
+ if (!s->avc && event_subject) {
+ // scontext
+ str = strstr(term, "subj=");
+ if (str) {
+ str += 5;
+ term = strchr(str, ' ');
+ if (term == NULL)
+ return 66;
+ *term = 0;
+ if (audit_avc_init(s) == 0) {
+ anode an;
+
+ anode_init(&an);
+ an.scontext = strdup(str);
+ alist_append(s->avc, &an);
+ *term = ' ';
+ } else
+ return 67;
+ } else
+ return 68;
+ }
+ // get command line if not already filled
+ if (!s->comm && event_comm) {
+ // dont do this search unless needed
+ str = strstr(term, "comm=");
+ if (str) {
+ /* Make the syscall one override */
+ if (s->comm)
+ free(s->comm);
+ str += 5;
+ if (*str == '"') {
+ str++;
+ term = strchr(str, '"');
+ if (term == NULL)
+ return 69;
+ *term = 0;
+ s->comm = strdup(str);
+ *term = '"';
+ } else
+ s->comm = unescape(str);
+ } else
+ return 70;
+ }
+ // get exe if not already filled
+ if (!s->exe && event_exe) {
+ // dont do this search unless needed
+ str = strstr(n->message, "exe=");
+ if (str) {
+ str += 4;
+ if (*str == '"') {
+ str++;
+ term = strchr(str, '"');
+ if (term == NULL)
+ return 71;
+ *term = 0;
+ s->exe = strdup(str);
+ *term = '"';
+ } else
+ s->exe = unescape(str);
+ } else
+ return 72;
+ }
+ return 0;
+}
+
--
1.8.3.1
11:52 a.m.
New subject: [PATCH ghak28/ghak25 user v6 2/2] ausearch-parse: mod parser for YAASAO for NETFILTER_CFG
Modify the YAASAO parser to accomodate the ghak25 NETFILTER_CFG record.
Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com>
---
src/ausearch-parse.c | 52 ++++++++++++++++++++++++++--------------------------
1 file changed, 26 insertions(+), 26 deletions(-)
diff --git a/src/ausearch-parse.c b/src/ausearch-parse.c
index be1d32cdfa5f..cd8632a58ac0 100644
--- a/src/ausearch-parse.c
+++ b/src/ausearch-parse.c
@@ -173,11 +173,11 @@ int extract_search_items(llist *l)
case AUDIT_BPRM_FCAPS:
case AUDIT_CAPSET:
case AUDIT_MMAP:
- case AUDIT_NETFILTER_CFG:
case AUDIT_PROCTITLE:
case AUDIT_REPLACE...AUDIT_BPF:
// Nothing to parse
break;
+ case AUDIT_NETFILTER_CFG:
case AUDIT_EVENT_LISTENER:
ret = parse_yaasao(n, s);
break;
@@ -2596,7 +2596,7 @@ static int parse_yaasao(lnode *n, search_items *s)
} else
return 54;
}
- // get uid if not already filled
+ // optionally get uid if not already filled
if ((s->uid == -1 && !s->tuid) && (event_uid != -1 || event_tuid))
{
str = strstr(term, "uid=");
if (str) {
@@ -2610,31 +2610,31 @@ static int parse_yaasao(lnode *n, search_items *s)
if (errno)
return 56;
*term = ' ';
- if (s->tuid) free((void *)s->tuid);
- s->tuid = lookup_uid("uid", s->uid);
} else
- return 57;
+ s->uid = 0;
+ if (s->tuid) free((void *)s->tuid);
+ s->tuid = lookup_uid("uid", s->uid);
}
- // get loginuid if not already filled
+ // optionally get loginuid if not already filled
if ((s->loginuid == -2 && !s->tauid) && (event_loginuid != -2 ||
event_tauid)) {
str = strstr(term, "auid=");
if (str) {
ptr = str + 5;
term = strchr(ptr, ' ');
if (term == NULL)
- return 58;
+ return 57;
*term = 0;
errno = 0;
s->loginuid = strtoul(ptr, NULL, 10);
if (errno)
- return 59;
+ return 58;
*term = ' ';
- if (s->tauid) free((void *)s->tauid);
- s->tauid = lookup_uid("auid", s->loginuid);
} else
- return 60;
+ s->loginuid = (unsigned long)-1;
+ if (s->tauid) free((void *)s->tauid);
+ s->tauid = lookup_uid("auid", s->loginuid);
}
- // get tty if not already filled
+ // optionally get tty if not already filled
if (!s->terminal && event_terminal) {
// dont do this search unless needed
str = strstr(term, "tty=");
@@ -2642,31 +2642,31 @@ static int parse_yaasao(lnode *n, search_items *s)
str += 4;
term = strchr(str, ' ');
if (term == NULL)
- return 61;
+ return 59;
*term = 0;
if (s->terminal) // ANOM_NETLINK has one
free(s->terminal);
s->terminal = strdup(str);
*term = ' ';
} else
- return 62;
+ s->terminal = strdup("(none)");
}
- // get ses if not already filled
+ // optionally get ses if not already filled
if (s->session_id == -2 && event_session_id != -2 ) {
str = strstr(term, "ses=");
if (str) {
ptr = str + 4;
term = strchr(ptr, ' ');
if (term == NULL)
- return 63;
+ return 60;
*term = 0;
errno = 0;
s->session_id = strtoul(ptr, NULL, 10);
if (errno)
- return 64;
+ return 61;
*term = ' ';
} else
- return 65
+ s->session_id = (unsigned long)-1;
}
// get subject if not already filled
if (!s->avc && event_subject) {
@@ -2676,7 +2676,7 @@ static int parse_yaasao(lnode *n, search_items *s)
str += 5;
term = strchr(str, ' ');
if (term == NULL)
- return 66;
+ return 62;
*term = 0;
if (audit_avc_init(s) == 0) {
anode an;
@@ -2686,9 +2686,9 @@ static int parse_yaasao(lnode *n, search_items *s)
alist_append(s->avc, &an);
*term = ' ';
} else
- return 67;
+ return 63;
} else
- return 68;
+ return 64;
}
// get command line if not already filled
if (!s->comm && event_comm) {
@@ -2703,16 +2703,16 @@ static int parse_yaasao(lnode *n, search_items *s)
str++;
term = strchr(str, '"');
if (term == NULL)
- return 69;
+ return 65;
*term = 0;
s->comm = strdup(str);
*term = '"';
} else
s->comm = unescape(str);
} else
- return 70;
+ return 66;
}
- // get exe if not already filled
+ // optionally get exe if not already filled
if (!s->exe && event_exe) {
// dont do this search unless needed
str = strstr(n->message, "exe=");
@@ -2722,14 +2722,14 @@ static int parse_yaasao(lnode *n, search_items *s)
str++;
term = strchr(str, '"');
if (term == NULL)
- return 71;
+ return 67;
*term = 0;
s->exe = strdup(str);
*term = '"';
} else
s->exe = unescape(str);
} else
- return 72;
+ s->exe = strdup("(null)");
}
return 0;
}
--
1.8.3.1
1676
days inactive
1676
days old
linux-audit@lists.linux-audit.osci.io
2 comments
1 participants
participants (1)
-
Richard Guy Briggs