Tracefs or debugfs were causing hundreds to thousands of PATH records to be associated with the init_module and finit_module SYSCALL records on a few modules when the following rule was in place for startup: -a always,exit -F arch=x86_64 -S init_module -F key=mod-load Provide a method to ignore these large number of PATH records from overwhelming the logs if they are not of interest. Introduce a new filter list "AUDIT_FILTER_FS", with a new field type AUDIT_FSTYPE, which keys off the filesystem 4-octet hexadecimal magic identifier to filter specific filesystem PATH records. An example rule would look like: -a never,filesystem -F fstype=0x74726163 -F key=ignore_tracefs -a never,filesystem -F fstype=0x64626720 -F key=ignore_debugfs Arguably the better way to address this issue is to disable tracefs and debugfs on boot from production systems. See: https://github.com/linux-audit/audit-kernel/issues/16 See: https://github.com/linux-audit/audit-userspace/issues/8 Test case: https://github.com/linux-audit/audit-testsuite/issues/42 Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; --- v3: rebase v2: convert AUDIT_FILTER_PATH to AUDIT_FILTER_FS --- include/uapi/linux/audit.h | 8 ++++++-- kernel/auditfilter.c | 39 ++++++++++++++++++++++++++++++++------- kernel/auditsc.c | 23 +++++++++++++++++++++++ 3 files changed, 61 insertions(+), 9 deletions(-)

diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h index 0714a66..be71134 100644 --- a/include/uapi/linux/audit.h +++ b/include/uapi/linux/audit.h @@ -155,8 +155,9 @@ #define AUDIT_FILTER_WATCH 0x03 /* Apply rule to file system watches */ #define AUDIT_FILTER_EXIT 0x04 /* Apply rule at syscall exit */ #define AUDIT_FILTER_TYPE 0x05 /* Apply rule at audit_log_start */ +#define AUDIT_FILTER_FS 0x06 /* Apply rule at __audit_inode_child */ -#define AUDIT_NR_FILTERS 6 +#define AUDIT_NR_FILTERS 7 #define AUDIT_FILTER_PREPEND 0x10 /* Prepend to front of list */ @@ -256,6 +257,7 @@ #define AUDIT_OBJ_LEV_HIGH 23 #define AUDIT_LOGINUID_SET 24 #define AUDIT_SESSIONID 25 /* Session ID */ +#define AUDIT_FSTYPE 26 /* FileSystem Type */ /* These are ONLY useful when checking * at syscall exit time (AUDIT_AT_EXIT). */ @@ -335,13 +337,15 @@ enum { #define AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND 0x00000008 #define AUDIT_FEATURE_BITMAP_SESSIONID_FILTER 0x00000010 #define AUDIT_FEATURE_BITMAP_LOST_RESET 0x00000020 +#define AUDIT_FEATURE_BITMAP_FILTER_FS 0x00000040 #define AUDIT_FEATURE_BITMAP_ALL (AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT | \ AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME | \ AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH | \ AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND | \ AUDIT_FEATURE_BITMAP_SESSIONID_FILTER | \ - AUDIT_FEATURE_BITMAP_LOST_RESET) + AUDIT_FEATURE_BITMAP_LOST_RESET | \ + AUDIT_FEATURE_BITMAP_FILTER_FS) /* deprecated: AUDIT_VERSION_* */ #define AUDIT_VERSION_LATEST AUDIT_FEATURE_BITMAP_ALL diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index 0b0aa58..4a1758a 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -56,7 +56,8 @@ struct list_head audit_filter_list[AUDIT_NR_FILTERS] = { LIST_HEAD_INIT(audit_filter_list[3]), LIST_HEAD_INIT(audit_filter_list[4]), LIST_HEAD_INIT(audit_filter_list[5]), -#if AUDIT_NR_FILTERS != 6 + LIST_HEAD_INIT(audit_filter_list[6]), +#if AUDIT_NR_FILTERS != 7 #error Fix audit_filter_list initialiser #endif }; @@ -67,6 +68,7 @@ struct list_head audit_filter_list[AUDIT_NR_FILTERS] = { LIST_HEAD_INIT(audit_rules_list[3]), LIST_HEAD_INIT(audit_rules_list[4]), LIST_HEAD_INIT(audit_rules_list[5]), + LIST_HEAD_INIT(audit_rules_list[6]), }; DEFINE_MUTEX(audit_filter_mutex); @@ -263,6 +265,7 @@ static int audit_match_signal(struct audit_entry *entry) #endif case AUDIT_FILTER_USER: case AUDIT_FILTER_TYPE: + case AUDIT_FILTER_FS: ; } if (unlikely(rule->action == AUDIT_POSSIBLE)) { @@ -338,6 +341,21 @@ static int audit_field_valid(struct audit_entry *entry, struct audit_field *f) entry->rule.listnr != AUDIT_FILTER_USER) return -EINVAL; break; + case AUDIT_FSTYPE: + if (entry->rule.listnr != AUDIT_FILTER_FS) + return -EINVAL; + break; + } + + switch(entry->rule.listnr) { + case AUDIT_FILTER_FS: + switch(f->type) { + case AUDIT_FSTYPE: + case AUDIT_FILTERKEY: + break; + default: + return -EINVAL; + } } switch(f->type) { @@ -391,6 +409,7 @@ static int audit_field_valid(struct audit_entry *entry, struct audit_field *f) return -EINVAL; /* FALL THROUGH */ case AUDIT_ARCH: + case AUDIT_FSTYPE: if (f->op != Audit_not_equal && f->op != Audit_equal) return -EINVAL; break; @@ -910,10 +929,13 @@ static inline int audit_add_rule(struct audit_entry *entry) #ifdef CONFIG_AUDITSYSCALL int dont_count = 0; - /* If either of these, don't count towards total */ - if (entry->rule.listnr == AUDIT_FILTER_USER || - entry->rule.listnr == AUDIT_FILTER_TYPE) + /* If any of these, don't count towards total */ + switch(entry->rule.listnr) { + case AUDIT_FILTER_USER: + case AUDIT_FILTER_TYPE: + case AUDIT_FILTER_FS: dont_count = 1; + } #endif mutex_lock(&audit_filter_mutex); @@ -989,10 +1011,13 @@ int audit_del_rule(struct audit_entry *entry) #ifdef CONFIG_AUDITSYSCALL int dont_count = 0; - /* If either of these, don't count towards total */ - if (entry->rule.listnr == AUDIT_FILTER_USER || - entry->rule.listnr == AUDIT_FILTER_TYPE) + /* If any of these, don't count towards total */ + switch(entry->rule.listnr) { + case AUDIT_FILTER_USER: + case AUDIT_FILTER_TYPE: + case AUDIT_FILTER_FS: dont_count = 1; + } #endif mutex_lock(&audit_filter_mutex); diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 11848df..ce6cbda 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1871,10 +1871,33 @@ void __audit_inode_child(struct inode *parent, struct inode *inode = d_backing_inode(dentry); const char *dname = dentry->d_name.name; struct audit_names *n, *found_parent = NULL, *found_child = NULL; + struct audit_entry *e; + struct list_head *list = &audit_filter_list[AUDIT_FILTER_FS]; + int i; if (!context->in_syscall) return; + rcu_read_lock(); + if (!list_empty(list)) { + list_for_each_entry_rcu(e, list, list) { + for (i = 0; i < e->rule.field_count; i++) { + struct audit_field *f = &e->rule.fields[i]; + + if (f->type == AUDIT_FSTYPE) { + if (audit_comparator(parent->i_sb->s_magic, + f->op, f->val)) { + if (e->rule.action == AUDIT_NEVER) { + rcu_read_unlock(); + return; + } + } + } + } + } + } + rcu_read_unlock(); + if (inode) handle_one(inode); -- 1.7.1 -- Linux-audit mailing list Linux-audit(a)redhat.com https://www.redhat.com/mailman/listinfo/linux-audit

On Wed, Aug 23, 2017 at 7:03 AM, Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > Tracefs or debugfs were causing hundreds to thousands of PATH records to > be associated with the init_module and finit_module SYSCALL records on a > > few modules when the following rule was in place for startup: > -a always,exit -F arch=x86_64 -S init_module -F key=mod-load > > Provide a method to ignore these large number of PATH records from > overwhelming the logs if they are not of interest. Introduce a new > filter list "AUDIT_FILTER_FS", with a new field type AUDIT_FSTYPE, > which keys off the filesystem 4-octet hexadecimal magic identifier to > filter specific filesystem PATH records. > > An example rule would look like: > -a never,filesystem -F fstype=0x74726163 -F key=ignore_tracefs > -a never,filesystem -F fstype=0x64626720 -F key=ignore_debugfs > > Arguably the better way to address this issue is to disable tracefs and > debugfs on boot from production systems. > > See: https://github.com/linux-audit/audit-kernel/issues/16 > See: https://github.com/linux-audit/audit-userspace/issues/8 > Test case: https://github.com/linux-audit/audit-testsuite/issues/42 > > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; > > --- > v3: rebase > v2: convert AUDIT_FILTER_PATH to AUDIT_FILTER_FS > --- > > include/uapi/linux/audit.h | 8 ++++++-- > kernel/auditfilter.c | 39 ++++++++++++++++++++++++++++++++------- > kernel/auditsc.c | 23 +++++++++++++++++++++++ > 3 files changed, 61 insertions(+), 9 deletions(-) Both this patch and 1/2 look okay, but I'm not going to merge either until after the merge window closes. Steve, I assume you are still happy with the kernel/userspace interface for this?

> diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h > index 0714a66..be71134 100644 > --- a/include/uapi/linux/audit.h > +++ b/include/uapi/linux/audit.h > @@ -155,8 +155,9 @@ > > #define AUDIT_FILTER_WATCH 0x03 /* Apply rule to file system > watches */ #define AUDIT_FILTER_EXIT 0x04 /* Apply rule at > syscall exit */ #define AUDIT_FILTER_TYPE 0x05 /* Apply rule at > audit_log_start */> > +#define AUDIT_FILTER_FS 0x06 /* Apply rule at > __audit_inode_child */ > > -#define AUDIT_NR_FILTERS 6 > +#define AUDIT_NR_FILTERS 7 > > #define AUDIT_FILTER_PREPEND 0x10 /* Prepend to front of list */ > > @@ -256,6 +257,7 @@ > > #define AUDIT_OBJ_LEV_HIGH 23 > #define AUDIT_LOGINUID_SET 24 > #define AUDIT_SESSIONID 25 /* Session ID */ > > +#define AUDIT_FSTYPE 26 /* FileSystem Type */ > > /* These are ONLY useful when checking > > * at syscall exit time (AUDIT_AT_EXIT). > */ > > @@ -335,13 +337,15 @@ enum { > > #define AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND 0x00000008 > #define AUDIT_FEATURE_BITMAP_SESSIONID_FILTER 0x00000010 > #define AUDIT_FEATURE_BITMAP_LOST_RESET 0x00000020 > > +#define AUDIT_FEATURE_BITMAP_FILTER_FS 0x00000040 > > #define AUDIT_FEATURE_BITMAP_ALL (AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT | \ > > AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME | > \ > AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH | \ > AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND | \ > AUDIT_FEATURE_BITMAP_SESSIONID_FILTER | > \ > > - AUDIT_FEATURE_BITMAP_LOST_RESET) > + AUDIT_FEATURE_BITMAP_LOST_RESET | \ > + AUDIT_FEATURE_BITMAP_FILTER_FS) > > /* deprecated: AUDIT_VERSION_* */ > #define AUDIT_VERSION_LATEST AUDIT_FEATURE_BITMAP_ALL > > diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c > index 0b0aa58..4a1758a 100644 > --- a/kernel/auditfilter.c > +++ b/kernel/auditfilter.c > @@ -56,7 +56,8 @@ struct list_head audit_filter_list[AUDIT_NR_FILTERS] = { > > LIST_HEAD_INIT(audit_filter_list[3]), > LIST_HEAD_INIT(audit_filter_list[4]), > LIST_HEAD_INIT(audit_filter_list[5]), > > -#if AUDIT_NR_FILTERS != 6 > + LIST_HEAD_INIT(audit_filter_list[6]), > +#if AUDIT_NR_FILTERS != 7 > > #error Fix audit_filter_list initialiser > #endif > }; > > @@ -67,6 +68,7 @@ struct list_head audit_filter_list[AUDIT_NR_FILTERS] = { > > LIST_HEAD_INIT(audit_rules_list[3]), > LIST_HEAD_INIT(audit_rules_list[4]), > LIST_HEAD_INIT(audit_rules_list[5]), > > + LIST_HEAD_INIT(audit_rules_list[6]), > > }; > > DEFINE_MUTEX(audit_filter_mutex); > > @@ -263,6 +265,7 @@ static int audit_match_signal(struct audit_entry > *entry)> > #endif > > case AUDIT_FILTER_USER: > > case AUDIT_FILTER_TYPE: > + case AUDIT_FILTER_FS: > ; > > } > if (unlikely(rule->action == AUDIT_POSSIBLE)) { > > @@ -338,6 +341,21 @@ static int audit_field_valid(struct audit_entry > *entry, struct audit_field *f)> > entry->rule.listnr != AUDIT_FILTER_USER) > > return -EINVAL; > > break; > > + case AUDIT_FSTYPE: > + if (entry->rule.listnr != AUDIT_FILTER_FS) > + return -EINVAL; > + break; > + } > + > + switch(entry->rule.listnr) { > + case AUDIT_FILTER_FS: > + switch(f->type) { > + case AUDIT_FSTYPE: > + case AUDIT_FILTERKEY: > + break; > + default: > + return -EINVAL; > + } > > } > > switch(f->type) { > > @@ -391,6 +409,7 @@ static int audit_field_valid(struct audit_entry > *entry, struct audit_field *f)> > return -EINVAL; > > /* FALL THROUGH */ > > case AUDIT_ARCH: > + case AUDIT_FSTYPE: > if (f->op != Audit_not_equal && f->op != Audit_equal) > > return -EINVAL; > > break; > > @@ -910,10 +929,13 @@ static inline int audit_add_rule(struct audit_entry > *entry)> > #ifdef CONFIG_AUDITSYSCALL > > int dont_count = 0; > > - /* If either of these, don't count towards total */ > - if (entry->rule.listnr == AUDIT_FILTER_USER || > - entry->rule.listnr == AUDIT_FILTER_TYPE) > + /* If any of these, don't count towards total */ > + switch(entry->rule.listnr) { > + case AUDIT_FILTER_USER: > + case AUDIT_FILTER_TYPE: > > + case AUDIT_FILTER_FS: > dont_count = 1; > > + } > > #endif > > mutex_lock(&audit_filter_mutex); > > @@ -989,10 +1011,13 @@ int audit_del_rule(struct audit_entry *entry) > > #ifdef CONFIG_AUDITSYSCALL > > int dont_count = 0; > > - /* If either of these, don't count towards total */ > - if (entry->rule.listnr == AUDIT_FILTER_USER || > - entry->rule.listnr == AUDIT_FILTER_TYPE) > + /* If any of these, don't count towards total */ > + switch(entry->rule.listnr) { > + case AUDIT_FILTER_USER: > + case AUDIT_FILTER_TYPE: > > + case AUDIT_FILTER_FS: > dont_count = 1; > > + } > > #endif > > mutex_lock(&audit_filter_mutex); > > diff --git a/kernel/auditsc.c b/kernel/auditsc.c > index 11848df..ce6cbda 100644 > --- a/kernel/auditsc.c > +++ b/kernel/auditsc.c > @@ -1871,10 +1871,33 @@ void __audit_inode_child(struct inode *parent, > > struct inode *inode = d_backing_inode(dentry); > const char *dname = dentry->d_name.name; > struct audit_names *n, *found_parent = NULL, *found_child = NULL; > > + struct audit_entry *e; > + struct list_head *list = &audit_filter_list[AUDIT_FILTER_FS]; > + int i; > > if (!context->in_syscall) > > return; > > + rcu_read_lock(); > + if (!list_empty(list)) { > + list_for_each_entry_rcu(e, list, list) { > + for (i = 0; i < e->rule.field_count; i++) { > + struct audit_field *f = > &e->rule.fields[i]; > + > + if (f->type == AUDIT_FSTYPE) { > + if > (audit_comparator(parent->i_sb->s_magic, + > f->op, f->val)) { > + if (e->rule.action == > AUDIT_NEVER) { + > rcu_read_unlock(); + > return; > + } > + } > + } > + } > + } > + } > + rcu_read_unlock(); > + > > if (inode) > > handle_one(inode); > > -- > 1.7.1 > > -- > Linux-audit mailing list > Linux-audit(a)redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit

On Wed, Aug 23, 2017 at 7:03 AM, Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > Tracefs or debugfs were causing hundreds to thousands of PATH records to > be associated with the init_module and finit_module SYSCALL records on a > few modules when the following rule was in place for startup: > -a always,exit -F arch=x86_64 -S init_module -F key=mod-load > > Provide a method to ignore these large number of PATH records from > overwhelming the logs if they are not of interest. Introduce a new > filter list "AUDIT_FILTER_FS", with a new field type AUDIT_FSTYPE, > which keys off the filesystem 4-octet hexadecimal magic identifier to > filter specific filesystem PATH records. > > An example rule would look like: > -a never,filesystem -F fstype=0x74726163 -F key=ignore_tracefs > -a never,filesystem -F fstype=0x64626720 -F key=ignore_debugfs > > Arguably the better way to address this issue is to disable tracefs and > debugfs on boot from production systems. > > See: https://github.com/linux-audit/audit-kernel/issues/16 > See: https://github.com/linux-audit/audit-userspace/issues/8 > Test case: https://github.com/linux-audit/audit-testsuite/issues/42 > > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; > > --- > v3: rebase > v2: convert AUDIT_FILTER_PATH to AUDIT_FILTER_FS > --- > include/uapi/linux/audit.h | 8 ++++++-- > kernel/auditfilter.c | 39 ++++++++++++++++++++++++++++++++------- > kernel/auditsc.c | 23 +++++++++++++++++++++++ > 3 files changed, 61 insertions(+), 9 deletions(-) I'm in the process of applying this patch right now, and I'm seeing a lot of space/tab whitespace damage in this patch. I'll fix it up, but please be more careful in the future.

> diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h > index 0714a66..be71134 100644 > --- a/include/uapi/linux/audit.h > +++ b/include/uapi/linux/audit.h > @@ -155,8 +155,9 @@ > #define AUDIT_FILTER_WATCH 0x03 /* Apply rule to file system watches */ > #define AUDIT_FILTER_EXIT 0x04 /* Apply rule at syscall exit */ > #define AUDIT_FILTER_TYPE 0x05 /* Apply rule at audit_log_start */ > +#define AUDIT_FILTER_FS 0x06 /* Apply rule at __audit_inode_child */ > > -#define AUDIT_NR_FILTERS 6 > +#define AUDIT_NR_FILTERS 7 > > #define AUDIT_FILTER_PREPEND 0x10 /* Prepend to front of list */ > > @@ -256,6 +257,7 @@ > #define AUDIT_OBJ_LEV_HIGH 23 > #define AUDIT_LOGINUID_SET 24 > #define AUDIT_SESSIONID 25 /* Session ID */ > +#define AUDIT_FSTYPE 26 /* FileSystem Type */ > > /* These are ONLY useful when checking > * at syscall exit time (AUDIT_AT_EXIT). */ > @@ -335,13 +337,15 @@ enum { > #define AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND 0x00000008 > #define AUDIT_FEATURE_BITMAP_SESSIONID_FILTER 0x00000010 > #define AUDIT_FEATURE_BITMAP_LOST_RESET 0x00000020 > +#define AUDIT_FEATURE_BITMAP_FILTER_FS 0x00000040 > > #define AUDIT_FEATURE_BITMAP_ALL (AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT | \ > AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME | \ > AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH | \ > AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND | \ > AUDIT_FEATURE_BITMAP_SESSIONID_FILTER | \ > - AUDIT_FEATURE_BITMAP_LOST_RESET) > + AUDIT_FEATURE_BITMAP_LOST_RESET | \ > + AUDIT_FEATURE_BITMAP_FILTER_FS) > > /* deprecated: AUDIT_VERSION_* */ > #define AUDIT_VERSION_LATEST AUDIT_FEATURE_BITMAP_ALL > diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c > index 0b0aa58..4a1758a 100644 > --- a/kernel/auditfilter.c > +++ b/kernel/auditfilter.c > @@ -56,7 +56,8 @@ struct list_head audit_filter_list[AUDIT_NR_FILTERS] = { > LIST_HEAD_INIT(audit_filter_list[3]), > LIST_HEAD_INIT(audit_filter_list[4]), > LIST_HEAD_INIT(audit_filter_list[5]), > -#if AUDIT_NR_FILTERS != 6 > + LIST_HEAD_INIT(audit_filter_list[6]), > +#if AUDIT_NR_FILTERS != 7 > #error Fix audit_filter_list initialiser > #endif > }; > @@ -67,6 +68,7 @@ struct list_head audit_filter_list[AUDIT_NR_FILTERS] = { > LIST_HEAD_INIT(audit_rules_list[3]), > LIST_HEAD_INIT(audit_rules_list[4]), > LIST_HEAD_INIT(audit_rules_list[5]), > + LIST_HEAD_INIT(audit_rules_list[6]), > }; > > DEFINE_MUTEX(audit_filter_mutex); > @@ -263,6 +265,7 @@ static int audit_match_signal(struct audit_entry *entry) > #endif > case AUDIT_FILTER_USER: > case AUDIT_FILTER_TYPE: > + case AUDIT_FILTER_FS: > ; > } > if (unlikely(rule->action == AUDIT_POSSIBLE)) { > @@ -338,6 +341,21 @@ static int audit_field_valid(struct audit_entry *entry, struct audit_field *f) > entry->rule.listnr != AUDIT_FILTER_USER) > return -EINVAL; > break; > + case AUDIT_FSTYPE: > + if (entry->rule.listnr != AUDIT_FILTER_FS) > + return -EINVAL; > + break; > + } > + > + switch(entry->rule.listnr) { > + case AUDIT_FILTER_FS: > + switch(f->type) { > + case AUDIT_FSTYPE: > + case AUDIT_FILTERKEY: > + break; > + default: > + return -EINVAL; > + } > } > > switch(f->type) { > @@ -391,6 +409,7 @@ static int audit_field_valid(struct audit_entry *entry, struct audit_field *f) > return -EINVAL; > /* FALL THROUGH */ > case AUDIT_ARCH: > + case AUDIT_FSTYPE: > if (f->op != Audit_not_equal && f->op != Audit_equal) > return -EINVAL; > break; > @@ -910,10 +929,13 @@ static inline int audit_add_rule(struct audit_entry *entry) > #ifdef CONFIG_AUDITSYSCALL > int dont_count = 0; > > - /* If either of these, don't count towards total */ > - if (entry->rule.listnr == AUDIT_FILTER_USER || > - entry->rule.listnr == AUDIT_FILTER_TYPE) > + /* If any of these, don't count towards total */ > + switch(entry->rule.listnr) { > + case AUDIT_FILTER_USER: > + case AUDIT_FILTER_TYPE: > + case AUDIT_FILTER_FS: > dont_count = 1; > + } > #endif > > mutex_lock(&audit_filter_mutex); > @@ -989,10 +1011,13 @@ int audit_del_rule(struct audit_entry *entry) > #ifdef CONFIG_AUDITSYSCALL > int dont_count = 0; > > - /* If either of these, don't count towards total */ > - if (entry->rule.listnr == AUDIT_FILTER_USER || > - entry->rule.listnr == AUDIT_FILTER_TYPE) > + /* If any of these, don't count towards total */ > + switch(entry->rule.listnr) { > + case AUDIT_FILTER_USER: > + case AUDIT_FILTER_TYPE: > + case AUDIT_FILTER_FS: > dont_count = 1; > + } > #endif > > mutex_lock(&audit_filter_mutex); > diff --git a/kernel/auditsc.c b/kernel/auditsc.c > index 11848df..ce6cbda 100644 > --- a/kernel/auditsc.c > +++ b/kernel/auditsc.c > @@ -1871,10 +1871,33 @@ void __audit_inode_child(struct inode *parent, > struct inode *inode = d_backing_inode(dentry); > const char *dname = dentry->d_name.name; > struct audit_names *n, *found_parent = NULL, *found_child = NULL; > + struct audit_entry *e; > + struct list_head *list = &audit_filter_list[AUDIT_FILTER_FS]; > + int i; > > if (!context->in_syscall) > return; > > + rcu_read_lock(); > + if (!list_empty(list)) { > + list_for_each_entry_rcu(e, list, list) { > + for (i = 0; i < e->rule.field_count; i++) { > + struct audit_field *f = &e->rule.fields[i]; > + > + if (f->type == AUDIT_FSTYPE) { > + if (audit_comparator(parent->i_sb->s_magic, > + f->op, f->val)) { > + if (e->rule.action == AUDIT_NEVER) { > + rcu_read_unlock(); > + return; > + } > + } > + } > + } > + } > + } > + rcu_read_unlock(); > + > if (inode) > handle_one(inode); > > -- > 1.7.1 > > -- > Linux-audit mailing list > Linux-audit(a)redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit -- paul moore www.paul-moore.com

On Wed, Aug 23, 2017 at 7:03 AM, Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > Tracefs or debugfs were causing hundreds to thousands of null PATH > records to be associated with the init_module and finit_module SYSCALL > records on a few modules when the following rule was in place for > startup: > -a always,exit -F arch=x86_64 -S init_module -F key=mod-load > > This happens because the parent inode is not found in the task's > audit_names list and hence treats it as anonymous. This gives us no > information other than a numerical device number that may no longer be > visible upon log inspeciton, and an inode number. > > Fill in the filesystem type, filesystem magic number and full pathname > from the filesystem mount point on previously null PATH records from > entries that have an anonymous parent from the child dentry using > dentry_path_raw(). > > Make the dentry argument of __audit_inode_child() non-const so that we > can take a reference to it in the case of an anonymous parent with > dget() and dget_parent() to be able to later print a partial path from > the host filesystem rather than null. > > Since all we are given is an inode of the parent and the dentry of the > child, finding the path from the mount point to the root of the > filesystem is more challenging that would involve searching all > vfsmounts from "/" until a matching dentry is found for that > filesystem's root dentry. Even if one is found, there may be more than > one mount point. At this point the gain seems marginal since > knowing the filesystem type and path are a significant help in tracking > down the source of the PATH records and being to address them. > > Sample output: > type=PROCTITLE msg=audit(1488317694.446:143): proctitle=2F7362696E2F6D6F6470726F6265002D71002D2D006E66737634 > type=PATH msg=audit(1488317694.446:143): item=797 name=tracefs(74726163):/events/nfs4/nfs4_setclientid/format inode=15969 dev=00:09 mode=0100444 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tracefs_t:s0 nametype=CREATE > type=PATH msg=audit(1488317694.446:143): item=796 name=tracefs(74726163):/events/nfs4/nfs4_setclientid inode=15964 dev=00:09 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tracefs_t:s0 nametype=PARENT > ... > type=PATH msg=audit(1488317694.446:143): item=1 name=tracefs(74726163):/events/nfs4 inode=15571 dev=00:09 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tracefs_t:s0 nametype=CREATE > type=PATH msg=audit(1488317694.446:143): item=0 name=tracefs(74726163):/events inode=119 dev=00:09 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tracefs_t:s0 nametype=PARENT > type=UNKNOWN[1330] msg=audit(1488317694.446:143): name="nfsv4" > type=SYSCALL msg=audit(1488317694.446:143): arch=c000003e syscall=313 success=yes exit=0 a0=1 a1=55d5a35ce106 a2=0 a3=1 items=798 ppid=6 pid=528 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="modprobe" exe="/usr/bin/kmod" subj=system_u:system_r:insmod_t:s0 key="mod-load" > > See: https://github.com/linux-audit/audit-kernel/issues/8 > Test case: https://github.com/linux-audit/audit-testsuite/issues/42 > > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; > > --- > v3: > fix audit_buffer leak and dname error allocation leak audit_log_name > only put audit_name->dentry if it is being replaced > > v2: > minor cosmetic changes and support fs filter patch > --- > include/linux/audit.h | 8 ++++---- > kernel/audit.c | 19 +++++++++++++++++++ > kernel/audit.h | 1 + > kernel/auditsc.c | 8 +++++++- > 4 files changed, 31 insertions(+), 5 deletions(-) ... > diff --git a/kernel/audit.c b/kernel/audit.c > index 59e60e0..d6e6e4e 100644 > --- a/kernel/audit.c > +++ b/kernel/audit.c > @@ -72,6 +72,7 @@ > #include <linux/freezer.h> > #include <linux/pid_namespace.h> > #include <net/netns/generic.h> > +#include <linux/dcache.h> > > #include "audit.h" > > @@ -2047,6 +2048,10 @@ void audit_copy_inode(struct audit_names *name, const struct dentry *dentry, > name->gid = inode->i_gid; > name->rdev = inode->i_rdev; > security_inode_getsecid(inode, &name->osid); > + if (name->dentry) { > + dput(name->dentry); > + name->dentry = NULL; > + } > audit_copy_fcaps(name, dentry); > } > > @@ -2088,6 +2093,20 @@ void audit_log_name(struct audit_context *context, struct audit_names *n, > audit_log_n_untrustedstring(ab, n->name->name, > n->name_len); > } > + } else if (n->dentry) { > + char *fullpath; > + const char *fullpathp = NULL; > + > + fullpath = kmalloc(PATH_MAX, GFP_KERNEL); > + if (fullpath) > + fullpathp = dentry_path_raw(n->dentry, fullpath, PATH_MAX); > + if (IS_ERR(fullpathp)) { > + fullpathp = NULL; > + kfree(fullpath); > + } > + audit_log_format(ab, " name=%s(0x%lx):%s", > + n->dentry->d_sb->s_type->name ?: "?", > + n->dentry->d_sb->s_magic, fullpathp ?: "?"); > } else > audit_log_format(ab, " name=(null)"); While looking this over one more time before merging I realized that you are missing the curly braces in the "if (fullpath)" if-statement above. This is an easy fix, and appears to be the Right Thing, so I'm just going to fix up the patch while merging; take a look at the result in the audit/next tree and if you have any objections let me know so I can back it out.

I'm also only merging this patch right now, patch 2/2 needs to wait until the corresponding userspace is ready so we can test/verify it.

paul moore

On Wed, Aug 23, 2017 at 7:03 AM, Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > Tracefs or debugfs were causing hundreds to thousands of null PATH > records to be associated with the init_module and finit_module SYSCALL > records on a few modules when the following rule was in place for > > startup: > -a always,exit -F arch=x86_64 -S init_module -F key=mod-load > > This happens because the parent inode is not found in the task's > audit_names list and hence treats it as anonymous. This gives us no > information other than a numerical device number that may no longer be > visible upon log inspeciton, and an inode number. > > Fill in the filesystem type, filesystem magic number and full pathname > from the filesystem mount point on previously null PATH records from > entries that have an anonymous parent from the child dentry using > dentry_path_raw().

> Make the dentry argument of __audit_inode_child() non-const so that we > can take a reference to it in the case of an anonymous parent with > dget() and dget_parent() to be able to later print a partial path from > the host filesystem rather than null. > > Since all we are given is an inode of the parent and the dentry of the > child, finding the path from the mount point to the root of the > filesystem is more challenging that would involve searching all > vfsmounts from "/" until a matching dentry is found for that > filesystem's root dentry. Even if one is found, there may be more than > one mount point. At this point the gain seems marginal since > knowing the filesystem type and path are a significant help in tracking > down the source of the PATH records and being to address them. > > Sample output: > type=PROCTITLE msg=audit(1488317694.446:143): > proctitle=2F7362696E2F6D6F6470726F6265002D71002D2D006E66737634 type=PATH > msg=audit(1488317694.446:143): item=797 > name=tracefs(74726163):/events/nfs4/nfs4_setclientid/format inode=15969 > dev=00:09 mode=0100444 ouid=0 ogid=0 rdev=00:00 > obj=system_u:object_r:tracefs_t:s0 nametype=CREATE type=PATH > msg=audit(1488317694.446:143): item=796 > name=tracefs(74726163):/events/nfs4/nfs4_setclientid inode=15964 > dev=00:09 mode=040755 ouid=0 ogid=0 rdev=00:00 > obj=system_u:object_r:tracefs_t:s0 nametype=PARENT ... > type=PATH msg=audit(1488317694.446:143): item=1 > name=tracefs(74726163):/events/nfs4 inode=15571 dev=00:09 mode=040755 > ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tracefs_t:s0 > nametype=CREATE type=PATH msg=audit(1488317694.446:143): item=0 > name=tracefs(74726163):/events inode=119 dev=00:09 mode=040755 ouid=0 > ogid=0 rdev=00:00 obj=system_u:object_r:tracefs_t:s0 nametype=PARENT > type=UNKNOWN[1330] msg=audit(1488317694.446:143): name="nfsv4" > type=SYSCALL msg=audit(1488317694.446:143): arch=c000003e syscall=313 > success=yes exit=0 a0=1 a1=55d5a35ce106 a2=0 a3=1 items=798 ppid=6 > pid=528 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 > fsgid=0 tty=(none) ses=4294967295 comm="modprobe" exe="/usr/bin/kmod" > subj=system_u:system_r:insmod_t:s0 key="mod-load" > > See: https://github.com/linux-audit/audit-kernel/issues/8 > Test case: https://github.com/linux-audit/audit-testsuite/issues/42 > > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; > > --- > > v3: > fix audit_buffer leak and dname error allocation leak audit_log_name > only put audit_name->dentry if it is being replaced > > v2: > minor cosmetic changes and support fs filter patch > > --- > > include/linux/audit.h | 8 ++++---- > kernel/audit.c | 19 +++++++++++++++++++ > kernel/audit.h | 1 + > kernel/auditsc.c | 8 +++++++- > 4 files changed, 31 insertions(+), 5 deletions(-) ... > diff --git a/kernel/audit.c b/kernel/audit.c > index 59e60e0..d6e6e4e 100644 > --- a/kernel/audit.c > +++ b/kernel/audit.c > @@ -72,6 +72,7 @@ > > #include <linux/freezer.h> > #include <linux/pid_namespace.h> > #include <net/netns/generic.h> > > +#include <linux/dcache.h> > > #include "audit.h" > > @@ -2047,6 +2048,10 @@ void audit_copy_inode(struct audit_names *name, > const struct dentry *dentry,> > name->gid = inode->i_gid; > name->rdev = inode->i_rdev; > security_inode_getsecid(inode, &name->osid); > > + if (name->dentry) { > + dput(name->dentry); > + name->dentry = NULL; > + } > > audit_copy_fcaps(name, dentry); > > } > > @@ -2088,6 +2093,20 @@ void audit_log_name(struct audit_context *context, > struct audit_names *n,> > audit_log_n_untrustedstring(ab, n->name->name, > > n->name_len); > > } > > + } else if (n->dentry) { > + char *fullpath; > + const char *fullpathp = NULL; > + > + fullpath = kmalloc(PATH_MAX, GFP_KERNEL); > + if (fullpath) > + fullpathp = dentry_path_raw(n->dentry, fullpath, > PATH_MAX); + if (IS_ERR(fullpathp)) { > + fullpathp = NULL; > + kfree(fullpath); > + } > + audit_log_format(ab, " name=%s(0x%lx):%s", > + n->dentry->d_sb->s_type->name ?: "?", > + n->dentry->d_sb->s_magic, fullpathp ?: > "?");> > } else > > audit_log_format(ab, " name=(null)"); While looking this over one more time before merging I realized that you are missing the curly braces in the "if (fullpath)" if-statement above. This is an easy fix, and appears to be the Right Thing, so I'm just going to fix up the patch while merging; take a look at the result in the audit/next tree and if you have any objections let me know so I can back it out. I'm also only merging this patch right now, patch 2/2 needs to wait until the corresponding userspace is ready so we can test/verify it.