security: lsm_audit: add ioctl specific auditing

PATCH In review Jeff Vander Stoep 6 participants 9 messages Apr 9, 2015 – May 20, 2015

Subsystems (2)

SELinux security module Security (LSM)

lore

Share & tools

lore

Jeff Vander Stoep

author

2015-04-09 21:49 UTC #0 lore raw

PATCH 1/2 security: lsm_audit: add ioctl specific auditing

Add information about ioctl calls to the LSM audit data. Log the file path and command number.

Signed-off-by Jeff Vander Stoep <[email protected]>

---
 include/linux/lsm_audit.h |  7 +++++++
 security/lsm_audit.c      | 15 +++++++++++++++
 2 files changed, 22 insertions(+)

include/linux/lsm_audit.h +7 -0

index 1cc89e9..ffb9c9d 100644
@@ -40,6 +40,11 @@ struct lsm_network_audit {
 	} fam;
 };
 
+struct lsm_ioctlop_audit {
+	struct path path;
+	u16 cmd;
+};
+
 /* Auxiliary data to use in generating the audit record. */
 struct common_audit_data {
 	char type;

@@ -53,6 +58,7 @@ struct common_audit_data {
 #define LSM_AUDIT_DATA_KMOD	8
 #define LSM_AUDIT_DATA_INODE	9
 #define LSM_AUDIT_DATA_DENTRY	10
+#define LSM_AUDIT_DATA_IOCTL_OP	11
 	union 	{
 		struct path path;
 		struct dentry *dentry;

@@ -68,6 +74,7 @@ struct common_audit_data {
 		} key_struct;
 #endif
 		char *kmod_name;
+		struct lsm_ioctlop_audit *op;
 	} u;
 	/* this union contains LSM specific data */
 	union {

security/lsm_audit.c +15 -0

index 69fdf3b..7147c17 100644
@@ -245,6 +245,21 @@ static void dump_common_audit_data(struct audit_buffer *ab,
 		}
 		break;
 	}
+	case LSM_AUDIT_DATA_IOCTL_OP: {
+		struct inode *inode;
+
+		audit_log_d_path(ab, " path=", &a->u.op->path);
+
+		inode = a->u.op->path.dentry->d_inode;
+		if (inode) {
+			audit_log_format(ab, " dev=");
+			audit_log_untrustedstring(ab, inode->i_sb->s_id);
+			audit_log_format(ab, " ino=%lu", inode->i_ino);
+		}
+
+		audit_log_format(ab, " ioctlcmd=%hx", a->u.op->cmd);
+		break;
+	}
 	case LSM_AUDIT_DATA_DENTRY: {
 		struct inode *inode;

Signature · 1 line

2.2.0.rc0.207.ga3a616c

Stephen Smalley

Acked-by on v1 1/2

2015-04-10 12:33 UTC #1 lore raw

Quoted 4 lines · Jeff Vander Stoep

Add information about ioctl calls to the LSM audit data. Log the file path and command number.
Signed-off-by Jeff Vander Stoep <[email protected]>

Acked-by Stephen Smalley <[email protected]>

Quoted 64 lines

---
 include/linux/lsm_audit.h |  7 +++++++
 security/lsm_audit.c      | 15 +++++++++++++++
 2 files changed, 22 insertions(+)

include/linux/lsm_audit.h +7 -0

index 1cc89e9..ffb9c9d 100644
@@ -40,6 +40,11 @@ struct lsm_network_audit {
 	} fam;
 };
 
+struct lsm_ioctlop_audit {
+	struct path path;
+	u16 cmd;
+};
+
 /* Auxiliary data to use in generating the audit record. */
 struct common_audit_data {
 	char type;

@@ -53,6 +58,7 @@ struct common_audit_data {
 #define LSM_AUDIT_DATA_KMOD	8
 #define LSM_AUDIT_DATA_INODE	9
 #define LSM_AUDIT_DATA_DENTRY	10
+#define LSM_AUDIT_DATA_IOCTL_OP	11
 	union 	{
 		struct path path;
 		struct dentry *dentry;

@@ -68,6 +74,7 @@ struct common_audit_data {
 		} key_struct;
 #endif
 		char *kmod_name;
+		struct lsm_ioctlop_audit *op;
 	} u;
 	/* this union contains LSM specific data */
 	union {

security/lsm_audit.c +15 -0

index 69fdf3b..7147c17 100644
@@ -245,6 +245,21 @@ static void dump_common_audit_data(struct audit_buffer *ab,
 		}
 		break;
 	}
+	case LSM_AUDIT_DATA_IOCTL_OP: {
+		struct inode *inode;
+
+		audit_log_d_path(ab, " path=", &a->u.op->path);
+
+		inode = a->u.op->path.dentry->d_inode;
+		if (inode) {
+			audit_log_format(ab, " dev=");
+			audit_log_untrustedstring(ab, inode->i_sb->s_id);
+			audit_log_format(ab, " ino=%lu", inode->i_ino);
+		}
+
+		audit_log_format(ab, " ioctlcmd=%hx", a->u.op->cmd);
+		break;
+	}
 	case LSM_AUDIT_DATA_DENTRY: {
 		struct inode *inode;

_______________________________________________
Selinux mailing list
[email protected]
To unsubscribe, send email to [email protected].
To get help, send an email containing "help" to [email protected].

Signature · 1 line

Nick Kralevich | Android Security | [email protected] | 650.214.4037

Paul Moore

maintainer

2015-04-23 22:25 UTC #3 lore raw

In reply to Jeff Vander Stoep

Quoted 8 lines · Jeff Vander Stoep

Add information about ioctl calls to the LSM audit data. Log the file path and command number.
Signed-off-by Jeff Vander Stoep <[email protected]>
---
 include/linux/lsm_audit.h |  7 +++++++
 security/lsm_audit.c      | 15 +++++++++++++++
 2 files changed, 22 insertions(+)

While this isn't specific to a given LSM, at present it only makes sense with the associated SELinux patches. James, unless you have any objections I would prefer if this went in via the SELinux tree.

Quoted 61 lines

include/linux/lsm_audit.h +7 -0

index 1cc89e9..ffb9c9d 100644
@@ -40,6 +40,11 @@ struct lsm_network_audit {
        } fam;
 };
 
+struct lsm_ioctlop_audit {
+       struct path path;
+       u16 cmd;
+};
+
 /* Auxiliary data to use in generating the audit record. */
 struct common_audit_data {
        char type;

@@ -53,6 +58,7 @@ struct common_audit_data {
 #define LSM_AUDIT_DATA_KMOD    8
 #define LSM_AUDIT_DATA_INODE   9
 #define LSM_AUDIT_DATA_DENTRY  10
+#define LSM_AUDIT_DATA_IOCTL_OP        11
        union   {
                struct path path;
                struct dentry *dentry;

@@ -68,6 +74,7 @@ struct common_audit_data {
                } key_struct;
 #endif
                char *kmod_name;
+               struct lsm_ioctlop_audit *op;
        } u;
        /* this union contains LSM specific data */
        union {

security/lsm_audit.c +15 -1

index 69fdf3b..7147c17 100644
@@ -245,6 +245,21 @@ static void dump_common_audit_data(struct audit_buffer *ab,
                }
                break;
        }
+       case LSM_AUDIT_DATA_IOCTL_OP: {
+               struct inode *inode;
+
+               audit_log_d_path(ab, " path=", &a->u.op->path);
+
+               inode = a->u.op->path.dentry->d_inode;
+               if (inode) {
+                       audit_log_format(ab, " dev=");
+                       audit_log_untrustedstring(ab, inode->i_sb->s_id);
+                       audit_log_format(ab, " ino=%lu", inode->i_ino);
+               }
+
+               audit_log_format(ab, " ioctlcmd=%hx", a->u.op->cmd);
+               break;
+       }
        case LSM_AUDIT_DATA_DENTRY: {
                struct inode *inode;
 
--

2.2.0.rc0.207.ga3a616c

Signature · 2 lines

paul moore
www.paul-moore.com

James Morris

maintainer

2015-04-24 00:00 UTC #4 lore raw

Quoted 10 lines · Paul Moore

Quoted 8 lines · Jeff Vander Stoep
Add information about ioctl calls to the LSM audit data. Log the file path and command number.
Signed-off-by Jeff Vander Stoep <[email protected]>
---
 include/linux/lsm_audit.h |  7 +++++++
 security/lsm_audit.c      | 15 +++++++++++++++
 2 files changed, 22 insertions(+)

Quoted 3 lines

While this isn't specific to a given LSM, at present it only makes sense with the associated SELinux patches. James, unless you have any objections I would prefer if this went in via the SELinux tree.

Fine by me.

Signature · 2 lines

James Morris
<[email protected]>

Paul Moore

maintainer

2015-05-20 20:06 UTC #5 lore raw

In reply to Jeff Vander Stoep

Quoted 8 lines · Jeff Vander Stoep

Add information about ioctl calls to the LSM audit data. Log the file path and command number.
Signed-off-by Jeff Vander Stoep <[email protected]>
---
 include/linux/lsm_audit.h |  7 +++++++
 security/lsm_audit.c      | 15 +++++++++++++++
 2 files changed, 22 insertions(+)

No real comment other than we should include the linux-audit list on this patch (added to the To/CC line).

Quoted 1 line

From an audit perspective the only new field would be the ioctl number which

is represented by the "ioctlcmd" name. Does anyone in the audit space have any strong feelings on this one way or another?

Quoted 57 lines

include/linux/lsm_audit.h +7 -0

index 1cc89e9..ffb9c9d 100644
@@ -40,6 +40,11 @@ struct lsm_network_audit {
 	} fam;
 };
 
+struct lsm_ioctlop_audit {
+	struct path path;
+	u16 cmd;
+};
+
 /* Auxiliary data to use in generating the audit record. */
 struct common_audit_data {
 	char type;

@@ -53,6 +58,7 @@ struct common_audit_data {
 #define LSM_AUDIT_DATA_KMOD	8
 #define LSM_AUDIT_DATA_INODE	9
 #define LSM_AUDIT_DATA_DENTRY	10
+#define LSM_AUDIT_DATA_IOCTL_OP	11
 	union 	{
 		struct path path;
 		struct dentry *dentry;

@@ -68,6 +74,7 @@ struct common_audit_data {
 		} key_struct;
 #endif
 		char *kmod_name;
+		struct lsm_ioctlop_audit *op;
 	} u;
 	/* this union contains LSM specific data */
 	union {

security/lsm_audit.c +15 -0

index 69fdf3b..7147c17 100644
@@ -245,6 +245,21 @@ static void dump_common_audit_data(struct audit_buffer
 *ab, }
 		break;
 	}
+	case LSM_AUDIT_DATA_IOCTL_OP: {
+		struct inode *inode;
+
+		audit_log_d_path(ab, " path=", &a->u.op->path);
+
+		inode = a->u.op->path.dentry->d_inode;
+		if (inode) {
+			audit_log_format(ab, " dev=");
+			audit_log_untrustedstring(ab, inode->i_sb->s_id);
+			audit_log_format(ab, " ino=%lu", inode->i_ino);
+		}
+
+		audit_log_format(ab, " ioctlcmd=%hx", a->u.op->cmd);
+		break;
+	}
 	case LSM_AUDIT_DATA_DENTRY: {
 		struct inode *inode;

Signature · 2 lines

paul moore
www.paul-moore.com

Steve Grubb

2015-05-20 20:21 UTC #6 lore raw

Quoted 11 lines · Paul Moore

Quoted 9 lines · Jeff Vander Stoep
Add information about ioctl calls to the LSM audit data. Log the file path and command number.
Signed-off-by Jeff Vander Stoep <[email protected]>
---
 include/linux/lsm_audit.h |  7 +++++++
 security/lsm_audit.c      | 15 +++++++++++++++
 2 files changed, 22 insertions(+)

Quoted 6 lines

No real comment other than we should include the linux-audit list on this patch (added to the To/CC line).
From an audit perspective the only new field would be the ioctl number which is represented by the "ioctlcmd" name. Does anyone in the audit space have any strong feelings on this one way or another?

Isn't that in arg1 already? I know I wrote interpretations for it.

-Steve

Quoted 79 lines

include/linux/lsm_audit.h +5 -0

index 1cc89e9..ffb9c9d 100644
@@ -40,6 +40,11 @@ struct lsm_network_audit {
 
 	} fam;
 
 };
 
+struct lsm_ioctlop_audit {
+	struct path path;
+	u16 cmd;
+};
+

/* Auxiliary data to use in generating the audit record. */ struct common_audit_data {

include/linux/lsm_audit.h +1 -0

 	char type;

@@ -53,6 +58,7 @@ struct common_audit_data {
 
 #define LSM_AUDIT_DATA_KMOD	8
 #define LSM_AUDIT_DATA_INODE	9
 #define LSM_AUDIT_DATA_DENTRY	10
 
+#define LSM_AUDIT_DATA_IOCTL_OP	11

include/linux/lsm_audit.h +1 -0

 	union 	{
 
 		struct path path;
 		struct dentry *dentry;

@@ -68,6 +74,7 @@ struct common_audit_data {
 
 		} key_struct;
 
 #endif
 
 		char *kmod_name;
 
+		struct lsm_ioctlop_audit *op;
 
 	} u;
 	/* this union contains LSM specific data */
 	union {

security/lsm_audit.c +0 -0

index 69fdf3b..7147c17 100644
@@ -245,6 +245,21 @@ static void dump_common_audit_data(struct

audit_buffer
*ab, }

security/lsm_audit.c +15 -0

 		break;
 
 	}
 
+	case LSM_AUDIT_DATA_IOCTL_OP: {
+		struct inode *inode;
+
+		audit_log_d_path(ab, " path=", &a->u.op->path);
+
+		inode = a->u.op->path.dentry->d_inode;
+		if (inode) {
+			audit_log_format(ab, " dev=");
+			audit_log_untrustedstring(ab, inode->i_sb->s_id);
+			audit_log_format(ab, " ino=%lu", inode->i_ino);
+		}
+
+		audit_log_format(ab, " ioctlcmd=%hx", a->u.op->cmd);
+		break;
+	}
 
 	case LSM_AUDIT_DATA_DENTRY: {
 
 		struct inode *inode;

Stephen Smalley

2015-05-20 20:22 UTC #7 lore raw

Quoted 12 lines · Steve Grubb

Quoted 11 lines · Paul Moore
Quoted 9 lines · Jeff Vander Stoep
Add information about ioctl calls to the LSM audit data. Log the file path and command number.
Signed-off-by Jeff Vander Stoep <[email protected]>
---
 include/linux/lsm_audit.h |  7 +++++++
 security/lsm_audit.c      | 15 +++++++++++++++
 2 files changed, 22 insertions(+)

Quoted 8 lines

Quoted 6 lines
No real comment other than we should include the linux-audit list on this patch (added to the To/CC line).
From an audit perspective the only new field would be the ioctl number which is represented by the "ioctlcmd" name. Does anyone in the audit space have any strong feelings on this one way or another?
Isn't that in arg1 already? I know I wrote interpretations for it.

Only with syscall audit, often not enabled. This is to capture the information on AVC denials for an extension to SELinux to support ioctl whitelisting.

Steve Grubb

2015-05-20 20:39 UTC #8 lore raw

Quoted 20 lines · Stephen Smalley

Quoted 19 lines · Steve Grubb
Quoted 17 lines · Paul Moore
Quoted 9 lines · Jeff Vander Stoep
Add information about ioctl calls to the LSM audit data. Log the file path and command number.
Signed-off-by Jeff Vander Stoep <[email protected]>
---
 include/linux/lsm_audit.h |  7 +++++++
 security/lsm_audit.c      | 15 +++++++++++++++
 2 files changed, 22 insertions(+)
No real comment other than we should include the linux-audit list on this patch (added to the To/CC line).
From an audit perspective the only new field would be the ioctl number which is represented by the "ioctlcmd" name. Does anyone in the audit space have any strong feelings on this one way or another?

Quoted 5 lines

Quoted 1 line
Isn't that in arg1 already? I know I wrote interpretations for it.
Only with syscall audit, often not enabled. This is to capture the information on AVC denials for an extension to SELinux to support ioctl whitelisting.

OK. ioctlcmd is fine. I'll add it to the lookup table to interpret the value.

-Steve