On Wednesday, June 6, 2018 12:58:28 PM EDT Richard Guy Briggs wrote: > Implement the proc fs write to set the audit container identifier of a > process, emitting an AUDIT_CONTAINER_ID record to document the event. > > This is a write from the container orchestrator task to a proc entry of > the form /proc/PID/audit_containerid where PID is the process ID of the > newly created task that is to become the first task in a container, or > an additional task added to a container. > > The write expects up to a u64 value (unset: 18446744073709551615). > > The writer must have capability CAP_AUDIT_CONTROL. > > This will produce a record such as this: > type=CONTAINER_ID msg=audit(2018-06-06 12:39:29.636:26949) : op=set > opid=2209 old-contid=18446744073709551615 contid=123456 pid=628 auid=root > uid=root tty=ttyS0 ses=1 > subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 comm=bash > exe=/usr/bin/bash res=yes > > The "op" field indicates an initial set. The "pid" to "ses" fields are > the orchestrator while the "opid" field is the object's PID, the process > being "contained". Old and new audit container identifier values are > given in the "contid" fields, while res indicates its success. > > It is not permitted to unset or re-set the audit container identifier. > A child inherits its parent's audit container identifier, but then can > be set only once after. > > See: https://github.com/linux-audit/audit-kernel/issues/90 > See: https://github.com/linux-audit/audit-userspace/issues/51 > See: https://github.com/linux-audit/audit-testsuite/issues/64 > See: > https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID > > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; > --- > fs/proc/base.c | 37 ++++++++++++++++++++++++ > include/linux/audit.h | 25 ++++++++++++++++ > include/uapi/linux/audit.h | 2 ++ > kernel/auditsc.c | 71 > ++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 135 > insertions(+) > > diff --git a/fs/proc/base.c b/fs/proc/base.c > index eafa39a..318dff4 100644 > --- a/fs/proc/base.c > +++ b/fs/proc/base.c > @@ -1302,6 +1302,41 @@ static ssize_t proc_sessionid_read(struct file * > file, char __user * buf, .read = proc_sessionid_read, > .llseek = generic_file_llseek, > }; > + > +static ssize_t proc_contid_write(struct file *file, const char __user > *buf, + size_t count, loff_t *ppos) > +{ > + struct inode *inode = file_inode(file); > + u64 contid; > + int rv; > + struct task_struct *task = get_proc_task(inode); > + > + if (!task) > + return -ESRCH; > + if (*ppos != 0) { > + /* No partial writes. */ > + put_task_struct(task); > + return -EINVAL; > + } > + > + rv = kstrtou64_from_user(buf, count, 10, &contid); > + if (rv < 0) { > + put_task_struct(task); > + return rv; > + } > + > + rv = audit_set_contid(task, contid); > + put_task_struct(task); > + if (rv < 0) > + return rv; > + return count; > +} > + > +static const struct file_operations proc_contid_operations = { > + .write = proc_contid_write, > + .llseek = generic_file_llseek, > +}; > + > #endif > > #ifdef CONFIG_FAULT_INJECTION > @@ -2995,6 +3030,7 @@ static int proc_pid_patch_state(struct seq_file *m, > struct pid_namespace *ns, #ifdef CONFIG_AUDITSYSCALL > REG("loginuid", S_IWUSR|S_IRUGO, proc_loginuid_operations), > REG("sessionid", S_IRUGO, proc_sessionid_operations), > + REG("audit_containerid", S_IWUSR, proc_contid_operations), > #endif > #ifdef CONFIG_FAULT_INJECTION > REG("make-it-fail", S_IRUGO|S_IWUSR, proc_fault_inject_operations), > @@ -3386,6 +3422,7 @@ static int proc_tid_comm_permission(struct inode > *inode, int mask) #ifdef CONFIG_AUDITSYSCALL > REG("loginuid", S_IWUSR|S_IRUGO, proc_loginuid_operations), > REG("sessionid", S_IRUGO, proc_sessionid_operations), > + REG("audit_containerid", S_IWUSR, proc_contid_operations), > #endif > #ifdef CONFIG_FAULT_INJECTION > REG("make-it-fail", S_IRUGO|S_IWUSR, proc_fault_inject_operations), > diff --git a/include/linux/audit.h b/include/linux/audit.h > index 4f824c4..497cd81 100644 > --- a/include/linux/audit.h > +++ b/include/linux/audit.h > @@ -219,6 +219,8 @@ static inline void audit_log_task_info(struct > audit_buffer *ab, struct audit_task_info { > kuid_t loginuid; > unsigned int sessionid; > + u64 contid; > + bool inherited; /* containerid inheritance */ > struct audit_context *ctx; > }; > extern struct audit_task_info init_struct_audit; > @@ -331,6 +333,7 @@ static inline void audit_ptrace(struct task_struct *t) > extern int auditsc_get_stamp(struct audit_context *ctx, > struct timespec64 *t, unsigned int *serial); > extern int audit_set_loginuid(kuid_t loginuid); > +extern int audit_set_contid(struct task_struct *tsk, u64 contid); > > static inline kuid_t audit_get_loginuid(struct task_struct *tsk) > { > @@ -348,6 +351,14 @@ static inline unsigned int audit_get_sessionid(struct > task_struct *tsk) return AUDIT_SID_UNSET; > } > > +static inline u64 audit_get_contid(struct task_struct *tsk) > +{ > + if (!tsk->audit) > + return AUDIT_CID_UNSET; > + else > + return tsk->audit->contid; > +} > + > extern void __audit_ipc_obj(struct kern_ipc_perm *ipcp); > extern void __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t > gid, umode_t mode); extern void __audit_bprm(struct linux_binprm *bprm); > @@ -542,6 +553,10 @@ static inline unsigned int audit_get_sessionid(struct > task_struct *tsk) { > return AUDIT_SID_UNSET; > } > +static inline kuid_t audit_get_contid(struct task_struct *tsk) > +{ > + return AUDIT_CID_UNSET; > +} > static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp) > { } > static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid, > @@ -606,6 +621,16 @@ static inline bool audit_loginuid_set(struct > task_struct *tsk) return uid_valid(audit_get_loginuid(tsk)); > } > > +static inline bool cid_valid(u64 contid) > +{ > + return contid != AUDIT_CID_UNSET; > +} > + > +static inline bool audit_contid_set(struct task_struct *tsk) > +{ > + return cid_valid(audit_get_contid(tsk)); > +} > + > static inline void audit_log_string(struct audit_buffer *ab, const char > *buf) { > audit_log_n_string(ab, buf, strlen(buf)); > diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h > index 04f9bd2..c3b1aca 100644 > --- a/include/uapi/linux/audit.h > +++ b/include/uapi/linux/audit.h > @@ -71,6 +71,7 @@ > #define AUDIT_TTY_SET 1017 /* Set TTY auditing status */ > #define AUDIT_SET_FEATURE 1018 /* Turn an audit feature on or off */ > #define AUDIT_GET_FEATURE 1019 /* Get which features are enabled */ > +#define AUDIT_CONTAINER_ID 1020 /* Define the container id and information > */ > > #define AUDIT_FIRST_USER_MSG 1100 /* Userspace messages mostly > uninteresting to kernel */ #define AUDIT_USER_AVC 1107 /* We filter this > differently */ > @@ -466,6 +467,7 @@ struct audit_tty_status { > > #define AUDIT_UID_UNSET (unsigned int)-1 > #define AUDIT_SID_UNSET ((unsigned int)-1) > +#define AUDIT_CID_UNSET ((u64)-1) > > /* audit_rule_data supports filter rules with both integer and string > * fields. It corresponds with AUDIT_ADD_RULE, AUDIT_DEL_RULE and > diff --git a/kernel/auditsc.c b/kernel/auditsc.c > index 59ef7a81..611e926 100644 > --- a/kernel/auditsc.c > +++ b/kernel/auditsc.c > @@ -956,6 +956,8 @@ int audit_alloc(struct task_struct *tsk) > return -ENOMEM; > info->loginuid = audit_get_loginuid(current); > info->sessionid = audit_get_sessionid(current); > + info->contid = audit_get_contid(current); > + info->inherited = true; > tsk->audit = info; > > if (likely(!audit_ever_enabled)) > @@ -985,6 +987,8 @@ int audit_alloc(struct task_struct *tsk) > struct audit_task_info init_struct_audit = { > .loginuid = INVALID_UID, > .sessionid = AUDIT_SID_UNSET, > + .contid = AUDIT_CID_UNSET, > + .inherited = true, > .ctx = NULL, > }; > > @@ -2112,6 +2116,73 @@ int audit_set_loginuid(kuid_t loginuid) > } > > /** > + * audit_set_contid - set current task's audit_context contid > + * @contid: contid value > + * > + * Returns 0 on success, -EPERM on permission failure. > + * > + * Called (set) from fs/proc/base.c::proc_contid_write(). > + */ > +int audit_set_contid(struct task_struct *task, u64 contid) > +{ > + u64 oldcontid; > + int rc = 0; > + struct audit_buffer *ab; > + uid_t uid; > + struct tty_struct *tty; > + char comm[sizeof(current->comm)]; > + > + /* Can't set if audit disabled */ > + if (!task->audit) > + return -ENOPROTOOPT; > + oldcontid = audit_get_contid(task); > + /* Don't allow the audit containerid to be unset */ > + if (!cid_valid(contid)) > + rc = -EINVAL; > + /* if we don't have caps, reject */ > + else if (!capable(CAP_AUDIT_CONTROL)) > + rc = -EPERM; > + /* if task has children or is not single-threaded, deny */ > + else if (!list_empty(&task->children)) > + rc = -EBUSY; > + else if (!(thread_group_leader(task) && thread_group_empty(task))) > + rc = -EALREADY; > + /* it is already set, and not inherited from the parent, reject */ > + else if (cid_valid(oldcontid) && !task->audit->inherited) > + rc = -EEXIST; > + if (!rc) { > + task_lock(task); > + task->audit->contid = contid; > + task->audit->inherited = false; > + task_unlock(task); > + } > + > + if (!audit_enabled) > + return rc; > + > + ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONTAINER_ID); > + if (!ab) > + return rc; > + > + uid = from_kuid(&init_user_ns, task_uid(current)); > + tty = audit_get_tty(current); > + audit_log_format(ab, "op=set opid=%d old-contid=%llu contid=%llu pid=%d > uid=%u auid=%u tty=%s ses=%u", + task_tgid_nr(task), oldcontid, contid, > + task_tgid_nr(current), uid > + from_kuid(&init_user_ns, audit_get_loginuid(current)), > + tty ? tty_name(tty) : "(none)", > + audit_get_sessionid(current)); The event code doesn't match the example event at the top. (uid and auid are transposed.) But the code looks right.

Ack for the event format.

-Steve > + audit_put_tty(tty); > + audit_log_task_context(ab); > + audit_log_format(ab, " comm="); > + audit_log_untrustedstring(ab, get_task_comm(comm, current)); > + audit_log_d_path_exe(ab, current->mm); > + audit_log_format(ab, " res=%d", !rc); > + audit_log_end(ab); > + return rc; > +} > + > +/** > * __audit_mq_open - record audit data for a POSIX MQ open > * @oflag: open flag > * @mode: mode bits

On Wed, Jun 6, 2018 at 1:00 PM Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > Implement the proc fs write to set the audit container identifier of a > process, emitting an AUDIT_CONTAINER_ID record to document the event. > > This is a write from the container orchestrator task to a proc entry of > the form /proc/PID/audit_containerid where PID is the process ID of the > newly created task that is to become the first task in a container, or > an additional task added to a container. > > The write expects up to a u64 value (unset: 18446744073709551615). > > The writer must have capability CAP_AUDIT_CONTROL. > > This will produce a record such as this: > type=CONTAINER_ID msg=audit(2018-06-06 12:39:29.636:26949) : op=set opid=2209 old-contid=18446744073709551615 contid=123456 pid=628 auid=root uid=root tty=ttyS0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 comm=bash exe=/usr/bin/bash res=yes > > The "op" field indicates an initial set. The "pid" to "ses" fields are > the orchestrator while the "opid" field is the object's PID, the process > being "contained". Old and new audit container identifier values are > given in the "contid" fields, while res indicates its success. > > It is not permitted to unset or re-set the audit container identifier. > A child inherits its parent's audit container identifier, but then can > be set only once after. > > See: https://github.com/linux-audit/audit-kernel/issues/90 > See: https://github.com/linux-audit/audit-userspace/issues/51 > See: https://github.com/linux-audit/audit-testsuite/issues/64 > See: https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID > > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; > --- > fs/proc/base.c | 37 ++++++++++++++++++++++++ > include/linux/audit.h | 25 ++++++++++++++++ > include/uapi/linux/audit.h | 2 ++ > kernel/auditsc.c | 71 ++++++++++++++++++++++++++++++++++++++++++++++ > 4 files changed, 135 insertions(+) ... > --- a/include/linux/audit.h > +++ b/include/linux/audit.h > @@ -606,6 +621,16 @@ static inline bool audit_loginuid_set(struct task_struct *tsk) > return uid_valid(audit_get_loginuid(tsk)); > } > > +static inline bool cid_valid(u64 contid) > +{ > + return contid != AUDIT_CID_UNSET; > +} > + > +static inline bool audit_contid_set(struct task_struct *tsk) > +{ > + return cid_valid(audit_get_contid(tsk)); > +} For the sake of consistency I think we should rename cid_valid() to audit_contid_valid().

> diff --git a/kernel/auditsc.c b/kernel/auditsc.c > index 59ef7a81..611e926 100644 > --- a/kernel/auditsc.c > +++ b/kernel/auditsc.c > @@ -956,6 +956,8 @@ int audit_alloc(struct task_struct *tsk) > return -ENOMEM; > info->loginuid = audit_get_loginuid(current); > info->sessionid = audit_get_sessionid(current); > + info->contid = audit_get_contid(current); > + info->inherited = true; First see my others comments in this patch about inheritence, but if we decide that flagging inherited values is important we should probably rename the "inherited" field to indicate that it applies to just the "contid" field.

> tsk->audit = info; > > if (likely(!audit_ever_enabled)) > @@ -985,6 +987,8 @@ int audit_alloc(struct task_struct *tsk) > struct audit_task_info init_struct_audit = { > .loginuid = INVALID_UID, > .sessionid = AUDIT_SID_UNSET, > + .contid = AUDIT_CID_UNSET, > + .inherited = true, > .ctx = NULL, > }; > > @@ -2112,6 +2116,73 @@ int audit_set_loginuid(kuid_t loginuid) > } > > /** > + * audit_set_contid - set current task's audit_context contid > + * @contid: contid value > + * > + * Returns 0 on success, -EPERM on permission failure. > + * > + * Called (set) from fs/proc/base.c::proc_contid_write(). > + */ > +int audit_set_contid(struct task_struct *task, u64 contid) > +{ > + u64 oldcontid; > + int rc = 0; > + struct audit_buffer *ab; > + uid_t uid; > + struct tty_struct *tty; > + char comm[sizeof(current->comm)]; > + > + /* Can't set if audit disabled */ > + if (!task->audit) > + return -ENOPROTOOPT; > + oldcontid = audit_get_contid(task); > + /* Don't allow the audit containerid to be unset */ > + if (!cid_valid(contid)) > + rc = -EINVAL; > + /* if we don't have caps, reject */ > + else if (!capable(CAP_AUDIT_CONTROL)) > + rc = -EPERM; > + /* if task has children or is not single-threaded, deny */ > + else if (!list_empty(&task->children)) > + rc = -EBUSY; Is this safe without holding tasklist_lock? I worry we might be vulnerable to a race with fork(). > + else if (!(thread_group_leader(task) && thread_group_empty(task))) > + rc = -EALREADY; Similar concern here as well, although related to threads.

> + /* it is already set, and not inherited from the parent, reject */ > + else if (cid_valid(oldcontid) && !task->audit->inherited) > + rc = -EEXIST; Maybe I'm missing something, but why do we care about preventing reassigning the audit container ID in this case? The task is single threaded and has no descendants at this point so it should be safe, yes? So long as the task changing the audit container ID has capable(CAP_AUDIT_CONTOL) it shouldn't matter, right?

Related, I'm questioning if we would ever care if the audit container ID was inherited or not?

> + if (!rc) { > + task_lock(task); > + task->audit->contid = contid; > + task->audit->inherited = false; > + task_unlock(task); I suspect the task_lock() may not be what we want here, but if we are using task_lock() to protect the audit fields two things come to mind: 1. We should update the header comments for task_lock() in task.h to indicate that it also protects ->audit.

2. Where else do we need to worry about taking this lock? At the very least we should take this lock near the top of this function before we check task->audit and not drop it until after we have set it, or failed the operation for one of the reasons above.

> + } > + > + if (!audit_enabled) > + return rc; > + > + ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONTAINER_ID); > + if (!ab) > + return rc; > + > + uid = from_kuid(&init_user_ns, task_uid(current)); > + tty = audit_get_tty(current); > + audit_log_format(ab, "op=set opid=%d old-contid=%llu contid=%llu pid=%d uid=%u auid=%u tty=%s ses=%u", > + task_tgid_nr(task), oldcontid, contid, > + task_tgid_nr(current), uid > + from_kuid(&init_user_ns, audit_get_loginuid(current)), > + tty ? tty_name(tty) : "(none)", > + audit_get_sessionid(current)); > + audit_put_tty(tty); > + audit_log_task_context(ab); > + audit_log_format(ab, " comm="); > + audit_log_untrustedstring(ab, get_task_comm(comm, current)); > + audit_log_d_path_exe(ab, current->mm); > + audit_log_format(ab, " res=%d", !rc); > + audit_log_end(ab); > + return rc; > +} > + > +/** > * __audit_mq_open - record audit data for a POSIX MQ open > * @oflag: open flag > * @mode: mode bits -- paul moore www.paul-moore.com

On Tue, Jul 24, 2018 at 3:09 PM Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > On 2018-07-20 18:13, Paul Moore wrote: > > On Wed, Jun 6, 2018 at 1:00 PM Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > > > Implement the proc fs write to set the audit container identifier of a > > > process, emitting an AUDIT_CONTAINER_ID record to document the event. > > > > > > This is a write from the container orchestrator task to a proc entry of > > > the form /proc/PID/audit_containerid where PID is the process ID of the > > > newly created task that is to become the first task in a container, or > > > an additional task added to a container. > > > > > > The write expects up to a u64 value (unset: 18446744073709551615). > > > > > > The writer must have capability CAP_AUDIT_CONTROL. > > > > > > This will produce a record such as this: > > > type=CONTAINER_ID msg=audit(2018-06-06 12:39:29.636:26949) : op=set opid=2209 old-contid=18446744073709551615 contid=123456 pid=628 auid=root uid=root tty=ttyS0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 comm=bash exe=/usr/bin/bash res=yes > > > > > > The "op" field indicates an initial set. The "pid" to "ses" fields are > > > the orchestrator while the "opid" field is the object's PID, the process > > > being "contained". Old and new audit container identifier values are > > > given in the "contid" fields, while res indicates its success. > > > > > > It is not permitted to unset or re-set the audit container identifier. > > > A child inherits its parent's audit container identifier, but then can > > > be set only once after. > > > > > > See: https://github.com/linux-audit/audit-kernel/issues/90 > > > See: https://github.com/linux-audit/audit-userspace/issues/51 > > > See: https://github.com/linux-audit/audit-testsuite/issues/64 > > > See: https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID > > > > > > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; > > > --- > > > fs/proc/base.c | 37 ++++++++++++++++++++++++ > > > include/linux/audit.h | 25 ++++++++++++++++ > > > include/uapi/linux/audit.h | 2 ++ > > > kernel/auditsc.c | 71 ++++++++++++++++++++++++++++++++++++++++++++++ > > > 4 files changed, 135 insertions(+) ... > > > @@ -2112,6 +2116,73 @@ int audit_set_loginuid(kuid_t loginuid) > > > } > > > > > > /** > > > + * audit_set_contid - set current task's audit_context contid > > > + * @contid: contid value > > > + * > > > + * Returns 0 on success, -EPERM on permission failure. > > > + * > > > + * Called (set) from fs/proc/base.c::proc_contid_write(). > > > + */ > > > +int audit_set_contid(struct task_struct *task, u64 contid) > > > +{ > > > + u64 oldcontid; > > > + int rc = 0; > > > + struct audit_buffer *ab; > > > + uid_t uid; > > > + struct tty_struct *tty; > > > + char comm[sizeof(current->comm)]; > > > + > > > + /* Can't set if audit disabled */ > > > + if (!task->audit) > > > + return -ENOPROTOOPT; > > > + oldcontid = audit_get_contid(task); > > > + /* Don't allow the audit containerid to be unset */ > > > + if (!cid_valid(contid)) > > > + rc = -EINVAL; > > > + /* if we don't have caps, reject */ > > > + else if (!capable(CAP_AUDIT_CONTROL)) > > > + rc = -EPERM; > > > + /* if task has children or is not single-threaded, deny */ > > > + else if (!list_empty(&task->children)) > > > + rc = -EBUSY; > > > > Is this safe without holding tasklist_lock? I worry we might be > > vulnerable to a race with fork(). > > > > > + else if (!(thread_group_leader(task) && thread_group_empty(task))) > > > + rc = -EALREADY; > > > > Similar concern here as well, although related to threads. > > I think you are correct here and tasklist_lock should cover both. Do we > also want rcu_read_lock() immediately preceeding it? You'll need to take a closer look and determine the locking scheme. I simply took a quick look while reviewing this patch to see what of the existing locks, if any, would be most applicable here; tasklist_lock seemed like a good starting point. It looks like tasklist_lock is defined as a rwlock_t so I'm not sure it would make sense to use it with a RCU protected structure (typically it's RCU+spinlock), but maybe that is the case with a task_struct, you'll need to check.

> > > + /* it is already set, and not inherited from the parent, reject */ > > > + else if (cid_valid(oldcontid) && !task->audit->inherited) > > > + rc = -EEXIST; > > > > Maybe I'm missing something, but why do we care about preventing > > reassigning the audit container ID in this case? The task is single > > threaded and has no descendants at this point so it should be safe, > > yes? So long as the task changing the audit container ID has > > capable(CAP_AUDIT_CONTOL) it shouldn't matter, right? > > Because we hammered out this idea 6 months ago in the design phase and I > thought we all firmly agreed that the audit container identifier could > only be set once. Has any significant discussion happenned since then > to change that wisdom? I just wonder why this is coming up now. Implementation, and time, can change how one looks at an earlier design. I believe this is why most well reasoned specifications have a reference design. Remind me why the design had the restriction of write once for the audit container ID? At this point given the CAP_AUDIT_CONTROL and the single-thread, no-children restrictions I'm not sure what harm there is in allowing the value to be written multiple times (so long as the changes are audited of course).

> > Related, I'm questioning if we would ever care if the audit container > > ID was inherited or not? > > We do since that is the only way we can tell if the value has been set > once already or inherited unless we check if the parent's audit > container identifier is identical (which tells us it was inherited). Tied to the above question. If we don't care about multiple changes, given the other constraints, we probably don't need the inherited flag.

paul moore

Create a new audit record AUDIT_CONTAINER to document the audit container identifier of a process if it is present. Called from audit_log_exit(), syscalls are covered. A sample raw event: type=SYSCALL msg=audit(1519924845.499:257): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=56374e1cef30 a2=241 a3=1b6 items=2 ppid=606 pid=635 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="tmpcontainerid" type=CWD msg=audit(1519924845.499:257): cwd="/root" type=PATH msg=audit(1519924845.499:257): item=0 name="/tmp/" inode=13863 dev=00:27 mode=041777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tmp_t:s0 nametype= PARENT cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0 type=PATH msg=audit(1519924845.499:257): item=1 name="/tmp/tmpcontainerid" inode=17729 dev=00:27 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 nametype=CREATE cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0 type=PROCTITLE msg=audit(1519924845.499:257): proctitle=62617368002D6300736C65657020313B206563686F2074657374203E202F746D 702F746D70636F6E7461696E65726964 type=CONTAINER msg=audit(1519924845.499:257): op=task contid=123458

See: https://github.com/linux-audit/audit-kernel/issues/90 See: https://github.com/linux-audit/audit-userspace/issues/51 See: https://github.com/linux-audit/audit-testsuite/issues/64 See: https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; --- include/linux/audit.h | 7 +++++++ include/uapi/linux/audit.h | 1 + kernel/audit.c | 23 +++++++++++++++++++++++ kernel/auditsc.c | 3 +++ 4 files changed, 34 insertions(+) diff --git a/include/linux/audit.h b/include/linux/audit.h index 497cd81..4e1e34e 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -152,6 +152,9 @@ extern void audit_log_key(struct audit_buffer

extern int audit_log_task_context(struct audit_buffer *ab); extern void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk); +extern int audit_log_contid(struct task_struct *tsk, + struct audit_context *context, + char *op); extern int audit_update_lsm_rules(void); @@ -202,6 +205,10 @@ static inline int audit_log_task_context(struct audit_buffer *ab) static inline void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk) { } +static inline int audit_log_contid(struct task_struct *tsk, + struct audit_context *context, + char *op) +{ } #define audit_enabled 0 #endif /* CONFIG_AUDIT */ diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h index c3b1aca..469ab25 100644 --- a/include/uapi/linux/audit.h +++ b/include/uapi/linux/audit.h @@ -115,6 +115,7 @@ #define AUDIT_REPLACE 1329 /* Replace auditd if this packet unanswerd

#define AUDIT_KERN_MODULE 1330 /* Kernel Module events */ #define AUDIT_FANOTIFY 1331 /* Fanotify access decision */ +#define AUDIT_CONTAINER 1332 /* Container ID */ #define AUDIT_AVC 1400 /* SE Linux avc denial or grant */ #define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */ diff --git a/kernel/audit.c b/kernel/audit.c index e7478cb..5e150c6 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -2048,6 +2048,29 @@ void audit_log_session_info(struct audit_buffer *ab) audit_log_format(ab, " auid=%u ses=%u", auid, sessionid); } +/* + * audit_log_contid - report container info + * @tsk: task to be recorded + * @context: task or local context for record + * @op: contid string description + */ +int audit_log_contid(struct task_struct *tsk, + struct audit_context *context, char *op) +{ + struct audit_buffer *ab; + + if (!audit_contid_set(tsk)) + return 0; + /* Generate AUDIT_CONTAINER record with container ID */ + ab = audit_log_start(context, GFP_KERNEL, AUDIT_CONTAINER); + if (!ab) + return -ENOMEM; + audit_log_format(ab, "op=%s contid=%llu", + op, audit_get_contid(tsk)); + audit_log_end(ab); + return 0; +} + void audit_log_key(struct audit_buffer *ab, char *key) { audit_log_format(ab, " key="); diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 611e926..a3c946c 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1490,10 +1490,13 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts audit_log_proctitle(tsk, context); + audit_log_contid(tsk, context, "task"); + /* Send end of event record to help user space know we are finished */ ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE); if (ab) audit_log_end(ab); + if (call_panic) audit_panic("error converting sid to string"); }

On Wed, Jun 6, 2018 at 1:00 PM Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > Create a new audit record AUDIT_CONTAINER to document the audit > container identifier of a process if it is present. > > Called from audit_log_exit(), syscalls are covered. > > A sample raw event: > type=SYSCALL msg=audit(1519924845.499:257): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=56374e1cef30 a2=241 a3=1b6 items=2 ppid=606 pid=635 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="tmpcontainerid" > type=CWD msg=audit(1519924845.499:257): cwd="/root" > type=PATH msg=audit(1519924845.499:257): item=0 name="/tmp/" inode=13863 dev=00:27 mode=041777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tmp_t:s0 nametype= PARENT cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0 > type=PATH msg=audit(1519924845.499:257): item=1 name="/tmp/tmpcontainerid" inode=17729 dev=00:27 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 nametype=CREATE cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0 > type=PROCTITLE msg=audit(1519924845.499:257): proctitle=62617368002D6300736C65657020313B206563686F2074657374203E202F746D702F746D70636F6E7461696E65726964 > type=CONTAINER msg=audit(1519924845.499:257): op=task contid=123458 > > See: https://github.com/linux-audit/audit-kernel/issues/90 > See: https://github.com/linux-audit/audit-userspace/issues/51 > See: https://github.com/linux-audit/audit-testsuite/issues/64 > See: https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; > --- > include/linux/audit.h | 7 +++++++ > include/uapi/linux/audit.h | 1 + > kernel/audit.c | 23 +++++++++++++++++++++++ > kernel/auditsc.c | 3 +++ > 4 files changed, 34 insertions(+) ... > --- a/include/uapi/linux/audit.h > +++ b/include/uapi/linux/audit.h > @@ -115,6 +115,7 @@ > #define AUDIT_REPLACE 1329 /* Replace auditd if this packet unanswerd */ > #define AUDIT_KERN_MODULE 1330 /* Kernel Module events */ > #define AUDIT_FANOTIFY 1331 /* Fanotify access decision */ > +#define AUDIT_CONTAINER 1332 /* Container ID */ I'm not sure I'm completely sold on the AUDIT_CONTAINER_ID and AUDIT_CONTAINER record type names. From what I can tell AUDIT_CONTAINER_ID seems to be used for audit container ID management operations, e.g. setting the ID, whereas the AUDIT_CONTAINER is used to tag events with the corresponding audit container ID. Assuming that is correct, it seems like AUDIT_CONTAINER might be better served if it was named AUDIT_CONTAINER_ID and if we could change AUDIT_CONTAINER_ID to AUDIT_CONTAINER_OP/MGMT/etc. Thoughts?

> #define AUDIT_AVC 1400 /* SE Linux avc denial or grant */ > #define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */ > diff --git a/kernel/audit.c b/kernel/audit.c > index e7478cb..5e150c6 100644 > --- a/kernel/audit.c > +++ b/kernel/audit.c > @@ -2048,6 +2048,29 @@ void audit_log_session_info(struct audit_buffer *ab) > audit_log_format(ab, " auid=%u ses=%u", auid, sessionid); > } > > +/* > + * audit_log_contid - report container info > + * @tsk: task to be recorded > + * @context: task or local context for record > + * @op: contid string description > + */ > +int audit_log_contid(struct task_struct *tsk, > + struct audit_context *context, char *op) > +{ > + struct audit_buffer *ab; > + > + if (!audit_contid_set(tsk)) > + return 0; > + /* Generate AUDIT_CONTAINER record with container ID */ > + ab = audit_log_start(context, GFP_KERNEL, AUDIT_CONTAINER); > + if (!ab) > + return -ENOMEM; > + audit_log_format(ab, "op=%s contid=%llu", > + op, audit_get_contid(tsk)); Can you explain your reason for including an "op" field in this record type? I've been looking at the rest of the patches in this patchset and it seems to be used more as an indicator of the record's generating context rather than any sort of audit container ID operation.

> + audit_log_end(ab); > + return 0; > +} -- paul moore www.paul-moore.com

On 2018-07-20 18:13, Paul Moore wrote: > On Wed, Jun 6, 2018 at 1:00 PM Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > > Create a new audit record AUDIT_CONTAINER to document the audit > > container identifier of a process if it is present. > > > > Called from audit_log_exit(), syscalls are covered. > > > > A sample raw event: > > type=SYSCALL msg=audit(1519924845.499:257): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=56374e1cef30 a2=241 a3=1b6 items=2 ppid=606 pid=635 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="tmpcontainerid" > > type=CWD msg=audit(1519924845.499:257): cwd="/root" > > type=PATH msg=audit(1519924845.499:257): item=0 name="/tmp/" inode=13863 dev=00:27 mode=041777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tmp_t:s0 nametype= PARENT cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0 > > type=PATH msg=audit(1519924845.499:257): item=1 name="/tmp/tmpcontainerid" inode=17729 dev=00:27 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 nametype=CREATE cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0 > > type=PROCTITLE msg=audit(1519924845.499:257): proctitle=62617368002D6300736C65657020313B206563686F2074657374203E202F746D702F746D70636F6E7461696E65726964 > > type=CONTAINER msg=audit(1519924845.499:257): op=task contid=123458 > > > > See: https://github.com/linux-audit/audit-kernel/issues/90 > > See: https://github.com/linux-audit/audit-userspace/issues/51 > > See: https://github.com/linux-audit/audit-testsuite/issues/64 > > See: https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID > > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; > > --- > > include/linux/audit.h | 7 +++++++ > > include/uapi/linux/audit.h | 1 + > > kernel/audit.c | 23 +++++++++++++++++++++++ > > kernel/auditsc.c | 3 +++ > > 4 files changed, 34 insertions(+) > > ... > > > --- a/include/uapi/linux/audit.h > > +++ b/include/uapi/linux/audit.h > > @@ -115,6 +115,7 @@ > > #define AUDIT_REPLACE 1329 /* Replace auditd if this packet unanswerd */ > > #define AUDIT_KERN_MODULE 1330 /* Kernel Module events */ > > #define AUDIT_FANOTIFY 1331 /* Fanotify access decision */ > > +#define AUDIT_CONTAINER 1332 /* Container ID */ > > I'm not sure I'm completely sold on the AUDIT_CONTAINER_ID and > AUDIT_CONTAINER record type names. From what I can tell > AUDIT_CONTAINER_ID seems to be used for audit container ID management > operations, e.g. setting the ID, whereas the AUDIT_CONTAINER is used > to tag events with the corresponding audit container ID. Assuming > that is correct, it seems like AUDIT_CONTAINER might be better served > if it was named AUDIT_CONTAINER_ID and if we could change > AUDIT_CONTAINER_ID to AUDIT_CONTAINER_OP/MGMT/etc. Thoughts? Please see discussion at: https://www.redhat.com/archives/linux-audit/2018-May/msg00101.html I'm fine with changing AUDIT_CONTAINER_ID to AUDIT_CONTAINER_OP/MGMT/etc.

> > #define AUDIT_AVC 1400 /* SE Linux avc denial or grant */ > > #define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */ > > diff --git a/kernel/audit.c b/kernel/audit.c > > index e7478cb..5e150c6 100644 > > --- a/kernel/audit.c > > +++ b/kernel/audit.c > > @@ -2048,6 +2048,29 @@ void audit_log_session_info(struct audit_buffer *ab) > > audit_log_format(ab, " auid=%u ses=%u", auid, sessionid); > > } > > > > +/* > > + * audit_log_contid - report container info > > + * @tsk: task to be recorded > > + * @context: task or local context for record > > + * @op: contid string description > > + */ > > +int audit_log_contid(struct task_struct *tsk, > > + struct audit_context *context, char *op) > > +{ > > + struct audit_buffer *ab; > > + > > + if (!audit_contid_set(tsk)) > > + return 0; > > + /* Generate AUDIT_CONTAINER record with container ID */ > > + ab = audit_log_start(context, GFP_KERNEL, AUDIT_CONTAINER); > > + if (!ab) > > + return -ENOMEM; > > + audit_log_format(ab, "op=%s contid=%llu", > > + op, audit_get_contid(tsk)); > > Can you explain your reason for including an "op" field in this record > type? I've been looking at the rest of the patches in this patchset > and it seems to be used more as an indicator of the record's > generating context rather than any sort of audit container ID > operation. "action" might work, but that's netfilter and numeric... "kind"? Nothing else really seems to fit from a field name, type or lack of searchability perspective.

Add audit container identifier support to ptrace and signals. In particular, the "op" field provides a way to label the auxiliary record to which it is associated. Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; --- include/linux/audit.h | 11 +++++------ kernel/audit.c | 13 +++++++------ kernel/audit.h | 2 ++ kernel/auditsc.c | 21 ++++++++++++++++----- 4 files changed, 30 insertions(+), 17 deletions(-)

diff --git a/kernel/audit.c b/kernel/audit.c index 5e150c6..ba304a8 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -142,6 +142,7 @@ struct audit_net { kuid_t audit_sig_uid = INVALID_UID; pid_t audit_sig_pid = -1; u32 audit_sig_sid = 0; +u64 audit_sig_cid = AUDIT_CID_UNSET; /* Records can be lost in several ways: 0) [suppressed in audit_alloc] @@ -1437,6 +1438,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) memcpy(sig_data->ctx, ctx, len); security_release_secctx(ctx, len); } + sig_data->cid = audit_sig_cid; audit_send_reply(skb, seq, AUDIT_SIGNAL_INFO, 0, 0, sig_data, sizeof(*sig_data) + len); kfree(sig_data); @@ -2050,23 +2052,22 @@ void audit_log_session_info(struct audit_buffer *ab) /* * audit_log_contid - report container info - * @tsk: task to be recorded * @context: task or local context for record * @op: contid string description + * @contid: container ID to report */ -int audit_log_contid(struct task_struct *tsk, - struct audit_context *context, char *op) +int audit_log_contid(struct audit_context *context, + char *op, u64 contid) { struct audit_buffer *ab; - if (!audit_contid_set(tsk)) + if (!cid_valid(contid)) return 0; /* Generate AUDIT_CONTAINER record with container ID */ ab = audit_log_start(context, GFP_KERNEL, AUDIT_CONTAINER); if (!ab) return -ENOMEM; - audit_log_format(ab, "op=%s contid=%llu", - op, audit_get_contid(tsk)); + audit_log_format(ab, "op=%s contid=%llu", op, contid); audit_log_end(ab); return 0; }

Standalone audit records have the timestamp and serial number generated on the fly and as such are unique, making them standalone. This new function audit_alloc_local() generates a local audit context that will be used only for a standalone record and its auxiliary record(s). The context is discarded immediately after the local associated records are produced. Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; --- include/linux/audit.h | 8 ++++++++ kernel/auditsc.c | 25 +++++++++++++++++++++++-- 2 files changed, 31 insertions(+), 2 deletions(-)

--- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -916,8 +916,11 @@ static inline void audit_free_aux(struct audit_context *context) static inline struct audit_context *audit_alloc_context(enum audit_state state) { struct audit_context *context; + gfp_t gfpflags; - context = kzalloc(sizeof(*context), GFP_KERNEL); + /* We can be called in atomic context via audit_tg() */ + gfpflags = (in_atomic() || irqs_disabled()) ? GFP_ATOMIC : GFP_KERNEL;

+ context = kzalloc(sizeof(*context), gfpflags); if (!context) return NULL; context->state = state; @@ -993,8 +996,26 @@ struct audit_task_info init_struct_audit = { .ctx = NULL, }; -static inline void audit_free_context(struct audit_context *context) +struct audit_context *audit_alloc_local(void) {

+ struct audit_context *context; + + if (!audit_ever_enabled) + return NULL; /* Return if not auditing. */ + + context = audit_alloc_context(AUDIT_RECORD_CONTEXT); + if (!context) + return NULL; + context->serial = audit_serial(); + context->ctime = current_kernel_time64(); + context->in_syscall = 1;

+ return context; +} + +void audit_free_context(struct audit_context *context) +{ + if (!context) + return; audit_free_names(context); unroll_tree_refs(context, NULL, 0); free_tree_refs(context); -- 1.8.3.1 -- Linux-audit mailing list Linux-audit(a)redhat.com https://www.redhat.com/mailman/listinfo/linux-audit

On Wed, Jun 6, 2018 at 1:04 PM Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > Add audit container identifier auxiliary record to tty logging rule > event standalone records. > > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; > --- > drivers/tty/tty_audit.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/drivers/tty/tty_audit.c b/drivers/tty/tty_audit.c > index e30aa6b..66bd850 100644 > --- a/drivers/tty/tty_audit.c > +++ b/drivers/tty/tty_audit.c > @@ -66,8 +66,9 @@ static void tty_audit_log(const char *description, dev_t dev, > uid_t uid = from_kuid(&init_user_ns, task_uid(tsk)); > uid_t loginuid = from_kuid(&init_user_ns, audit_get_loginuid(tsk)); > unsigned int sessionid = audit_get_sessionid(tsk); > + struct audit_context *context = audit_alloc_local(); We should be using current's audit_context in tty_audit_log(). Actually, we should probably just get rid of the tsk variable in tty_audit_log() and use current directly to make things a bit more obvious.

<time passes> I did some digging and I have a two year old, half-baked patch that cleans up this tsk/current usage as well as a few others. I just rebased it against audit/next and surprisingly it seems to pass a basic smoke test (kernel boots and audit-testsuite passes); I'll post it to the list as a RFC once I'm done reviewing these patches.

> - ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_TTY); > + ab = audit_log_start(context, GFP_KERNEL, AUDIT_TTY); > if (ab) { > char name[sizeof(tsk->comm)]; > > @@ -80,6 +81,8 @@ static void tty_audit_log(const char *description, dev_t dev, > audit_log_n_hex(ab, data, size); > audit_log_end(ab); > } > + audit_log_contid(context, "tty", audit_get_contid(tsk)); > + audit_free_context(context); > } -- paul moore www.paul-moore.com

On Wed, Jun 6, 2018 at 1:03 PM Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > Audit events could happen in a network namespace outside of a task > context due to packets received from the net that trigger an auditing > rule prior to being associated with a running task. The network > namespace could in use by multiple containers by association to the > tasks in that network namespace. We still want a way to attribute > these events to any potential containers. Keep a list per network > namespace to track these audit container identifiiers. > > Add/increment the audit container identifier on: > - initial setting of the audit container identifier via /proc > - clone/fork call that inherits an audit container identifier > - unshare call that inherits an audit container identifier > - setns call that inherits an audit container identifier > Delete/decrement the audit container identifier on: > - an inherited audit container identifier dropped when child set > - process exit > - unshare call that drops a net namespace > - setns call that drops a net namespace > > See: https://github.com/linux-audit/audit-kernel/issues/92 > See: https://github.com/linux-audit/audit-testsuite/issues/64 > See: https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; > --- > include/linux/audit.h | 23 ++++++++++++++++ > kernel/audit.c | 72 +++++++++++++++++++++++++++++++++++++++++++++++++++ > kernel/auditsc.c | 5 ++++ > kernel/nsproxy.c | 4 +++ > 4 files changed, 104 insertions(+) ... > diff --git a/include/linux/audit.h b/include/linux/audit.h > index 1e37abf..7e2e51c 100644 > --- a/include/linux/audit.h > +++ b/include/linux/audit.h > @@ -87,6 +88,12 @@ struct audit_field { > u32 op; > }; > > +struct audit_contid { > + struct list_head list; > + u64 id; > + refcount_t refcount; > +}; Do we need to worry about locking the audit container ID list? Does the network namespace code (or some other namespace code) ensure that add/deletes are serialized?

> @@ -156,6 +163,10 @@ extern void audit_log_task_info(struct audit_buffer *ab, > struct task_struct *tsk); > extern int audit_log_contid(struct audit_context *context, > char *op, u64 contid); > +extern struct list_head *audit_get_contid_list(const struct net *net); > +extern void audit_contid_add(struct net *net, u64 contid); > +extern void audit_contid_del(struct net *net, u64 contid); I wonder if we should change these function names to indicate that they are managing the netns/cid list? Right now there is no mention of networking other than the first parameter. Maybe audit_netns_contid_*()?

> +extern void audit_switch_task_namespaces(struct nsproxy *ns, struct task_struct *p); > > extern int audit_update_lsm_rules(void); > > @@ -209,6 +220,18 @@ static inline void audit_log_task_info(struct audit_buffer *ab, > static inline int audit_log_contid(struct audit_context *context, > char *op, u64 contid) > { } > +static inline struct list_head *audit_get_contid_list(const struct net *net) > +{ > + static LIST_HEAD(list); > + return &list; > +} Why can't we just return NULL here like a normal dummy function? It's only ever used inside audit. Actually, why is this even in include/linux/audit.h, couldn't we put it in kernel/audit.h or even just make it a static in audit.c?

> +static inline void audit_contid_add(struct net *net, u64 contid) > +{ } > +static inline void audit_contid_del(struct net *net, u64 contid) > +{ } > +static inline void audit_switch_task_namespaces(struct nsproxy *ns, struct task_struct *p) > +{ } > + > #define audit_enabled 0 > #endif /* CONFIG_AUDIT */ > > diff --git a/kernel/audit.c b/kernel/audit.c > index ba304a8..ecd2de4 100644 > --- a/kernel/audit.c > +++ b/kernel/audit.c > @@ -106,6 +106,7 @@ > */ > struct audit_net { > struct sock *sk; > + struct list_head contid_list; > }; > > /** > @@ -311,6 +312,76 @@ static struct sock *audit_get_sk(const struct net *net) > return aunet->sk; > } > > +/** > + * audit_get_contid_list - Return the audit container ID list for the given network namespace > + * @net: the destination network namespace > + * > + * Description: > + * Returns the list pointer if valid, NULL otherwise. The caller must ensure > + * that a reference is held for the network namespace while the sock is in use. > + */ > +struct list_head *audit_get_contid_list(const struct net *net) > +{ > + struct audit_net *aunet = net_generic(net, audit_net_id); > + > + return &aunet->contid_list; > +} > + > +void audit_contid_add(struct net *net, u64 contid) > +{ > + struct list_head *contid_list = audit_get_contid_list(net); > + struct audit_contid *cont; > + > + if (!cid_valid(contid)) > + return; > + if (!list_empty(contid_list)) > + list_for_each_entry(cont, contid_list, list) > + if (cont->id == contid) { > + refcount_inc(&cont->refcount); > + return; > + } <thinking out loud>I think this is fine for right now, but we may need to be a bit clever about how we store the IDs - walking an unsorted list with lots of entries may prove to be too painful.</thinking out loud>

> + cont = kmalloc(sizeof(struct audit_contid), GFP_KERNEL); > + if (!cont) > + return; > + INIT_LIST_HEAD(&cont->list); > + cont->id = contid; > + refcount_set(&cont->refcount, 1); > + list_add(&cont->list, contid_list); > +} > + > +void audit_contid_del(struct net *net, u64 contid) > +{ > + struct list_head *contid_list = audit_get_contid_list(net); > + struct audit_contid *cont = NULL; > + int found = 0; > + > + if (!cid_valid(contid)) > + return; > + if (!list_empty(contid_list)) > + list_for_each_entry(cont, contid_list, list) > + if (cont->id == contid) { > + found = 1; > + break; You don't really need the found variable, you can just move all of the work you need to do up into the if statement and return from inside the if statement.

> + } > + if (!found) > + return; > + list_del(&cont->list); > + if (refcount_dec_and_test(&cont->refcount)) > + kfree(cont); Don't you want to dec_and_test first and only remove it from the list if there are no other references?

> +} > > +void audit_switch_task_namespaces(struct nsproxy *ns, struct task_struct *p) > +{ > + u64 contid = audit_get_contid(p); > + struct nsproxy *new = p->nsproxy; > + > + if (!cid_valid(contid)) > + return; > + audit_contid_del(ns->net_ns, contid); > + if (new) > + audit_contid_add(new->net_ns, contid); > +} > + > void audit_panic(const char *message) > { > switch (audit_failure) { > @@ -1550,6 +1621,7 @@ static int __net_init audit_net_init(struct net *net) > return -ENOMEM; > } > aunet->sk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT; > + INIT_LIST_HEAD(&aunet->contid_list); > > return 0; > } > diff --git a/kernel/auditsc.c b/kernel/auditsc.c > index ea1ee35..6ab5e5e 100644 > --- a/kernel/auditsc.c > +++ b/kernel/auditsc.c > @@ -75,6 +75,7 @@ > #include <linux/uaccess.h> > #include <linux/fsnotify_backend.h> > #include <uapi/linux/limits.h> > +#include <net/net_namespace.h> > > #include "audit.h" > > @@ -2165,6 +2166,7 @@ int audit_set_contid(struct task_struct *task, u64 contid) > uid_t uid; > struct tty_struct *tty; > char comm[sizeof(current->comm)]; > + struct net *net = task->nsproxy->net_ns; > > /* Can't set if audit disabled */ > if (!task->audit) > @@ -2185,10 +2187,13 @@ int audit_set_contid(struct task_struct *task, u64 contid) > else if (cid_valid(oldcontid) && !task->audit->inherited) > rc = -EEXIST; > if (!rc) { > + if (cid_valid(oldcontid)) > + audit_contid_del(net, oldcontid); > task_lock(task); > task->audit->contid = contid; > task->audit->inherited = false; > task_unlock(task); > + audit_contid_add(net, contid); > } > > if (!audit_enabled) > diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c > index f6c5d33..dcb69fe 100644 > --- a/kernel/nsproxy.c > +++ b/kernel/nsproxy.c > @@ -27,6 +27,7 @@ > #include <linux/syscalls.h> > #include <linux/cgroup.h> > #include <linux/perf_event.h> > +#include <linux/audit.h> > > static struct kmem_cache *nsproxy_cachep; > > @@ -140,6 +141,7 @@ int copy_namespaces(unsigned long flags, struct task_struct *tsk) > struct nsproxy *old_ns = tsk->nsproxy; > struct user_namespace *user_ns = task_cred_xxx(tsk, user_ns); > struct nsproxy *new_ns; > + u64 contid = audit_get_contid(tsk); > > if (likely(!(flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC | > CLONE_NEWPID | CLONE_NEWNET | > @@ -167,6 +169,7 @@ int copy_namespaces(unsigned long flags, struct task_struct *tsk) > return PTR_ERR(new_ns); > > tsk->nsproxy = new_ns; > + audit_contid_add(new_ns->net_ns, contid); > return 0; > } > > @@ -224,6 +227,7 @@ void switch_task_namespaces(struct task_struct *p, struct nsproxy *new) > ns = p->nsproxy; > p->nsproxy = new; > task_unlock(p); > + audit_switch_task_namespaces(ns, p); > > if (ns && atomic_dec_and_test(&ns->count)) > free_nsproxy(ns); > -- > 1.8.3.1 > > -- > Linux-audit mailing list > Linux-audit(a)redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit -- paul moore www.paul-moore.com

Add audit container identifier auxiliary record(s) to NETFILTER_PKT event standalone records. Iterate through all potential audit container identifiers associated with a network namespace. Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; --- include/linux/audit.h | 5 +++++ kernel/audit.c | 20 +++++++++++++++++++- kernel/auditsc.c | 2 ++ net/netfilter/xt_AUDIT.c | 12 ++++++++++-- 4 files changed, 36 insertions(+), 3 deletions(-)

diff --git a/include/linux/audit.h b/include/linux/audit.h index 7e2e51c..4560a4e 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -167,6 +167,8 @@ extern int audit_log_contid(struct audit_context *context, extern void audit_contid_add(struct net *net, u64 contid); extern void audit_contid_del(struct net *net, u64 contid); extern void audit_switch_task_namespaces(struct nsproxy *ns, struct task_struct *p); +extern void audit_log_contid_list(struct net *net, + struct audit_context *context);

extern int audit_update_lsm_rules(void); @@ -231,6 +233,9 @@ static inline void audit_contid_del(struct net *net, u64 contid) { } static inline void audit_switch_task_namespaces(struct nsproxy *ns, struct task_struct *p) { } +static inline void audit_log_contid_list(struct net *net, + struct audit_context *context) +{ } #define audit_enabled 0 #endif /* CONFIG_AUDIT */ diff --git a/kernel/audit.c b/kernel/audit.c index ecd2de4..8cca41a 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -382,6 +382,20 @@ void audit_switch_task_namespaces(struct nsproxy *ns, struct task_struct *p) audit_contid_add(new->net_ns, contid); } +void audit_log_contid_list(struct net *net, struct audit_context *context) +{ + struct audit_contid *cont; + int i = 0; + + list_for_each_entry(cont, audit_get_contid_list(net), list) { + char buf[14]; + + sprintf(buf, "net%u", i++); + audit_log_contid(context, buf, cont->id);

+ } +} +EXPORT_SYMBOL(audit_log_contid_list); + void audit_panic(const char *message) { switch (audit_failure) { @@ -2132,17 +2146,21 @@ int audit_log_contid(struct audit_context *context, char *op, u64 contid) { struct audit_buffer *ab; + gfp_t gfpflags; if (!cid_valid(contid)) return 0; + /* We can be called in atomic context via audit_tg() */ + gfpflags = (in_atomic() || irqs_disabled()) ? GFP_ATOMIC : GFP_KERNEL;

/* Generate AUDIT_CONTAINER record with container ID */ - ab = audit_log_start(context, GFP_KERNEL, AUDIT_CONTAINER); + ab = audit_log_start(context, gfpflags, AUDIT_CONTAINER); if (!ab) return -ENOMEM; audit_log_format(ab, "op=%s contid=%llu", op, contid); audit_log_end(ab); return 0; } +EXPORT_SYMBOL(audit_log_contid);

diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 6ab5e5e..e2a16d2 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1015,6 +1015,7 @@ struct audit_context *audit_alloc_local(void) context->in_syscall = 1; return context; } +EXPORT_SYMBOL(audit_alloc_local);

void audit_free_context(struct audit_context *context) { @@ -1029,6 +1030,7 @@ void audit_free_context(struct audit_context *context) audit_proctitle_free(context); kfree(context); } +EXPORT_SYMBOL(audit_free_context);

static int audit_log_pid_context(struct audit_context *context, pid_t pid, kuid_t auid, kuid_t uid, unsigned int sessionid, diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c index f368ee6..10d2707 100644 --- a/net/netfilter/xt_AUDIT.c +++ b/net/netfilter/xt_AUDIT.c @@ -71,10 +71,13 @@ static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb) { struct audit_buffer *ab; int fam = -1; + struct audit_context *context; + struct net *net; if (audit_enabled == 0) - goto errout; - ab = audit_log_start(NULL, GFP_ATOMIC, AUDIT_NETFILTER_PKT); + goto out; + context = audit_alloc_local(); + ab = audit_log_start(context, GFP_ATOMIC, AUDIT_NETFILTER_PKT); if (ab == NULL) goto errout; @@ -104,7 +107,12 @@ static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb) audit_log_end(ab); + net = xt_net(par); + audit_log_contid_list(net, context); + errout: + audit_free_context(context); +out: return XT_CONTINUE; } -- 1.8.3.1 -- Linux-audit mailing list Linux-audit(a)redhat.com https://www.redhat.com/mailman/listinfo/linux-audit

On Friday, July 20, 2018 6:15:00 PM EDT Paul Moore wrote: > On Wed, Jun 6, 2018 at 1:03 PM Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > > Add audit container identifier auxiliary record(s) to NETFILTER_PKT > > event standalone records. Iterate through all potential audit container > > identifiers associated with a network namespace. > > > > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; > > --- > > include/linux/audit.h | 5 +++++ > > kernel/audit.c | 20 +++++++++++++++++++- > > kernel/auditsc.c | 2 ++ > > net/netfilter/xt_AUDIT.c | 12 ++++++++++-- > > 4 files changed, 36 insertions(+), 3 deletions(-) > > ... > > > diff --git a/include/linux/audit.h b/include/linux/audit.h > > index 7e2e51c..4560a4e 100644 > > --- a/include/linux/audit.h > > +++ b/include/linux/audit.h > > @@ -167,6 +167,8 @@ extern int audit_log_contid(struct audit_context > > *context, extern void audit_contid_add(struct net *net, u64 contid); > > extern void audit_contid_del(struct net *net, u64 contid); > > extern void audit_switch_task_namespaces(struct nsproxy *ns, struct > > task_struct *p); +extern void audit_log_contid_list(struct net *net, > > + struct audit_context *context); > > See my comment in previous patches about changing the function name to > better indicate it's dedicate use for network namespaces. > > > extern int audit_update_lsm_rules(void); > > > > @@ -231,6 +233,9 @@ static inline void audit_contid_del(struct net *net, > > u64 contid) { } > > static inline void audit_switch_task_namespaces(struct nsproxy *ns, > > struct task_struct *p) { } > > +static inline void audit_log_contid_list(struct net *net, > > + struct audit_context *context) > > +{ } > > > > #define audit_enabled 0 > > #endif /* CONFIG_AUDIT */ > > diff --git a/kernel/audit.c b/kernel/audit.c > > index ecd2de4..8cca41a 100644 > > --- a/kernel/audit.c > > +++ b/kernel/audit.c > > @@ -382,6 +382,20 @@ void audit_switch_task_namespaces(struct nsproxy > > *ns, struct task_struct *p) audit_contid_add(new->net_ns, contid); > > } > > > > +void audit_log_contid_list(struct net *net, struct audit_context > > *context) +{ > > + struct audit_contid *cont; > > + int i = 0; > > + > > + list_for_each_entry(cont, audit_get_contid_list(net), list) { > > + char buf[14]; > > + > > + sprintf(buf, "net%u", i++); > > + audit_log_contid(context, buf, cont->id); > > Hmm. It looks like this will generate multiple audit container ID > records with "op=netX contid=Y" (X=netns number, Y=audit container > ID), is that what we want? I've mentioned my concern around the "op" > values in these records earlier in the patchset, that still applies > here, but now I'm also concerned about the multiple records. I'm > thinking we might be better served with a single record with either > multiple "contid" fields, or a single "contid" field with a set of > comma separated values (or some other delimiter that Steve's tools > will tolerate). > > Steve, thoughts? A single record is best. Maybe pattern this after the args listed in an execve record.

Add audit container identifier auxiliary record(s) to NETFILTER_PKT event standalone records. Iterate through all potential audit container identifiers associated with a network namespace. Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; --- include/linux/audit.h | 5 +++++ kernel/audit.c | 20 +++++++++++++++++++- kernel/auditsc.c | 2 ++ net/netfilter/xt_AUDIT.c | 12 ++++++++++-- 4 files changed, 36 insertions(+), 3 deletions(-) diff --git a/include/linux/audit.h b/include/linux/audit.h index 7e2e51c..4560a4e 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -167,6 +167,8 @@ extern int audit_log_contid(struct audit_context *context, extern void audit_contid_add(struct net *net, u64 contid); extern void audit_contid_del(struct net *net, u64 contid); extern void audit_switch_task_namespaces(struct nsproxy *ns, struct task_struct *p); +extern void audit_log_contid_list(struct net *net, + struct audit_context *context); extern int audit_update_lsm_rules(void); @@ -231,6 +233,9 @@ static inline void audit_contid_del(struct net *net, u64 contid) { } static inline void audit_switch_task_namespaces(struct nsproxy *ns, struct task_struct *p) { } +static inline void audit_log_contid_list(struct net *net, + struct audit_context *context) +{ } #define audit_enabled 0 #endif /* CONFIG_AUDIT */ diff --git a/kernel/audit.c b/kernel/audit.c index ecd2de4..8cca41a 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -382,6 +382,20 @@ void audit_switch_task_namespaces(struct nsproxy *ns, struct task_struct *p) audit_contid_add(new->net_ns, contid); } +void audit_log_contid_list(struct net *net, struct audit_context *context) +{ + struct audit_contid *cont; + int i = 0; + + list_for_each_entry(cont, audit_get_contid_list(net), list) { + char buf[14]; + + sprintf(buf, "net%u", i++); + audit_log_contid(context, buf, cont->id); + } +} +EXPORT_SYMBOL(audit_log_contid_list); + void audit_panic(const char *message) { switch (audit_failure) { @@ -2132,17 +2146,21 @@ int audit_log_contid(struct audit_context *context, char *op, u64 contid) { struct audit_buffer *ab; + gfp_t gfpflags; if (!cid_valid(contid)) return 0; + /* We can be called in atomic context via audit_tg() */ + gfpflags = (in_atomic() || irqs_disabled()) ? GFP_ATOMIC : GFP_KERNEL; /* Generate AUDIT_CONTAINER record with container ID */ - ab = audit_log_start(context, GFP_KERNEL, AUDIT_CONTAINER); + ab = audit_log_start(context, gfpflags, AUDIT_CONTAINER); if (!ab) return -ENOMEM; audit_log_format(ab, "op=%s contid=%llu", op, contid); audit_log_end(ab); return 0; } +EXPORT_SYMBOL(audit_log_contid); void audit_log_key(struct audit_buffer *ab, char *key) { diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 6ab5e5e..e2a16d2 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1015,6 +1015,7 @@ struct audit_context *audit_alloc_local(void) context->in_syscall = 1; return context; } +EXPORT_SYMBOL(audit_alloc_local); void audit_free_context(struct audit_context *context) { @@ -1029,6 +1030,7 @@ void audit_free_context(struct audit_context *context) audit_proctitle_free(context); kfree(context); } +EXPORT_SYMBOL(audit_free_context); static int audit_log_pid_context(struct audit_context *context, pid_t pid, kuid_t auid, kuid_t uid, unsigned int sessionid, diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c index f368ee6..10d2707 100644 --- a/net/netfilter/xt_AUDIT.c +++ b/net/netfilter/xt_AUDIT.c @@ -71,10 +71,13 @@ static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb) { struct audit_buffer *ab; int fam = -1; + struct audit_context *context; + struct net *net; if (audit_enabled == 0) - goto errout; - ab = audit_log_start(NULL, GFP_ATOMIC, AUDIT_NETFILTER_PKT); + goto out; + context = audit_alloc_local(); + ab = audit_log_start(context, GFP_ATOMIC, AUDIT_NETFILTER_PKT); if (ab == NULL) goto errout; @@ -104,7 +107,12 @@ static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb) audit_log_end(ab); + net = xt_net(par); + audit_log_contid_list(net, context); + errout: + audit_free_context(context); +out: return XT_CONTINUE; } -- 1.8.3.1

Add support for reading the audit container identifier from the proc filesystem. This is a read from the proc entry of the form /proc/PID/audit_containerid where PID is the process ID of the task whose audit container identifier is sought. The read expects up to a u64 value (unset: 18446744073709551615). Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; --- fs/proc/base.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 318dff4..ca8bfe2 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -1303,6 +1303,21 @@ static ssize_t proc_sessionid_read(struct file * file, char __user * buf, .llseek = generic_file_llseek, }; +static ssize_t proc_contid_read(struct file *file, char __user *buf, + size_t count, loff_t *ppos) +{ + struct inode *inode = file_inode(file); + struct task_struct *task = get_proc_task(inode); + ssize_t length; + char tmpbuf[TMPBUFLEN*2]; + + if (!task) + return -ESRCH; + length = scnprintf(tmpbuf, TMPBUFLEN*2, "%llu", audit_get_contid(task)); + put_task_struct(task); + return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); +}

static ssize_t proc_contid_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos) { @@ -1333,6 +1348,7 @@ static ssize_t proc_contid_write(struct file *file, const char __user *buf, } static const struct file_operations proc_contid_operations = { + .read = proc_contid_read, .write = proc_contid_write, .llseek = generic_file_llseek, }; @@ -3030,7 +3046,7 @@ static int proc_pid_patch_state(struct seq_file *m, struct pid_namespace *ns, #ifdef CONFIG_AUDITSYSCALL REG("loginuid", S_IWUSR|S_IRUGO, proc_loginuid_operations), REG("sessionid", S_IRUGO, proc_sessionid_operations), - REG("audit_containerid", S_IWUSR, proc_contid_operations), + REG("audit_containerid", S_IWUSR|S_IRUSR, proc_contid_operations), #endif #ifdef CONFIG_FAULT_INJECTION REG("make-it-fail", S_IRUGO|S_IWUSR, proc_fault_inject_operations), @@ -3422,7 +3438,7 @@ static int proc_tid_comm_permission(struct inode *inode, int mask) #ifdef CONFIG_AUDITSYSCALL REG("loginuid", S_IWUSR|S_IRUGO, proc_loginuid_operations), REG("sessionid", S_IRUGO, proc_sessionid_operations), - REG("audit_containerid", S_IWUSR, proc_contid_operations), + REG("audit_containerid", S_IWUSR|S_IRUSR, proc_contid_operations), #endif #ifdef CONFIG_FAULT_INJECTION REG("make-it-fail", S_IRUGO|S_IWUSR, proc_fault_inject_operations),