The audit-related parameters in struct task_struct should ideally be collected together and accessed through a standard audit API. Collect the existing loginuid, sessionid and audit_context together in a new struct audit_task_info called "audit" in struct task_struct. Use kmem_cache to manage this pool of memory. Un-inline audit_free() to be able to always recover that memory. See: https://github.com/linux-audit/audit-kernel/issues/81 Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; --- include/linux/audit.h | 34 ++++++++++++++++++++++++---------- include/linux/sched.h | 5 +---- init/init_task.c | 3 +-- init/main.c | 2 ++ kernel/auditsc.c | 51 ++++++++++++++++++++++++++++++++++++++++++--------- kernel/fork.c | 4 +++- 6 files changed, 73 insertions(+), 26 deletions(-)

diff --git a/include/linux/audit.h b/include/linux/audit.h index 9334fbe..8964332 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -219,8 +219,15 @@ static inline void audit_log_task_info(struct audit_buffer *ab, /* These are defined in auditsc.c */ /* Public API */ +struct audit_task_info { + kuid_t loginuid; + unsigned int sessionid; + struct audit_context *ctx; +};

diff --git a/include/linux/sched.h b/include/linux/sched.h index 87bf02d..e117272 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -873,10 +872,8 @@ struct task_struct { struct callback_head *task_works; - struct audit_context *audit_context; #ifdef CONFIG_AUDITSYSCALL - kuid_t loginuid; - unsigned int sessionid; + struct audit_task_info *audit; #endif struct seccomp seccomp;

diff --git a/init/main.c b/init/main.c index 3b4ada1..6aba171 100644 --- a/init/main.c +++ b/init/main.c @@ -92,6 +92,7 @@ #include <linux/rodata_test.h> #include <linux/jump_label.h> #include <linux/mem_encrypt.h> +#include <linux/audit.h> #include <asm/io.h> #include <asm/bugs.h> @@ -721,6 +722,7 @@ asmlinkage __visible void __init start_kernel(void) nsfs_init(); cpuset_init(); cgroup_init(); + audit_task_init(); taskstats_init_early(); delayacct_init();

diff --git a/kernel/auditsc.c b/kernel/auditsc.c index fb20746..88779a7 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -841,7 +841,7 @@ static inline struct audit_context *audit_take_context(struct task_struct *tsk, int return_valid, long return_code) { - struct audit_context *context = tsk->audit_context; + struct audit_context *context = tsk->audit->ctx; if (!context) return NULL; @@ -926,6 +926,15 @@ static inline struct audit_context *audit_alloc_context(enum audit_state state) return context; } +static struct kmem_cache *audit_task_cache; + +void __init audit_task_init(void) +{ + audit_task_cache = kmem_cache_create("audit_task", + sizeof(struct audit_task_info), + 0, SLAB_PANIC, NULL); +}

/** * audit_alloc - allocate an audit context block for a task * @tsk: task @@ -940,17 +949,28 @@ int audit_alloc(struct task_struct *tsk) struct audit_context *context; enum audit_state state; char *key = NULL; + struct audit_task_info *info; + + info = kmem_cache_zalloc(audit_task_cache, GFP_KERNEL); + if (!info) + return -ENOMEM; + info->loginuid = audit_get_loginuid(current); + info->sessionid = audit_get_sessionid(current); + tsk->audit = info; if (likely(!audit_ever_enabled)) return 0; /* Return if not auditing. */

state = audit_filter_task(tsk, &key); if (state == AUDIT_DISABLED) { + audit_set_context(tsk, NULL);

clear_tsk_thread_flag(tsk, TIF_SYSCALL_AUDIT); return 0; } if (!(context = audit_alloc_context(state))) { + tsk->audit = NULL; + kmem_cache_free(audit_task_cache, info); kfree(key); audit_log_lost("out of memory in audit_alloc"); return -ENOMEM; @@ -962,6 +982,12 @@ int audit_alloc(struct task_struct *tsk) return 0; } +struct audit_task_info init_struct_audit = { + .loginuid = INVALID_UID, + .sessionid = AUDIT_SID_UNSET, + .ctx = NULL, +}; + static inline void audit_free_context(struct audit_context *context) { audit_free_names(context);

I'm not sure what's going on here, but it looks like HTML-encoded reply quoting making the quoted text very difficult to read. All the previous ">" have been converted to the HTML "&gt;" encoding. Your most recent reply text looks mostly fine.

On 2019-01-03 15:10, Paul Moore wrote: > On Thu, Nov 1, 2018 at 6:07 PM Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > &gt; On 2018-10-19 19:15, Paul Moore wrote: > &gt; &gt; On Sun, Aug 5, 2018 at 4:32 AM Richard Guy Briggs > <rgb(a)redhat.com&gt; wrote: > &gt; &gt; &gt; The audit-related parameters in struct task_struct > should ideally be > &gt; &gt; &gt; collected together and accessed through a standard audit API. > &gt; &gt; &gt; > &gt; &gt; &gt; Collect the existing loginuid, sessionid and > audit_context together in a > &gt; &gt; &gt; new struct audit_task_info called "audit" in struct task_struct. > &gt; &gt; &gt; > &gt; &gt; &gt; Use kmem_cache to manage this pool of memory. > &gt; &gt; &gt; Un-inline audit_free() to be able to always recover that memory. > &gt; &gt; &gt; > &gt; &gt; &gt; See: https://github.com/linux-audit/audit-kernel/issues/81 > &gt; &gt; &gt; > &gt; &gt; &gt; Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; > &gt; &gt; &gt; --- > &gt; &gt; &gt; include/linux/audit.h | 34 ++++++++++++++++++++++++---------- > &gt; &gt; &gt; include/linux/sched.h | 5 +---- > &gt; &gt; &gt; init/init_task.c | 3 +-- > &gt; &gt; &gt; init/main.c | 2 ++ > &gt; &gt; &gt; kernel/auditsc.c | 51 > ++++++++++++++++++++++++++++++++++++++++++--------- > &gt; &gt; &gt; kernel/fork.c | 4 +++- > &gt; &gt; &gt; 6 files changed, 73 insertions(+), 26 deletions(-) > &gt; &gt; > &gt; &gt; ... > &gt; &gt; > &gt; &gt; &gt; diff --git a/include/linux/sched.h b/include/linux/sched.h > &gt; &gt; &gt; index 87bf02d..e117272 100644 > &gt; &gt; &gt; --- a/include/linux/sched.h > &gt; &gt; &gt; +++ b/include/linux/sched.h > &gt; &gt; &gt; @@ -873,10 +872,8 @@ struct task_struct { > &gt; &gt; &gt; > &gt; &gt; &gt; struct callback_head *task_works; > &gt; &gt; &gt; > &gt; &gt; &gt; - struct audit_context *audit_context; > &gt; &gt; &gt; #ifdef CONFIG_AUDITSYSCALL > &gt; &gt; &gt; - kuid_t loginuid; > &gt; &gt; &gt; - unsigned int sessionid; > &gt; &gt; &gt; + struct audit_task_info *audit; > &gt; &gt; &gt; #endif > &gt; &gt; &gt; struct seccomp seccomp; > &gt; &gt; > &gt; &gt; Prior to this patch audit_context was available regardless of > &gt; &gt; CONFIG_AUDITSYSCALL, after this patch the corresponding audit_context > &gt; &gt; is only available when CONFIG_AUDITSYSCALL is defined. > &gt; > &gt; This was intentional since audit_context is not used when AUDITSYSCALL is > &gt; disabled. audit_alloc() was stubbed in that case to return 0. > audit_context() > &gt; returned NULL. > &gt; > &gt; The fact that audit_context was still present in struct task_struct was an > &gt; oversight in the two patches already accepted: > &gt; ("audit: use inline function to get audit context") > &gt; ("audit: use inline function to get audit context") > &gt; that failed to hide or remove it from struct task_struct when it > was no longer > &gt; relevant. > > Okay, in that case let's pull this out and fix this separately from > the audit container ID patchset. > > &gt; On further digging, loginuid and sessionid (and > audit_log_session_info) should > &gt; be part of CONFIG_AUDIT scope and not CONFIG_AUDITSYSCALL since > it is used in > &gt; CONFIG_CHANGE, ANOM_LINK, FEATURE_CHANGE(, INTEGRITY_RULE), none > of which are > &gt; otherwise dependent on AUDITSYSCALL. > > This looks like something else we should fix independently from this patchset. > > &gt; Looking ahead, contid should be treated like loginuid and > sessionid, which are > &gt; currently only available when syscall auditting is. > > That seems reasonable. Eventually it would be great if we got rid of > CONFIG_AUDITSYSCALL, but that is a separate issue, and something that > is going to require work from the different arch/ABI folks to ensure > everything is working properly. > > &gt; Converting records from standalone to syscall and checking > audit_dummy_context > &gt; changes the nature of CONFIG_AUDIT/!CONFIG_AUDITSYSCALL separation. > &gt; eg: ANOM_LINK accompanied by PATH record (which needed CWD addition to be > &gt; complete anyways) > &gt; > &gt; &gt; &gt; diff --git a/init/main.c b/init/main.c > &gt; &gt; &gt; index 3b4ada1..6aba171 100644 > &gt; &gt; &gt; --- a/init/main.c > &gt; &gt; &gt; +++ b/init/main.c > &gt; &gt; &gt; @@ -92,6 +92,7 @@ > &gt; &gt; &gt; #include <linux rodata_test.h=""> > &gt; &gt; &gt; #include <linux jump_label.h=""> > &gt; &gt; &gt; #include <linux mem_encrypt.h=""> > &gt; &gt; &gt; +#include <linux audit.h=""> > &gt; &gt; &gt; > &gt; &gt; &gt; #include <asm io.h=""> > &gt; &gt; &gt; #include <asm bugs.h=""> > &gt; &gt; &gt; @@ -721,6 +722,7 @@ asmlinkage __visible void __init > start_kernel(void) > &gt; &gt; &gt; nsfs_init(); > &gt; &gt; &gt; cpuset_init(); > &gt; &gt; &gt; cgroup_init(); > &gt; &gt; &gt; + audit_task_init(); > &gt; &gt; &gt; taskstats_init_early(); > &gt; &gt; &gt; delayacct_init(); > &gt; &gt; > &gt; &gt; It seems like we would need either init_struct_audit or > &gt; &gt; audit_task_init(), but not both, yes? > &gt; > &gt; One sets initial values of init task via an included struct, > other makes a call > &gt; to create the kmem cache. Both seem appropriate to me unless we move the > &gt; initialization from a struct to assignments in audit_task_init(), > but I'm not > &gt; that comfortable separating the audit init values from the rest of the > &gt; task_struct init task initializers (though there are other > subsystems that need > &gt; to do so dynamically). > > My original thinking was focused on the use of init_struct_audit as an > initializer when audit_task_init() was already creating a kmem_cache > pool and a zero'd/init'd audit_task_info could be obtained via the > usual kmem_cache functions. Alternatively, although I don't believe > it would be recommended for this case, would be to use > init_struct_audit as an init helper if we included the audit_task_info > struct directly in the task_struct, as opposed to a pointer. What I > missed was the simple fact that you're only using init_struct_audit > for the init_task, which pretty much makes my original question rather > silly :) > > -- > paul moore > www.paul-moore.com - RGB -- Richard Guy Briggs <rgb(a)redhat.com&gt; Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635

On Thu, Nov 1, 2018 at 6:07 PM Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > On 2018-10-19 19:15, Paul Moore wrote: > > On Sun, Aug 5, 2018 at 4:32 AM Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > > > The audit-related parameters in struct task_struct should ideally be > > > collected together and accessed through a standard audit API. > > > > > > Collect the existing loginuid, sessionid and audit_context together in a > > > new struct audit_task_info called "audit" in struct task_struct. > > > > > > Use kmem_cache to manage this pool of memory. > > > Un-inline audit_free() to be able to always recover that memory. > > > > > > See: https://github.com/linux-audit/audit-kernel/issues/81 > > > > > > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; > > > --- > > > include/linux/audit.h | 34 ++++++++++++++++++++++++---------- > > > include/linux/sched.h | 5 +---- > > > init/init_task.c | 3 +-- > > > init/main.c | 2 ++ > > > kernel/auditsc.c | 51 ++++++++++++++++++++++++++++++++++++++++++--------- > > > kernel/fork.c | 4 +++- > > > 6 files changed, 73 insertions(+), 26 deletions(-) > > > > ... > > > > > diff --git a/include/linux/sched.h b/include/linux/sched.h > > > index 87bf02d..e117272 100644 > > > --- a/include/linux/sched.h > > > +++ b/include/linux/sched.h > > > @@ -873,10 +872,8 @@ struct task_struct { > > > > > > struct callback_head *task_works; > > > > > > - struct audit_context *audit_context; > > > #ifdef CONFIG_AUDITSYSCALL > > > - kuid_t loginuid; > > > - unsigned int sessionid; > > > + struct audit_task_info *audit; > > > #endif > > > struct seccomp seccomp; > > > > Prior to this patch audit_context was available regardless of > > CONFIG_AUDITSYSCALL, after this patch the corresponding audit_context > > is only available when CONFIG_AUDITSYSCALL is defined. > > This was intentional since audit_context is not used when AUDITSYSCALL is > disabled. audit_alloc() was stubbed in that case to return 0. audit_context() > returned NULL. > > The fact that audit_context was still present in struct task_struct was an > oversight in the two patches already accepted: > ("audit: use inline function to get audit context") > ("audit: use inline function to get audit context") > that failed to hide or remove it from struct task_struct when it was no longer > relevant. Okay, in that case let's pull this out and fix this separately from the audit container ID patchset.

> On further digging, loginuid and sessionid (and audit_log_session_info) should > be part of CONFIG_AUDIT scope and not CONFIG_AUDITSYSCALL since it is used in > CONFIG_CHANGE, ANOM_LINK, FEATURE_CHANGE(, INTEGRITY_RULE), none of which are > otherwise dependent on AUDITSYSCALL. This looks like something else we should fix independently from this patchset.

> Looking ahead, contid should be treated like loginuid and sessionid, which are > currently only available when syscall auditting is. That seems reasonable. Eventually it would be great if we got rid of CONFIG_AUDITSYSCALL, but that is a separate issue, and something that is going to require work from the different arch/ABI folks to ensure everything is working properly.

> Converting records from standalone to syscall and checking audit_dummy_context > changes the nature of CONFIG_AUDIT/!CONFIG_AUDITSYSCALL separation. > eg: ANOM_LINK accompanied by PATH record (which needed CWD addition to be > complete anyways)

paul moore

Hi Richard, On Tue, Jul 31, 2018 at 04:07:36PM -0400, Richard Guy Briggs wrote: > The audit-related parameters in struct task_struct should ideally be > collected together and accessed through a standard audit API. > > Collect the existing loginuid, sessionid and audit_context together in a > new struct audit_task_info called "audit" in struct task_struct. > > Use kmem_cache to manage this pool of memory. > Un-inline audit_free() to be able to always recover that memory. > > See: https://github.com/linux-audit/audit-kernel/issues/81 > > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; Overall I am not sure if keeping task_struct a bit smaller is worth the added complexity, but I guess that is just me.

Anyway, couple of nitpicks. Please feel free to ignore, and my apologies if some of all of the comments are duplicates.

Guenter > --- > include/linux/audit.h | 34 ++++++++++++++++++++++++---------- > include/linux/sched.h | 5 +---- > init/init_task.c | 3 +-- > init/main.c | 2 ++ > kernel/auditsc.c | 51 ++++++++++++++++++++++++++++++++++++++++++--------- > kernel/fork.c | 4 +++- > 6 files changed, 73 insertions(+), 26 deletions(-) > > diff --git a/include/linux/audit.h b/include/linux/audit.h > index 9334fbe..8964332 100644 > --- a/include/linux/audit.h > +++ b/include/linux/audit.h > @@ -219,8 +219,15 @@ static inline void audit_log_task_info(struct audit_buffer *ab, > > /* These are defined in auditsc.c */ > /* Public API */ Not sure if the structure below belongs after "Public API". Is it part of the public API ? > +struct audit_task_info { > + kuid_t loginuid; > + unsigned int sessionid; > + struct audit_context *ctx; > +}; Add empty line ? > +extern struct audit_task_info init_struct_audit; > +extern void __init audit_task_init(void); > extern int audit_alloc(struct task_struct *task); > -extern void __audit_free(struct task_struct *task); > +extern void audit_free(struct task_struct *task); > extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1, > unsigned long a2, unsigned long a3); > extern void __audit_syscall_exit(int ret_success, long ret_value); > @@ -242,12 +249,15 @@ extern void audit_seccomp_actions_logged(const char *names, > > static inline void audit_set_context(struct task_struct *task, struct audit_context *ctx) > { > - task->audit_context = ctx; > + task->audit->ctx = ctx; > } > > static inline struct audit_context *audit_context(void) > { > - return current->audit_context; > + if (current->audit) > + return current->audit->ctx; > + else > + return NULL; Unnecessary else (and static checkers may complain). > } > > static inline bool audit_dummy_context(void) > @@ -255,11 +265,7 @@ static inline bool audit_dummy_context(void) > void *p = audit_context(); > return !p || *(int *)p; > } > -static inline void audit_free(struct task_struct *task) > -{ > - if (unlikely(task->audit_context)) > - __audit_free(task); > -} > + > static inline void audit_syscall_entry(int major, unsigned long a0, > unsigned long a1, unsigned long a2, > unsigned long a3) > @@ -331,12 +337,18 @@ extern int auditsc_get_stamp(struct audit_context *ctx, > > static inline kuid_t audit_get_loginuid(struct task_struct *tsk) > { > - return tsk->loginuid; > + if (tsk->audit) > + return tsk->audit->loginuid; > + else > + return INVALID_UID; Unnecessary else. > } > > static inline unsigned int audit_get_sessionid(struct task_struct *tsk) > { > - return tsk->sessionid; > + if (tsk->audit) > + return tsk->audit->sessionid; > + else > + return AUDIT_SID_UNSET; Unnecessary else. > } > > extern void __audit_ipc_obj(struct kern_ipc_perm *ipcp); > @@ -461,6 +473,8 @@ static inline void audit_fanotify(unsigned int response) > extern int audit_n_rules; > extern int audit_signals; > #else /* CONFIG_AUDITSYSCALL */ > +static inline void __init audit_task_init(void) > +{ } > static inline int audit_alloc(struct task_struct *task) > { > return 0; > diff --git a/include/linux/sched.h b/include/linux/sched.h > index 87bf02d..e117272 100644 > --- a/include/linux/sched.h > +++ b/include/linux/sched.h > @@ -30,7 +30,6 @@ > #include <linux/rseq.h> > > /* task_struct member predeclarations (sorted alphabetically): */ > -struct audit_context; > struct backing_dev_info; > struct bio_list; > struct blk_plug; > @@ -873,10 +872,8 @@ struct task_struct { > > struct callback_head *task_works; > > - struct audit_context *audit_context; > #ifdef CONFIG_AUDITSYSCALL > - kuid_t loginuid; > - unsigned int sessionid; > + struct audit_task_info *audit; > #endif > struct seccomp seccomp; > > diff --git a/init/init_task.c b/init/init_task.c > index 74f60ba..4058840 100644 > --- a/init/init_task.c > +++ b/init/init_task.c > @@ -119,8 +119,7 @@ struct task_struct init_task > .thread_group = LIST_HEAD_INIT(init_task.thread_group), > .thread_node = LIST_HEAD_INIT(init_signals.thread_head), > #ifdef CONFIG_AUDITSYSCALL > - .loginuid = INVALID_UID, > - .sessionid = AUDIT_SID_UNSET, > + .audit = &init_struct_audit, > #endif > #ifdef CONFIG_PERF_EVENTS > .perf_event_mutex = __MUTEX_INITIALIZER(init_task.perf_event_mutex), > diff --git a/init/main.c b/init/main.c > index 3b4ada1..6aba171 100644 > --- a/init/main.c > +++ b/init/main.c > @@ -92,6 +92,7 @@ > #include <linux/rodata_test.h> > #include <linux/jump_label.h> > #include <linux/mem_encrypt.h> > +#include <linux/audit.h> > > #include <asm/io.h> > #include <asm/bugs.h> > @@ -721,6 +722,7 @@ asmlinkage __visible void __init start_kernel(void) > nsfs_init(); > cpuset_init(); > cgroup_init(); > + audit_task_init(); > taskstats_init_early(); > delayacct_init(); > > diff --git a/kernel/auditsc.c b/kernel/auditsc.c > index fb20746..88779a7 100644 > --- a/kernel/auditsc.c > +++ b/kernel/auditsc.c > @@ -841,7 +841,7 @@ static inline struct audit_context *audit_take_context(struct task_struct *tsk, > int return_valid, > long return_code) > { > - struct audit_context *context = tsk->audit_context; > + struct audit_context *context = tsk->audit->ctx; > > if (!context) > return NULL; > @@ -926,6 +926,15 @@ static inline struct audit_context *audit_alloc_context(enum audit_state state) > return context; > } > > +static struct kmem_cache *audit_task_cache; > + > +void __init audit_task_init(void) > +{ > + audit_task_cache = kmem_cache_create("audit_task", > + sizeof(struct audit_task_info), > + 0, SLAB_PANIC, NULL); > +} > + > /** > * audit_alloc - allocate an audit context block for a task > * @tsk: task > @@ -940,17 +949,28 @@ int audit_alloc(struct task_struct *tsk) > struct audit_context *context; > enum audit_state state; > char *key = NULL; > + struct audit_task_info *info; > + > + info = kmem_cache_zalloc(audit_task_cache, GFP_KERNEL); > + if (!info) > + return -ENOMEM; > + info->loginuid = audit_get_loginuid(current); > + info->sessionid = audit_get_sessionid(current); > + tsk->audit = info; > > if (likely(!audit_ever_enabled)) > return 0; /* Return if not auditing. */ > > state = audit_filter_task(tsk, &key); > if (state == AUDIT_DISABLED) { > + audit_set_context(tsk, NULL); > clear_tsk_thread_flag(tsk, TIF_SYSCALL_AUDIT); > return 0; > } > > if (!(context = audit_alloc_context(state))) { > + tsk->audit = NULL; > + kmem_cache_free(audit_task_cache, info); > kfree(key); > audit_log_lost("out of memory in audit_alloc"); > return -ENOMEM; > @@ -962,6 +982,12 @@ int audit_alloc(struct task_struct *tsk) > return 0; > } > > +struct audit_task_info init_struct_audit = { > + .loginuid = INVALID_UID, > + .sessionid = AUDIT_SID_UNSET, > + .ctx = NULL, > +}; > + > static inline void audit_free_context(struct audit_context *context) > { > audit_free_names(context); > @@ -1469,26 +1495,33 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts > } > > /** > - * __audit_free - free a per-task audit context > + * audit_free - free a per-task audit context > * @tsk: task whose audit context block to free > * > * Called from copy_process and do_exit > */ > -void __audit_free(struct task_struct *tsk) > +void audit_free(struct task_struct *tsk) > { > struct audit_context *context; > + struct audit_task_info *info; > > context = audit_take_context(tsk, 0, 0); > - if (!context) > - return; > - > /* Check for system calls that do not go through the exit > * function (e.g., exit_group), then free context block. > * We use GFP_ATOMIC here because we might be doing this > * in the context of the idle thread */ > /* that can happen only if we are called from do_exit() */ > - if (context->in_syscall && context->current_state == AUDIT_RECORD_CONTEXT) > + if (context && context->in_syscall && > + context->current_state == AUDIT_RECORD_CONTEXT) > audit_log_exit(context, tsk); > + /* Freeing the audit_task_info struct must be performed after > + * audit_log_exit() due to need for loginuid and sessionid. > + */ > + info = tsk->audit; > + tsk->audit = NULL; > + kmem_cache_free(audit_task_cache, info); > + if (!context) > + return; > if (!list_empty(&context->killed_trees)) > audit_kill_trees(&context->killed_trees); Looks kind of terrible with the repeated check if context is NULL. Maybe reorder ? context = audit_take_context(tsk, 0, 0); if (context) { /* do all the context work */ } kmem_cache_free(audit_task_cache, tsk->audit); tsk->audit = NULL; // is that even necessary ? If "info" is really needed, ie if tsk (and tsk->audit) can be accessed from another thread in parallel, I'd be a bit concerned about the lack of sync() or similar after clearing tsk->audit. Another option might have been to separate audit_free() into audit_free_context() and audit_free_info(). > > @@ -2071,8 +2104,8 @@ int audit_set_loginuid(kuid_t loginuid) > sessionid = (unsigned int)atomic_inc_return(&session_id); > } > > - task->sessionid = sessionid; > - task->loginuid = loginuid; > + task->audit->sessionid = sessionid; > + task->audit->loginuid = loginuid; > out: > audit_log_set_loginuid(oldloginuid, loginuid, oldsessionid, sessionid, rc); > return rc; > diff --git a/kernel/fork.c b/kernel/fork.c > index 9440d61..1bfb0ff 100644 > --- a/kernel/fork.c > +++ b/kernel/fork.c > @@ -1721,7 +1721,9 @@ static __latent_entropy struct task_struct *copy_process( > p->start_time = ktime_get_ns(); > p->real_start_time = ktime_get_boot_ns(); > p->io_context = NULL; > - audit_set_context(p, NULL); > +#ifdef CONFIG_AUDITSYSCALL > + p->audit = NULL; > +#endif /* CONFIG_AUDITSYSCALL */ audit_alloc() is called a bit later and sets p->audit, so I don't think this is really necessary. > cgroup_fork(p); > #ifdef CONFIG_NUMA > p->mempolicy = mpol_dup(p->mempolicy);

Implement the proc fs write to set the audit container identifier of a process, emitting an AUDIT_CONTAINER_OP record to document the event. This is a write from the container orchestrator task to a proc entry of the form /proc/PID/audit_containerid where PID is the process ID of the newly created task that is to become the first task in a container, or an additional task added to a container. The write expects up to a u64 value (unset: 18446744073709551615). The writer must have capability CAP_AUDIT_CONTROL. This will produce a record such as this: type=CONTAINER_ID msg=audit(2018-06-06 12:39:29.636:26949) : op=set opid=2209 old-contid=18446744073709551615 contid=123456 pid=628 auid=root uid=root tty=ttyS0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 comm=bash exe=/usr/bin/bash res=yes

The "op" field indicates an initial set. The "pid" to "ses" fields are the orchestrator while the "opid" field is the object's PID, the process being "contained". Old and new audit container identifier values are given in the "contid" fields, while res indicates its success.

It is not permitted to unset the audit container identifier. A child inherits its parent's audit container identifier. See: https://github.com/linux-audit/audit-kernel/issues/90 See: https://github.com/linux-audit/audit-userspace/issues/51 See: https://github.com/linux-audit/audit-testsuite/issues/64 See: https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; Acked-by: Serge Hallyn <serge(a)hallyn.com&gt; Acked-by: Steve Grubb <sgrubb(a)redhat.com&gt; --- fs/proc/base.c | 37 +++++++++++++++++++++++++ include/linux/audit.h | 24 ++++++++++++++++ include/uapi/linux/audit.h | 2 ++ kernel/auditsc.c | 68 ++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 131 insertions(+)

@@ -2112,6 +2114,72 @@ int audit_set_loginuid(kuid_t loginuid) } /** + * audit_set_contid - set current task's audit_context contid + * @contid: contid value + * + * Returns 0 on success, -EPERM on permission failure. + * + * Called (set) from fs/proc/base.c::proc_contid_write(). + */ +int audit_set_contid(struct task_struct *task, u64 contid) +{ + u64 oldcontid; + int rc = 0; + struct audit_buffer *ab; + uid_t uid; + struct tty_struct *tty; + char comm[sizeof(current->comm)]; + + task_lock(task); + /* Can't set if audit disabled */ + if (!task->audit) { + task_unlock(task); + return -ENOPROTOOPT; + } + oldcontid = audit_get_contid(task); + read_lock(&tasklist_lock);

+ /* Don't allow the audit containerid to be unset */ + if (!audit_contid_valid(contid)) + rc = -EINVAL; + /* if we don't have caps, reject */ + else if (!capable(CAP_AUDIT_CONTROL)) + rc = -EPERM; + /* if task has children or is not single-threaded, deny */ + else if (!list_empty(&task->children)) + rc = -EBUSY; + else if (!(thread_group_leader(task) && thread_group_empty(task))) + rc = -EALREADY; + read_unlock(&tasklist_lock); + if (!rc) + task->audit->contid = contid; + task_unlock(task); + + if (!audit_enabled) + return rc; + + ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONTAINER_OP); + if (!ab) + return rc; + + uid = from_kuid(&init_user_ns, task_uid(current)); + tty = audit_get_tty(current); + audit_log_format(ab, "op=set opid=%d old-contid=%llu contid=%llu pid=%d uid=%u auid=%u tty=%s ses=%u", + task_tgid_nr(task), oldcontid, contid, + task_tgid_nr(current), uid, + from_kuid(&init_user_ns, audit_get_loginuid(current)), + tty ? tty_name(tty) : "(none)", + audit_get_sessionid(current)); + audit_put_tty(tty); + audit_log_task_context(ab); + audit_log_format(ab, " comm="); + audit_log_untrustedstring(ab, get_task_comm(comm, current)); + audit_log_d_path_exe(ab, current->mm); + audit_log_format(ab, " res=%d", !rc); + audit_log_end(ab); + return rc; +}

On Tue, Jul 31, 2018 at 4:11 PM Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > > Implement the proc fs write to set the audit container identifier of a > process, emitting an AUDIT_CONTAINER_OP record to document the event. > > This is a write from the container orchestrator task to a proc entry of > the form /proc/PID/audit_containerid where PID is the process ID of the > newly created task that is to become the first task in a container, or > an additional task added to a container. > > The write expects up to a u64 value (unset: 18446744073709551615). > > The writer must have capability CAP_AUDIT_CONTROL. > > This will produce a record such as this: > type=CONTAINER_ID msg=audit(2018-06-06 12:39:29.636:26949) : op=set opid=2209 old-contid=18446744073709551615 contid=123456 pid=628 auid=root uid=root tty=ttyS0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 comm=bash exe=/usr/bin/bash res=yes You need to update the record type in the example above.

> The "op" field indicates an initial set. The "pid" to "ses" fields are > the orchestrator while the "opid" field is the object's PID, the process > being "contained". Old and new audit container identifier values are > given in the "contid" fields, while res indicates its success. I understand Steve's concern around the "op" field, but I think it might be a bit premature to think we might not need to do some sort of audit container ID management in the future that would want to make use of the CONTAINER_OP message type. I would like to see the "op" field preserved.

> It is not permitted to unset the audit container identifier. > A child inherits its parent's audit container identifier. > > See: https://github.com/linux-audit/audit-kernel/issues/90 > See: https://github.com/linux-audit/audit-userspace/issues/51 > See: https://github.com/linux-audit/audit-testsuite/issues/64 > See: https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID > > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; > Acked-by: Serge Hallyn <serge(a)hallyn.com&gt; > Acked-by: Steve Grubb <sgrubb(a)redhat.com&gt; > --- > fs/proc/base.c | 37 +++++++++++++++++++++++++ > include/linux/audit.h | 24 ++++++++++++++++ > include/uapi/linux/audit.h | 2 ++ > kernel/auditsc.c | 68 ++++++++++++++++++++++++++++++++++++++++++++++ > 4 files changed, 131 insertions(+) ... > @@ -2112,6 +2114,72 @@ int audit_set_loginuid(kuid_t loginuid) > } > > /** > + * audit_set_contid - set current task's audit_context contid > + * @contid: contid value > + * > + * Returns 0 on success, -EPERM on permission failure. > + * > + * Called (set) from fs/proc/base.c::proc_contid_write(). > + */ > +int audit_set_contid(struct task_struct *task, u64 contid) > +{ > + u64 oldcontid; > + int rc = 0; > + struct audit_buffer *ab; > + uid_t uid; > + struct tty_struct *tty; > + char comm[sizeof(current->comm)]; > + > + task_lock(task); > + /* Can't set if audit disabled */ > + if (!task->audit) { > + task_unlock(task); > + return -ENOPROTOOPT; > + } > + oldcontid = audit_get_contid(task); > + read_lock(&tasklist_lock); I assume lockdep was happy with nesting the tasklist_lock inside the task lock?

> + /* Don't allow the audit containerid to be unset */ > + if (!audit_contid_valid(contid)) > + rc = -EINVAL; > + /* if we don't have caps, reject */ > + else if (!capable(CAP_AUDIT_CONTROL)) > + rc = -EPERM; > + /* if task has children or is not single-threaded, deny */ > + else if (!list_empty(&task->children)) > + rc = -EBUSY; > + else if (!(thread_group_leader(task) && thread_group_empty(task))) > + rc = -EALREADY; > + read_unlock(&tasklist_lock); > + if (!rc) > + task->audit->contid = contid; > + task_unlock(task); > + > + if (!audit_enabled) > + return rc; > + > + ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONTAINER_OP); > + if (!ab) > + return rc; > + > + uid = from_kuid(&init_user_ns, task_uid(current)); > + tty = audit_get_tty(current); > + audit_log_format(ab, "op=set opid=%d old-contid=%llu contid=%llu pid=%d uid=%u auid=%u tty=%s ses=%u", > + task_tgid_nr(task), oldcontid, contid, > + task_tgid_nr(current), uid, > + from_kuid(&init_user_ns, audit_get_loginuid(current)), > + tty ? tty_name(tty) : "(none)", > + audit_get_sessionid(current)); > + audit_put_tty(tty); > + audit_log_task_context(ab); > + audit_log_format(ab, " comm="); > + audit_log_untrustedstring(ab, get_task_comm(comm, current)); > + audit_log_d_path_exe(ab, current->mm); > + audit_log_format(ab, " res=%d", !rc); > + audit_log_end(ab); > + return rc; > +} -- paul moore www.paul-moore.com

Create a new audit record AUDIT_CONTAINER to document the audit container identifier of a process if it is present. Called from audit_log_exit(), syscalls are covered. A sample raw event: type=SYSCALL msg=audit(1519924845.499:257): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=56374e1cef30 a2=241 a3=1b6 items=2 ppid=606 pid=635 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="tmpcontainerid" type=CWD msg=audit(1519924845.499:257): cwd="/root" type=PATH msg=audit(1519924845.499:257): item=0 name="/tmp/" inode=13863 dev=00:27 mode=041777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tmp_t:s0 nametype= PARENT cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0 type=PATH msg=audit(1519924845.499:257): item=1 name="/tmp/tmpcontainerid" inode=17729 dev=00:27 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 nametype=CREATE cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0 type=PROCTITLE msg=audit(1519924845.499:257): proctitle=62617368002D6300736C65657020313B206563686F2074657374203E202F746D 702F746D70636F6E7461696E65726964 type=CONTAINER msg=audit(1519924845.499:257): op=task contid=123458

See: https://github.com/linux-audit/audit-kernel/issues/90 See: https://github.com/linux-audit/audit-userspace/issues/51 See: https://github.com/linux-audit/audit-testsuite/issues/64 See: https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; Acked-by: Serge Hallyn <serge(a)hallyn.com&gt; Acked-by: Steve Grubb <sgrubb(a)redhat.com&gt; --- include/linux/audit.h | 7 +++++++ include/uapi/linux/audit.h | 1 + kernel/audit.c | 24 ++++++++++++++++++++++++ kernel/auditsc.c | 3 +++ 4 files changed, 35 insertions(+) diff --git a/include/linux/audit.h b/include/linux/audit.h index 71a6fc6..d5a48dc 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -155,6 +155,9 @@ extern void audit_log_key(struct audit_buffer

extern int audit_log_task_context(struct audit_buffer *ab); extern void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk); +extern int audit_log_contid(struct task_struct *tsk, + struct audit_context *context, + char *op); extern int audit_update_lsm_rules(void); @@ -205,6 +208,10 @@ static inline int audit_log_task_context(struct audit_buffer *ab) static inline void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk) { } +static inline int audit_log_contid(struct task_struct *tsk, + struct audit_context *context, + char *op) +{ } #define audit_enabled AUDIT_OFF #endif /* CONFIG_AUDIT */ diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h index 3474f57..dc259c7 100644 --- a/include/uapi/linux/audit.h +++ b/include/uapi/linux/audit.h @@ -115,6 +115,7 @@ #define AUDIT_REPLACE 1329 /* Replace auditd if this packet unanswerd

#define AUDIT_KERN_MODULE 1330 /* Kernel Module events */ #define AUDIT_FANOTIFY 1331 /* Fanotify access decision */ +#define AUDIT_CONTAINER 1332 /* Container ID */ #define AUDIT_AVC 1400 /* SE Linux avc denial or grant */ #define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */ diff --git a/kernel/audit.c b/kernel/audit.c index 2a80587..15f54c7 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -2045,6 +2045,30 @@ void audit_log_session_info(struct audit_buffer *ab) audit_log_format(ab, " auid=%u ses=%u", auid, sessionid); } +/* + * audit_log_contid - report container info + * @tsk: task to be recorded + * @context: task or local context for record + * @op: contid string description + */ +int audit_log_contid(struct task_struct *tsk, + struct audit_context *context, char *op) +{ + struct audit_buffer *ab; + + if (!audit_contid_set(tsk)) + return 0; + /* Generate AUDIT_CONTAINER record with container ID */ + ab = audit_log_start(context, GFP_KERNEL, AUDIT_CONTAINER); + if (!ab) + return -ENOMEM; + audit_log_format(ab, "op=%s contid=%llu", + op, audit_get_contid(tsk)); + audit_log_end(ab); + return 0; +} +EXPORT_SYMBOL(audit_log_contid); + void audit_log_key(struct audit_buffer *ab, char *key) { audit_log_format(ab, " key="); diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 6125cef..39e5633 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1488,10 +1488,13 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts audit_log_proctitle(tsk, context); + audit_log_contid(tsk, context, "task"); + /* Send end of event record to help user space know we are finished */ ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE); if (ab) audit_log_end(ab); + if (call_panic) audit_panic("error converting sid to string"); }

On Sun, Aug 5, 2018 at 4:32 AM Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > Create a new audit record AUDIT_CONTAINER to document the audit > container identifier of a process if it is present. > > Called from audit_log_exit(), syscalls are covered. > > A sample raw event: > type=SYSCALL msg=audit(1519924845.499:257): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=56374e1cef30 a2=241 a3=1b6 items=2 ppid=606 pid=635 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="tmpcontainerid" > type=CWD msg=audit(1519924845.499:257): cwd="/root" > type=PATH msg=audit(1519924845.499:257): item=0 name="/tmp/" inode=13863 dev=00:27 mode=041777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tmp_t:s0 nametype= PARENT cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0 > type=PATH msg=audit(1519924845.499:257): item=1 name="/tmp/tmpcontainerid" inode=17729 dev=00:27 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 nametype=CREATE cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0 > type=PROCTITLE msg=audit(1519924845.499:257): proctitle=62617368002D6300736C65657020313B206563686F2074657374203E202F746D702F746D70636F6E7461696E65726964 > type=CONTAINER msg=audit(1519924845.499:257): op=task contid=123458 > > See: https://github.com/linux-audit/audit-kernel/issues/90 > See: https://github.com/linux-audit/audit-userspace/issues/51 > See: https://github.com/linux-audit/audit-testsuite/issues/64 > See: https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; > Acked-by: Serge Hallyn <serge(a)hallyn.com&gt; > Acked-by: Steve Grubb <sgrubb(a)redhat.com&gt; > --- > include/linux/audit.h | 7 +++++++ > include/uapi/linux/audit.h | 1 + > kernel/audit.c | 24 ++++++++++++++++++++++++ > kernel/auditsc.c | 3 +++ > 4 files changed, 35 insertions(+) ... > @@ -2045,6 +2045,30 @@ void audit_log_session_info(struct audit_buffer *ab) > audit_log_format(ab, " auid=%u ses=%u", auid, sessionid); > } > > +/* > + * audit_log_contid - report container info > + * @tsk: task to be recorded > + * @context: task or local context for record > + * @op: contid string description > + */ > +int audit_log_contid(struct task_struct *tsk, > + struct audit_context *context, char *op) > +{ > + struct audit_buffer *ab; > + > + if (!audit_contid_set(tsk)) > + return 0; > + /* Generate AUDIT_CONTAINER record with container ID */ > + ab = audit_log_start(context, GFP_KERNEL, AUDIT_CONTAINER); > + if (!ab) > + return -ENOMEM; > + audit_log_format(ab, "op=%s contid=%llu", > + op, audit_get_contid(tsk)); > + audit_log_end(ab); > + return 0; > +} > +EXPORT_SYMBOL(audit_log_contid); As discussed in the previous iteration of the patch, I prefer AUDIT_CONTAINER_ID here over AUDIT_CONTAINER. If you feel strongly about keeping it as-is with AUDIT_CONTAINER I suppose I could live with that, but it is isn't my first choice.

However, I do care about the "op" field in this record. It just doesn't make any sense; the way you are using it it is more of a context field than an operations field, and even then why is the context important from a logging and/or security perspective? Drop it please.

paul moore

On Wed, Oct 24, 2018 at 11:15 AM Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > On 2018-10-19 19:16, Paul Moore wrote: > > On Sun, Aug 5, 2018 at 4:32 AM Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > > > Create a new audit record AUDIT_CONTAINER to document the audit > > > container identifier of a process if it is present. > > > > > > Called from audit_log_exit(), syscalls are covered. > > > > > > A sample raw event: > > > type=SYSCALL msg=audit(1519924845.499:257): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=56374e1cef30 a2=241 a3=1b6 items=2 ppid=606 pid=635 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="tmpcontainerid" > > > type=CWD msg=audit(1519924845.499:257): cwd="/root" > > > type=PATH msg=audit(1519924845.499:257): item=0 name="/tmp/" inode=13863 dev=00:27 mode=041777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tmp_t:s0 nametype= PARENT cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0 > > > type=PATH msg=audit(1519924845.499:257): item=1 name="/tmp/tmpcontainerid" inode=17729 dev=00:27 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 nametype=CREATE cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0 > > > type=PROCTITLE msg=audit(1519924845.499:257): proctitle=62617368002D6300736C65657020313B206563686F2074657374203E202F746D702F746D70636F6E7461696E65726964 > > > type=CONTAINER msg=audit(1519924845.499:257): op=task contid=123458 > > > > > > See: https://github.com/linux-audit/audit-kernel/issues/90 > > > See: https://github.com/linux-audit/audit-userspace/issues/51 > > > See: https://github.com/linux-audit/audit-testsuite/issues/64 > > > See: https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID > > > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; > > > Acked-by: Serge Hallyn <serge(a)hallyn.com&gt; > > > Acked-by: Steve Grubb <sgrubb(a)redhat.com&gt; > > > --- > > > include/linux/audit.h | 7 +++++++ > > > include/uapi/linux/audit.h | 1 + > > > kernel/audit.c | 24 ++++++++++++++++++++++++ > > > kernel/auditsc.c | 3 +++ > > > 4 files changed, 35 insertions(+) > > > > ... > > > > > @@ -2045,6 +2045,30 @@ void audit_log_session_info(struct audit_buffer *ab) > > > audit_log_format(ab, " auid=%u ses=%u", auid, sessionid); > > > } > > > > > > +/* > > > + * audit_log_contid - report container info > > > + * @tsk: task to be recorded > > > + * @context: task or local context for record > > > + * @op: contid string description > > > + */ > > > +int audit_log_contid(struct task_struct *tsk, > > > + struct audit_context *context, char *op) > > > +{ > > > + struct audit_buffer *ab; > > > + > > > + if (!audit_contid_set(tsk)) > > > + return 0; > > > + /* Generate AUDIT_CONTAINER record with container ID */ > > > + ab = audit_log_start(context, GFP_KERNEL, AUDIT_CONTAINER); > > > + if (!ab) > > > + return -ENOMEM; > > > + audit_log_format(ab, "op=%s contid=%llu", > > > + op, audit_get_contid(tsk)); > > > + audit_log_end(ab); > > > + return 0; > > > +} > > > +EXPORT_SYMBOL(audit_log_contid); > > > > As discussed in the previous iteration of the patch, I prefer > > AUDIT_CONTAINER_ID here over AUDIT_CONTAINER. If you feel strongly > > about keeping it as-is with AUDIT_CONTAINER I suppose I could live > > with that, but it is isn't my first choice. > > I don't have a strong opinion on this one, mildly preferring the shorter > one only because it is shorter. We already have multiple AUDIT_CONTAINER* record types, so it seems as though we should use "AUDIT_CONTAINER" as a prefix of sorts, rather than a type itself.

> > However, I do care about the "op" field in this record. It just > > doesn't make any sense; the way you are using it it is more of a > > context field than an operations field, and even then why is the > > context important from a logging and/or security perspective? Drop it > > please. > > I'll rename it to whatever you like. I'd suggest "ref=". The reason I > think it is important is there are multiple sources that aren't always > obvious from the other records to which it is associated. In the case > of ptrace and signals, there can be many target tasks listed (OBJ_PID) > with no other way to distinguish the matching audit container identifier > records all for one event. This is in addition to the default syscall > container identifier record. I'm not currently happy with the text > content to link the two, but that should be solvable (most obvious is > taret PID). Throwing away this information seems shortsighted. It would be helpful if you could generate real audit events demonstrating the problems you are describing, as well as a more standard syscall event, so we can discuss some possible solutions.

paul moore

On Tue, Jul 31, 2018 at 4:11 PM Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > Add audit container identifier support to ptrace and signals. In > particular, the "op" field provides a way to label the auxiliary record > to which it is associated. > > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; > Acked-by: Serge Hallyn <serge(a)hallyn.com&gt; > --- > include/linux/audit.h | 11 +++++------ > kernel/audit.c | 13 +++++++------ > kernel/audit.h | 2 ++ > kernel/auditsc.c | 21 ++++++++++++++++----- > 4 files changed, 30 insertions(+), 17 deletions(-) ... > @@ -155,9 +156,8 @@ extern void audit_log_key(struct audit_buffer *ab, > extern int audit_log_task_context(struct audit_buffer *ab); > extern void audit_log_task_info(struct audit_buffer *ab, > struct task_struct *tsk); > -extern int audit_log_contid(struct task_struct *tsk, > - struct audit_context *context, > - char *op); > +extern int audit_log_contid(struct audit_context *context, > + char *op, u64 contid); > > extern int audit_update_lsm_rules(void); ... > @@ -2047,23 +2049,22 @@ void audit_log_session_info(struct audit_buffer *ab) > > /* > * audit_log_contid - report container info > - * @tsk: task to be recorded > * @context: task or local context for record > * @op: contid string description > + * @contid: container ID to report > */ > -int audit_log_contid(struct task_struct *tsk, > - struct audit_context *context, char *op) > +int audit_log_contid(struct audit_context *context, > + char *op, u64 contid) > { > struct audit_buffer *ab; > > - if (!audit_contid_set(tsk)) > + if (!audit_contid_valid(contid)) > return 0; > /* Generate AUDIT_CONTAINER record with container ID */ > ab = audit_log_start(context, GFP_KERNEL, AUDIT_CONTAINER); > if (!ab) > return -ENOMEM; > - audit_log_format(ab, "op=%s contid=%llu", > - op, audit_get_contid(tsk)); > + audit_log_format(ab, "op=%s contid=%llu", op, contid); > audit_log_end(ab); > return 0; > } My previous comments still apply: these audit_log_contid() changes should be done earlier in the patchset when you first define audit_log_contid().

paul moore

Standalone audit records have the timestamp and serial number generated on the fly and as such are unique, making them standalone. This new function audit_alloc_local() generates a local audit context that will be used only for a standalone record and its auxiliary record(s). The context is discarded immediately after the local associated records are produced. Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; Acked-by: Serge Hallyn <serge(a)hallyn.com&gt; --- include/linux/audit.h | 8 ++++++++ kernel/audit.h | 1 + kernel/auditsc.c | 33 ++++++++++++++++++++++++++++----- 3 files changed, 37 insertions(+), 5 deletions(-)

diff --git a/include/linux/audit.h b/include/linux/audit.h index 4f514ed..1f340ad 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -234,7 +234,9 @@ struct audit_task_info { extern struct audit_task_info init_struct_audit; extern void __init audit_task_init(void); extern int audit_alloc(struct task_struct *task); +extern struct audit_context *audit_alloc_local(gfp_t gfpflags); extern void audit_free(struct task_struct *task); +extern void audit_free_context(struct audit_context *context); extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1, unsigned long a2, unsigned long a3); extern void __audit_syscall_exit(int ret_success, long ret_value); @@ -495,6 +497,12 @@ static inline int audit_alloc(struct task_struct *task) { return 0; } +static inline struct audit_context *audit_alloc_local(gfp_t gfpflags) +{ + return NULL; +} +static inline void audit_free_context(struct audit_context *context) +{ } static inline void audit_free(struct task_struct *task) { } static inline void audit_syscall_entry(int major, unsigned long a0, diff --git a/kernel/audit.h b/kernel/audit.h index 1cf1c35..a6d00a5 100644 --- a/kernel/audit.h +++ b/kernel/audit.h @@ -110,6 +110,7 @@ struct audit_proctitle { struct audit_context { int dummy; /* must be the first element */ int in_syscall; /* 1 if task is in a syscall */ + bool local; /* local context needed */ enum audit_state state, current_state; unsigned int serial; /* serial number for record */ int major; /* syscall number */ diff --git a/kernel/auditsc.c b/kernel/auditsc.c index cdb24cf..7627f21 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -913,11 +913,13 @@ static inline void audit_free_aux(struct audit_context *context) } } -static inline struct audit_context *audit_alloc_context(enum audit_state state) +static inline struct audit_context *audit_alloc_context(enum audit_state state, + gfp_t gfpflags) { struct audit_context *context; - context = kzalloc(sizeof(*context), GFP_KERNEL); + /* We can be called in atomic context via audit_tg() */ + context = kzalloc(sizeof(*context), gfpflags); if (!context) return NULL; context->state = state; @@ -970,7 +972,8 @@ int audit_alloc(struct task_struct *tsk) return 0; } - if (!(context = audit_alloc_context(state))) { + context = audit_alloc_context(state, GFP_KERNEL); + if (!(context)) { tsk->audit = NULL; kmem_cache_free(audit_task_cache, info); kfree(key); @@ -991,8 +994,27 @@ struct audit_task_info init_struct_audit = { .ctx = NULL, }; -static inline void audit_free_context(struct audit_context *context) +struct audit_context *audit_alloc_local(gfp_t gfpflags) { + struct audit_context *context; + + if (!audit_ever_enabled) + return NULL; /* Return if not auditing. */ + + context = audit_alloc_context(AUDIT_RECORD_CONTEXT, gfpflags); + if (!context) + return NULL; + context->serial = audit_serial(); + context->ctime = current_kernel_time64(); + context->local = true; + return context; +} +EXPORT_SYMBOL(audit_alloc_local); + +void audit_free_context(struct audit_context *context) +{ + if (!context) + return; audit_free_names(context); unroll_tree_refs(context, NULL, 0); free_tree_refs(context); @@ -1002,6 +1024,7 @@ static inline void audit_free_context(struct audit_context *context) audit_proctitle_free(context); kfree(context); } +EXPORT_SYMBOL(audit_free_context); static int audit_log_pid_context(struct audit_context *context, pid_t pid, kuid_t auid, kuid_t uid, unsigned int sessionid, @@ -2024,7 +2047,7 @@ void __audit_inode_child(struct inode *parent, int auditsc_get_stamp(struct audit_context *ctx, struct timespec64 *t, unsigned int *serial) { - if (!ctx->in_syscall) + if (!ctx->in_syscall && !ctx->local) return 0; if (!ctx->serial) ctx->serial = audit_serial();

Add audit container identifier auxiliary record to tty logging rule event standalone records. Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; Acked-by: Serge Hallyn <serge(a)hallyn.com&gt; --- drivers/tty/tty_audit.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/tty/tty_audit.c b/drivers/tty/tty_audit.c index 50f567b..3e21477 100644 --- a/drivers/tty/tty_audit.c +++ b/drivers/tty/tty_audit.c @@ -66,8 +66,9 @@ static void tty_audit_log(const char *description, dev_t dev, uid_t uid = from_kuid(&init_user_ns, task_uid(tsk)); uid_t loginuid = from_kuid(&init_user_ns, audit_get_loginuid(tsk)); unsigned int sessionid = audit_get_sessionid(tsk); + struct audit_context *context = audit_alloc_local(GFP_KERNEL); - ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_TTY); + ab = audit_log_start(context, GFP_KERNEL, AUDIT_TTY); if (ab) { char name[sizeof(tsk->comm)]; @@ -80,6 +81,8 @@ static void tty_audit_log(const char *description, dev_t dev, audit_log_n_hex(ab, data, size); audit_log_end(ab); } + audit_log_contid(context, "tty", audit_get_contid(tsk)); + audit_free_context(context); }

> Local contexts are a last resort. If you ever find yourself writing > code that generates a local context, you should first be 100% certain > that the event is not the the result of a process initiated action (in > which case it should take from the task's context). Well, I'm 100% certain it is linked to a process, but so are USER records that are already being discussed as the exception. This is basically a keystroke logger (that has a flag to omit passwords).

On 2019-01-03 15:11, Paul Moore wrote: > On Wed, Oct 31, 2018 at 5:17 PM Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > > On 2018-10-19 19:17, Paul Moore wrote: > > > On Sun, Aug 5, 2018 at 4:33 AM Richard Guy Briggs > <rgb(a)redhat.com&gt; wrote: > > > > Add audit container identifier auxiliary record to tty logging rule > > > > event standalone records. > > > > > > > > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; > > > > Acked-by: Serge Hallyn <serge(a)hallyn.com&gt; > > > > --- > > > > drivers/tty/tty_audit.c | 5 ++++- > > > > 1 file changed, 4 insertions(+), 1 deletion(-) > > > > > > > > diff --git a/drivers/tty/tty_audit.c b/drivers/tty/tty_audit.c > > > > index 50f567b..3e21477 100644 > > > > --- a/drivers/tty/tty_audit.c > > > > +++ b/drivers/tty/tty_audit.c > > > > @@ -66,8 +66,9 @@ static void tty_audit_log(const char *description, dev_t dev, > > > > uid_t uid = from_kuid(&amp;init_user_ns, task_uid(tsk)); > > > > uid_t loginuid = from_kuid(&amp;init_user_ns, audit_get_loginuid(tsk)); > > > > unsigned int sessionid = audit_get_sessionid(tsk); > > > > + struct audit_context *context = audit_alloc_local(GFP_KERNEL); > > > > > > > > - ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_TTY); > > > > + ab = audit_log_start(context, GFP_KERNEL, AUDIT_TTY); > > > > if (ab) { > > > > char name[sizeof(tsk->comm)]; > > > > > > > > @@ -80,6 +81,8 @@ static void tty_audit_log(const char *description, dev_t dev, > > > > audit_log_n_hex(ab, data, size); > > > > audit_log_end(ab); > > > > } > > > > + audit_log_contid(context, "tty", audit_get_contid(tsk)); > > > > + audit_free_context(context); > > > > } > > > > > > Since I never polished up my task_struct/current fix patch enough to > > > get it past RFC status during this development window (new job, stolen > > > laptop, etc.) *and* it looks like you are going to need at least one > > > more respin of this patchset, go ahead and fix this patch to use > > > current instead of generating a local context. I'll deal with the > > > merge fallout if/when it happens. > > > > Sure, I will switch it to current in the call to audit_get_contid(). > > > > The local context is a distinct issue. Like USER records, I prefer > > local due to potential record volume, it is already trackable as far as > > Steve is concerned, and if it is to be connected with the syscall > > record, it should be linked to syscall records in a seperate new github > > issue with its own patch. It accumulates events until the buffer is > > flushed to a record, so the timestamp only represents the flush (usually > > user "CR/enter"). > > Generally, yes, associating records is a separate issue, but in this > particular case you are changing this record by making it a "local" > record, which as we've discussed before, I view as a necessary evil > and something that must be minimized. A quick look at the > tty_audit_log() callers shows tty_audit_tiocsti() which is an ioctl > handler (and thus current should be valid and correct), and > tty_audit_buf_push() whose callers all seem have valid and correct > current values; if you find that not to be the case please let me > know. Unless I'm misunderstanding what "local" means, it already had a local context by virtue of having a NULL context since it was never previously connected to syscall events, so changing it to a local context doesn't change that other than making it possible to associate an auxiliary audit container identifier record. The reasoning I'm also applying here is that the contents of this record don't all come from this one syscall, but most likely came in from an entire line of individual keystrokes, so the syscall information is only from the last one of those syscalls, though that syscall information other than the timestamp should be the same.

Reading your reply above it isn't clear to me that I had made these two points clear previously. If you still think this record should be associated to a syscall despite my reasoning above, I'm willing to connect it, but will do so in a seperate issue/patch.

On 2019-01-10 20:12, Paul Moore wrote: > On Thu, Jan 10, 2019 at 5:59 PM Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > > On 2019-01-03 15:11, Paul Moore wrote: > > > On Wed, Oct 31, 2018 at 5:17 PM Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > > > > On 2018-10-19 19:17, Paul Moore wrote: > > > > > On Sun, Aug 5, 2018 at 4:33 AM Richard Guy Briggs > > > <rgb(a)redhat.com&gt; wrote: > > > > > > Add audit container identifier auxiliary record to tty logging rule > > > > > > event standalone records. > > > > > > > > > > > > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; > > > > > > Acked-by: Serge Hallyn <serge(a)hallyn.com&gt; > > > > > > --- > > > > > > drivers/tty/tty_audit.c | 5 ++++- > > > > > > 1 file changed, 4 insertions(+), 1 deletion(-) > > > > > > > > > > > > diff --git a/drivers/tty/tty_audit.c b/drivers/tty/tty_audit.c > > > > > > index 50f567b..3e21477 100644 > > > > > > --- a/drivers/tty/tty_audit.c > > > > > > +++ b/drivers/tty/tty_audit.c > > > > > > @@ -66,8 +66,9 @@ static void tty_audit_log(const char *description, dev_t dev, > > > > > > uid_t uid = from_kuid(&amp;init_user_ns, task_uid(tsk)); > > > > > > uid_t loginuid = from_kuid(&amp;init_user_ns, audit_get_loginuid(tsk)); > > > > > > unsigned int sessionid = audit_get_sessionid(tsk); > > > > > > + struct audit_context *context = audit_alloc_local(GFP_KERNEL); > > > > > > > > > > > > - ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_TTY); > > > > > > + ab = audit_log_start(context, GFP_KERNEL, AUDIT_TTY); > > > > > > if (ab) { > > > > > > char name[sizeof(tsk->comm)]; > > > > > > > > > > > > @@ -80,6 +81,8 @@ static void tty_audit_log(const char *description, dev_t dev, > > > > > > audit_log_n_hex(ab, data, size); > > > > > > audit_log_end(ab); > > > > > > } > > > > > > + audit_log_contid(context, "tty", audit_get_contid(tsk)); > > > > > > + audit_free_context(context); > > > > > > } > > > > > > > > > > Since I never polished up my task_struct/current fix patch enough to > > > > > get it past RFC status during this development window (new job, stolen > > > > > laptop, etc.) *and* it looks like you are going to need at least one > > > > > more respin of this patchset, go ahead and fix this patch to use > > > > > current instead of generating a local context. I'll deal with the > > > > > merge fallout if/when it happens. > > > > > > > > Sure, I will switch it to current in the call to audit_get_contid(). > > > > > > > > The local context is a distinct issue. Like USER records, I prefer > > > > local due to potential record volume, it is already trackable as far as > > > > Steve is concerned, and if it is to be connected with the syscall > > > > record, it should be linked to syscall records in a seperate new github > > > > issue with its own patch. It accumulates events until the buffer is > > > > flushed to a record, so the timestamp only represents the flush (usually > > > > user "CR/enter"). > > > > > > Generally, yes, associating records is a separate issue, but in this > > > particular case you are changing this record by making it a "local" > > > record, which as we've discussed before, I view as a necessary evil > > > and something that must be minimized. A quick look at the > > > tty_audit_log() callers shows tty_audit_tiocsti() which is an ioctl > > > handler (and thus current should be valid and correct), and > > > tty_audit_buf_push() whose callers all seem have valid and correct > > > current values; if you find that not to be the case please let me > > > know. > > > > Unless I'm misunderstanding what "local" means, it already had a local > > context by virtue of having a NULL context since it was never previously > > connected to syscall events, so changing it to a local context doesn't > > change that other than making it possible to associate an auxiliary > > audit container identifier record. > > > > The reasoning I'm also applying here is that the contents of this record > > don't all come from this one syscall, but most likely came in from an > > entire line of individual keystrokes, so the syscall information is only > > from the last one of those syscalls, though that syscall information > > other than the timestamp should be the same. > > Looking at the callers to tty_audit_log(), I think we can all agree > that in the tty_audit_tiocsti() case it is correct to associate the > tty record with current, as it is the current task which sent the > ioctl with the data. Do you not agree? I'm fine with that, yes. > With tty_audit_buf_push() we need to do a bit more work to track down > all the callers. Looking quickly it appears that all of the > tty_audit_add_data() callers are copying data to/from userspace, so > associating these tty records with their syscall would seem > appropriate. With tty_audit_push() it either appears to be > tty_audit_tiocsti() (again) or more userspace copy routines. I didn't > bother looking at tty_audit_exit() because that seemed pretty clear to > be something worth associating with a syscall. You may find that if > you dig deeper into the call stacks things fall apart and there are > cases where the records shouldn't be associated with the current > syscall, but based on what I'm seeing right now that doesn't appear to > be the case. Ok. Except that it might be multiple subsequent calls that assemble that data, only flushed to an audit record on exceeding N_TTY_BUF_SIZE (4k) or that task switching device and flushing the previous device or that task switching icanon mode.

> > Reading your reply above it isn't clear to me that I had made these two > > points clear previously. If you still think this record should be > > associated to a syscall despite my reasoning above, I'm willing to > > connect it, but will do so in a seperate issue/patch. So can I conclude that you are fine with the buffering of the data from multiple syscalls being associated with the output of that buffer to one audit record with the last of those syscalls?

On Sun, Aug 5, 2018 at 4:33 AM Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > Add audit container identifier auxiliary record(s) to NETFILTER_PKT > event standalone records. Iterate through all potential audit container > identifiers associated with a network namespace. > > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; > --- > include/linux/audit.h | 5 +++++ > kernel/audit.c | 26 ++++++++++++++++++++++++++ > net/netfilter/xt_AUDIT.c | 12 ++++++++++-- > 3 files changed, 41 insertions(+), 2 deletions(-) ... > diff --git a/include/linux/audit.h b/include/linux/audit.h > index 9a02095..8755f4d 100644 > --- a/include/linux/audit.h > +++ b/include/linux/audit.h > @@ -169,6 +169,8 @@ extern int audit_log_contid(struct audit_context *context, > extern void audit_netns_contid_add(struct net *net, u64 contid); > extern void audit_netns_contid_del(struct net *net, u64 contid); > extern void audit_switch_task_namespaces(struct nsproxy *ns, struct task_struct *p); > +extern void audit_log_netns_contid_list(struct net *net, > + struct audit_context *context); > > extern int audit_update_lsm_rules(void); > > @@ -228,6 +230,9 @@ static inline void audit_netns_contid_del(struct net *net, u64 contid) > { } > static inline void audit_switch_task_namespaces(struct nsproxy *ns, struct task_struct *p) > { } > +static inline void audit_log_netns_contid_list(struct net *net, > + struct audit_context *context) > +{ } > > #define audit_enabled AUDIT_OFF > #endif /* CONFIG_AUDIT */ > diff --git a/kernel/audit.c b/kernel/audit.c > index c5fed3b..b23711c 100644 > --- a/kernel/audit.c > +++ b/kernel/audit.c > @@ -392,6 +392,32 @@ void audit_switch_task_namespaces(struct nsproxy *ns, struct task_struct *p) > audit_netns_contid_add(new->net_ns, contid); > } > > +void audit_log_netns_contid_list(struct net *net, struct audit_context *context) > +{ > + spinlock_t *lock = audit_get_netns_contid_list_lock(net); > + struct audit_buffer *ab; > + struct audit_contid *cont; > + bool first = true; > + > + /* Generate AUDIT_CONTAINER record with container ID CSV list */ > + ab = audit_log_start(context, GFP_ATOMIC, AUDIT_CONTAINER); > + if (!ab) { > + audit_log_lost("out of memory in audit_log_netns_contid_list"); > + return; > + } > + audit_log_format(ab, "contid="); > + spin_lock(lock); > + list_for_each_entry(cont, audit_get_netns_contid_list(net), list) { > + if (!first) > + audit_log_format(ab, ","); > + audit_log_format(ab, "%llu", cont->id); > + first = false; > + } > + spin_unlock(lock); This is looking like potentially a lot of work to be doing under a spinlock, not to mention a single spinlock that is shared across CPUs. Considering that I expect changes to the list to be somewhat infrequent, this might be a good candidate for a RCU based locking scheme.

> + audit_log_end(ab); > +} > +EXPORT_SYMBOL(audit_log_netns_contid_list); > > void audit_panic(const char *message) > { > switch (audit_failure) { > diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c > index af883f1..44fac3f 100644 > --- a/net/netfilter/xt_AUDIT.c > +++ b/net/netfilter/xt_AUDIT.c > @@ -71,10 +71,13 @@ static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb) > { > struct audit_buffer *ab; > int fam = -1; > + struct audit_context *context; > + struct net *net; > > if (audit_enabled == AUDIT_OFF) > - goto errout; > - ab = audit_log_start(NULL, GFP_ATOMIC, AUDIT_NETFILTER_PKT); > + goto out; > + context = audit_alloc_local(GFP_ATOMIC); > + ab = audit_log_start(context, GFP_ATOMIC, AUDIT_NETFILTER_PKT); > if (ab == NULL) > goto errout; > > @@ -104,7 +107,12 @@ static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb) > > audit_log_end(ab); > > + net = xt_net(par); > + audit_log_netns_contid_list(net, context); > + > errout: > + audit_free_context(context); > +out: > return XT_CONTINUE; > } > -- paul moore www.paul-moore.com

On 2018-10-31 15:30, Richard Guy Briggs wrote: > On 2018-10-19 19:18, Paul Moore wrote: > > On Sun, Aug 5, 2018 at 4:33 AM Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > > > Add audit container identifier auxiliary record(s) to NETFILTER_PKT > > > event standalone records. Iterate through all potential audit container > > > identifiers associated with a network namespace. > > > > > > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; > > > --- > > > include/linux/audit.h | 5 +++++ > > > kernel/audit.c | 26 ++++++++++++++++++++++++++ > > > net/netfilter/xt_AUDIT.c | 12 ++++++++++-- > > > 3 files changed, 41 insertions(+), 2 deletions(-) > > > > ... > > > > > diff --git a/include/linux/audit.h b/include/linux/audit.h > > > index 9a02095..8755f4d 100644 > > > --- a/include/linux/audit.h > > > +++ b/include/linux/audit.h > > > @@ -169,6 +169,8 @@ extern int audit_log_contid(struct audit_context *context, > > > extern void audit_netns_contid_add(struct net *net, u64 contid); > > > extern void audit_netns_contid_del(struct net *net, u64 contid); > > > extern void audit_switch_task_namespaces(struct nsproxy *ns, struct task_struct *p); > > > +extern void audit_log_netns_contid_list(struct net *net, > > > + struct audit_context *context); > > > > > > extern int audit_update_lsm_rules(void); > > > > > > @@ -228,6 +230,9 @@ static inline void audit_netns_contid_del(struct net *net, u64 contid) > > > { } > > > static inline void audit_switch_task_namespaces(struct nsproxy *ns, struct task_struct *p) > > > { } > > > +static inline void audit_log_netns_contid_list(struct net *net, > > > + struct audit_context *context) > > > +{ } > > > > > > #define audit_enabled AUDIT_OFF > > > #endif /* CONFIG_AUDIT */ > > > diff --git a/kernel/audit.c b/kernel/audit.c > > > index c5fed3b..b23711c 100644 > > > --- a/kernel/audit.c > > > +++ b/kernel/audit.c > > > @@ -392,6 +392,32 @@ void audit_switch_task_namespaces(struct nsproxy *ns, struct task_struct *p) > > > audit_netns_contid_add(new->net_ns, contid); > > > } > > > > > > +void audit_log_netns_contid_list(struct net *net, struct audit_context *context) > > > +{ > > > + spinlock_t *lock = audit_get_netns_contid_list_lock(net); > > > + struct audit_buffer *ab; > > > + struct audit_contid *cont; > > > + bool first = true; > > > + > > > + /* Generate AUDIT_CONTAINER record with container ID CSV list */ > > > + ab = audit_log_start(context, GFP_ATOMIC, AUDIT_CONTAINER); > > > + if (!ab) { > > > + audit_log_lost("out of memory in audit_log_netns_contid_list"); > > > + return; > > > + } > > > + audit_log_format(ab, "contid="); > > > + spin_lock(lock); > > > + list_for_each_entry(cont, audit_get_netns_contid_list(net), list) { > > > + if (!first) > > > + audit_log_format(ab, ","); > > > + audit_log_format(ab, "%llu", cont->id); > > > + first = false; > > > + } > > > + spin_unlock(lock); > > > > This is looking like potentially a lot of work to be doing under a > > spinlock, not to mention a single spinlock that is shared across CPUs. > > Considering that I expect changes to the list to be somewhat > > infrequent, this might be a good candidate for a RCU based locking > > scheme. > > Would something like this look reasonable? > (This is on top of a patch to make contid list lock and unlock > functions.) Paul, could I please get your review on this locking approach I proposed almost two months ago so I can be more reassured that it won't be an issue in v5? Thanks!

> diff --git a/include/linux/audit.h b/include/linux/audit.h > index be5d6eb..9428fc3 100644 > --- a/include/linux/audit.h > +++ b/include/linux/audit.h > @@ -92,6 +92,7 @@ struct audit_contid { > struct list_head list; > u64 id; > refcount_t refcount; > + struct rcu_head rcu; > }; > > extern int is_audit_feature_set(int which); > diff --git a/kernel/audit.c b/kernel/audit.c > index d5b58163..6f84c25 100644 > --- a/kernel/audit.c > +++ b/kernel/audit.c > @@ -106,7 +106,6 @@ > struct audit_net { > struct sock *sk; > struct list_head contid_list; > - spinlock_t contid_list_lock; > }; > > /** > @@ -327,26 +326,6 @@ struct list_head *audit_get_netns_contid_list(const struct net *net) > return &aunet->contid_list; > } > > -static int audit_netns_contid_lock(const struct net *net) > -{ > - struct audit_net *aunet = net_generic(net, audit_net_id); > - > - if (!aunet) > - return -EINVAL; > - spin_lock(aunet->contid_list_lock); > - return 0; > -} > - > -static int audit_netns_contid_unlock(const struct net *net) > -{ > - struct audit_net *aunet = net_generic(net, audit_net_id); > - > - if (!aunet) > - return -EINVAL; > - spin_unlock(aunet->contid_list_lock); > - return 0; > -} > - > void audit_netns_contid_add(struct net *net, u64 contid) > { > struct list_head *contid_list = audit_get_netns_contid_list(net); > @@ -354,10 +333,9 @@ void audit_netns_contid_add(struct net *net, u64 contid) > > if (!audit_contid_valid(contid)) > return; > - if (audit_netns_contid_lock(net)) > - return; > + rcu_read_lock(); > if (!list_empty(contid_list)) > - list_for_each_entry(cont, contid_list, list) > + list_for_each_entry_rcu(cont, contid_list, list) > if (cont->id == contid) { > refcount_inc(&cont->refcount); > goto out; > @@ -367,10 +345,16 @@ void audit_netns_contid_add(struct net *net, u64 contid) > INIT_LIST_HEAD(&cont->list); > cont->id = contid; > refcount_set(&cont->refcount, 1); > - list_add(&cont->list, contid_list); > + list_add_rcu(&cont->list, contid_list); > } > out: > - audit_netns_contid_unlock(net); > + rcu_read_unlock(); > +} > + > +audit_free_contid_rcu(struct rcu_head *head) { > + struct audit_contid *contid = container_of(head, struct audit_contid, rcu); > + > + kfree(contid); > } > > void audit_netns_contid_del(struct net *net, u64 contid) > @@ -380,17 +364,16 @@ void audit_netns_contid_del(struct net *net, u64 contid) > > if (!audit_contid_valid(contid)) > return; > - if (audit_netns_contid_lock(net)) > - return; > + rcu_read_lock(); > if (!list_empty(contid_list)) > - list_for_each_entry(cont, contid_list, list) > + list_for_each_entry_rcu(cont, contid_list, list) > if (cont->id == contid) { > - list_del(&cont->list); > + list_del_rcu(&cont->list); > if (refcount_dec_and_test(&cont->refcount)) > - kfree(cont); > + call_rcu(&cont->rcu, audit_free_contid_rcu); > break; > } > - audit_netns_contid_unlock(net); > + rcu_read_unlock(); > } > > void audit_switch_task_namespaces(struct nsproxy *ns, struct task_struct *p) > @@ -418,15 +401,14 @@ void audit_log_netns_contid_list(struct net *net, struct audit_context *context) > return; > } > audit_log_format(ab, "ref=net contid="); > - if (audit_netns_contid_lock(net)) > - return; > - list_for_each_entry(cont, audit_get_netns_contid_list(net), list) { > + rcu_read_lock(); > + list_for_each_entry_rcu(cont, audit_get_netns_contid_list(net), list) { > if (!first) > audit_log_format(ab, ","); > audit_log_format(ab, "%llu", cont->id); > first = false; > } > - audit_netns_contid_unlock(net); > + rcu_read_unlock(); > audit_log_end(ab); > } > EXPORT_SYMBOL(audit_log_netns_contid_list); > @@ -1674,7 +1656,6 @@ static int __net_init audit_net_init(struct net *net) > .flags = NL_CFG_F_NONROOT_RECV, > .groups = AUDIT_NLGRP_MAX, > }; > - > struct audit_net *aunet = net_generic(net, audit_net_id); > > aunet->sk = netlink_kernel_create(net, NETLINK_AUDIT, &cfg); > @@ -1684,8 +1665,6 @@ static int __net_init audit_net_init(struct net *net) > } > aunet->sk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT; > INIT_LIST_HEAD(&aunet->contid_list); > - spin_lock_init(&aunet->contid_list_lock); > - > return 0; > } > > > > > > + audit_log_end(ab); > > > +} > > > +EXPORT_SYMBOL(audit_log_netns_contid_list); > > > > > > void audit_panic(const char *message) > > > { > > > switch (audit_failure) { > > > diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c > > > index af883f1..44fac3f 100644 > > > --- a/net/netfilter/xt_AUDIT.c > > > +++ b/net/netfilter/xt_AUDIT.c > > > @@ -71,10 +71,13 @@ static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb) > > > { > > > struct audit_buffer *ab; > > > int fam = -1; > > > + struct audit_context *context; > > > + struct net *net; > > > > > > if (audit_enabled == AUDIT_OFF) > > > - goto errout; > > > - ab = audit_log_start(NULL, GFP_ATOMIC, AUDIT_NETFILTER_PKT); > > > + goto out; > > > + context = audit_alloc_local(GFP_ATOMIC); > > > + ab = audit_log_start(context, GFP_ATOMIC, AUDIT_NETFILTER_PKT); > > > if (ab == NULL) > > > goto errout; > > > > > > @@ -104,7 +107,12 @@ static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb) > > > > > > audit_log_end(ab); > > > > > > + net = xt_net(par); > > > + audit_log_netns_contid_list(net, context); > > > + > > > errout: > > > + audit_free_context(context); > > > +out: > > > return XT_CONTINUE; > > > } > > > > > > > -- > > paul moore > > www.paul-moore.com > > - RGB > > -- > Richard Guy Briggs <rgb(a)redhat.com&gt; > Sr. S/W Engineer, Kernel Security, Base Operating Systems > Remote, Ottawa, Red Hat Canada > IRC: rgb, SunRaycer > Voice: +1.647.777.2635, Internal: (81) 32635 > > -- > Linux-audit mailing list > Linux-audit(a)redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit - RGB -- Richard Guy Briggs <rgb(a)redhat.com&gt; Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635