7:54 p.m.
Hello,
Here is the patch that implements the filesystem auditing component of the
audit subsystem. For this list, attached as a file /w CHANGELOG. Patched
against linux-2.6.11.5 -- Please note, this is untested in SMP (sorry
Stephen, haven't had the time; will do tomorrow).
CHANGELOG
+ Changed naming convention (most notably, removed my initials)
-> linux-2.6.11.5-auditfs-tc1-6-2.patch to linux-2.6.11.5-auditfs.6.2.patch
+ Unconditionally allocate inode->i_audit, initialize to NULL
-> Hook (1) in inode_alloc() : audit_inode_alloc()
-> Hook (1) in destroy_inode() : audit_inode_free()
+ Additional placement of audit_notify_watch() hooks
-> Hook (2) open_namei() : catch on succ/fail paths
-> Hook (1) vfs_create() : catch post create
-> Hook (1) vfs_mkdir() : catch post mkdir
-> Hook (1) vfs_mknod() : catch post mknod
-> Hook (1) vfs_symlink(): catch post symlink
-> Hook (1) vfs_link() : catch post link
-> Hook (1) vfs_rename_dir : post rename
-> Hook (1) vfs_rename_other : post rename
+ Modified placement of audit_attach_watch() hooks
-> Hook (1) d_move() : catch post move to attach watch
+ Added support for audit_context.aux (but did not add IPC portion)
+ Shifted audit_notify_watch() back to kernel/auditsc.c
-> Store accessed audit_watch information on audit_context.aux to dump at
audit_log_exit(), rather then instant delivery to user space.
+ Changed audit_watch *req field of audit_receive_watch() to void *
+ Shifted sanity checking / copying of watch data from userspace back into
audit_watch_insert() and audit_watch_remove()
+ Added AUDIT_WATCH_LST support
-> Added to switch statement in audit_receive_msg(), audit_netlink_ok(),
and audit_receive_watch()
+ Added audit_watch_to_string() to convert watch to string
+ Added audit_list_watches() to send watches on a given directory back to user
space in the form of strings
+ Added AUDIT_WATCH_ERR support - generic channel to send messages about watch
actions to userspace; convert audit_receive_watch() to use this
+ Moved placement of locked audit_fetch_watch of parent above write_lock on
child to prevent deadlock if parent == child in audit_attach_watch. Have not
tested code on SMP, however.
--
-tim
8:34 a.m.
On Monday 28 March 2005 20:54, Timothy R. Chavez wrote:
+ Added AUDIT_WATCH_LST support
Why not LIST instead of LST.
+ Added AUDIT_WATCH_ERR support - generic channel to send messages
about
watch actions to userspace; convert audit_receive_watch() to use this
I disagree with this whole approach. You should not create your own message
call back. You should use the same one that every other packet type uses.
Please just return the error back to audit_receive_msg. It should either
return the error code directly or catch the error code in err. You do not
need a type in the error message either. That should be readily appearant. If
I'm inserting a rule, I should know the error was related to insert.
Was audit_receive_msg not returning an error message?
Thanks,
-Steve
9:38 a.m.
On Tuesday 29 March 2005 08:34 am, Steve Grubb wrote:
On Monday 28 March 2005 20:54, Timothy R. Chavez wrote:
> + Added AUDIT_WATCH_LST support
Why not LIST instead of LST.
> + Added AUDIT_WATCH_ERR support - generic channel to send messages about
> watch actions to userspace; convert audit_receive_watch() to use this
I disagree with this whole approach. You should not create your own message
call back. You should use the same one that every other packet type uses.
Please just return the error back to audit_receive_msg. It should either
return the error code directly or catch the error code in err. You do not
need a type in the error message either. That should be readily appearant.
If I'm inserting a rule, I should know the error was related to insert.
I can change this. Easy enough. This will reduce the reply code for
insert/delete for 0.6.9 too and eliminate a macro.
Was audit_receive_msg not returning an error message?
No it can return one. I just wanted to put some additional context around
that error message.
Thanks,
-Steve
--
Linux-audit mailing list
Linux-audit(a)redhat.com
http://www.redhat.com/mailman/listinfo/linux-audit
--
-tim
10:31 a.m.
On Tuesday 29 March 2005 10:38, Timothy R. Chavez wrote:
I can change this. Easy enough. This will reduce the reply code
for
insert/delete for 0.6.9 too and eliminate a macro.
Thanks. I think it simplifies the code.
And then there's this:
+ Shifted sanity checking / copying of watch data from userspace back into
audit_watch_insert() and audit_watch_remove()
You have the same code in insert and remove. Why not just do something like
this:
if type is list {
handle it
}
else if type is insert or remove {
sanity checking
if insert handle insert
else handle remove
}
else
EINVAL
But when you think about it, couldn't list have an invalid path as well? Does
list need the same sanity checking? If not, audit_receive_msg could just call
audit_list_watches directly. Also, audit_receive_watch does not need a
default because audit_receive_msg only calls it if the type is something it
handles. So, the EINVAL above is not needed. audit_receive_watch becomes:
sanity checking
if insert handle insert
else handle remove
In audit_receive_msg, when handling AUDIT_WATCH_LST, don't you need to check
the length of nlh->nlmsg_len before passing the request?
-Steve
11:54 a.m.
On Tuesday 29 March 2005 10:31 am, Steve Grubb wrote:
On Tuesday 29 March 2005 10:38, Timothy R. Chavez wrote:
> I can change this. Easy enough. This will reduce the reply code for
> insert/delete for 0.6.9 too and eliminate a macro.
Thanks. I think it simplifies the code.
And then there's this:
+ Shifted sanity checking / copying of watch data from userspace back into
audit_watch_insert() and audit_watch_remove()
Yeah I suppose I should rethink this and centralize all the checking as best
as possible.
But when you think about it, couldn't list have an invalid path as well?
Yeah, it can, but since it's already a kernel space string and I'm just
passing it path_lookup, it ought to fail accordingly.
Does list need the same sanity checking? If not, audit_receive_msg
could
just call audit_list_watches directly. Also, audit_receive_watch does not
need a default because audit_receive_msg only calls it if the type is
something it handles.
I think this is actually the best approach.
-tim
10:43 a.m.
On Mon, 2005-03-28 at 19:54 -0600, Timothy R. Chavez wrote:
Hello,
Here is the patch that implements the filesystem auditing component of the
audit subsystem. For this list, attached as a file /w CHANGELOG. Patched
against linux-2.6.11.5 -- Please note, this is untested in SMP (sorry
Stephen, haven't had the time; will do tomorrow).
BTW, trivial test for the shadow file example is:
auditctl -e 1
auditctl -w /etc/shadow -p w
passwd
<change own password>
I see an audit message for syscall 38 (rename), with two auxiliary items
for shadow (with garbage for the inode= fields, looks like you aren't
setting the ino field upon audit_notify_watch), and two items
for /etc/nshadow and /etc/shadow. Why two auxiliary items? Is this due
to the may_delete() notify and the vfs_rename_other() notify both being
triggered upon the rename. I guess that makes sense.
--
Stephen Smalley <sds(a)tycho.nsa.gov>
National Security Agency
5:10 p.m.
On Tuesday 29 March 2005 10:43 am, Stephen Smalley wrote:
I see an audit message for syscall 38 (rename), with two auxiliary
items
for shadow (with garbage for the inode= fields, looks like you aren't
setting the ino field upon audit_notify_watch)
Hahaha... oops :) Fixed.
--
-tim
7207
days inactive
7207
days old
linux-audit@lists.linux-audit.osci.io
6 comments
3 participants
participants (3)
-
Stephen Smalley -
Steve Grubb -
Timothy R. Chavez