add uid and comm to OBJ_PID records

Add uid and comm collection to OBJ_PID records. This information was ask for by RHEL users who wanted a better idea where signals were ending up.

Signed-off-by Eric Paris <[email protected]>

---

#kill a program running as a different user in a different domain type=OBJ_PID msg=audit(12/10/2007 15:36:54.328:67) : opid=3018 obj=root:system_r:httpd_t:s0-s0:c0.c1023 uid=test comm=loop

type=SYSCALL msg=audit(12/10/2007 15:36:54.328:67) : arch=x86_64 syscall=kill success=yes exit=0 a0=bca a1=f a2=0 a3=0 items=0 ppid=2189 pid=2194 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 comm=bash exe=/bin/bash subj=root:system_r:unconfined_t:s0-s0:c0.c1023 key=(null)

## custom program which fork() 2 children, puts them in a grp and

type=OBJ_PID msg=audit(12/10/2007 15:29:59.969:38) : opid=2976

type=OBJ_PID msg=audit(12/10/2007 15:29:59.969:38) : opid=2975

type=SYSCALL msg=audit(12/10/2007 15:29:59.969:38) : arch=x86_64

 kernel/auditsc.c |   21 ++++++++++++++++++---
 1 files changed, 18 insertions(+), 3 deletions(-)

kernel/auditsc.c +18 -4

index bce9ecd..dcedbb0 100644
@@ -176,7 +176,9 @@ struct audit_aux_data_fd_pair {
 struct audit_aux_data_pids {
 	struct audit_aux_data	d;
 	pid_t			target_pid[AUDIT_AUX_PIDS];
+	pid_t			target_uid[AUDIT_AUX_PIDS];
 	u32			target_sid[AUDIT_AUX_PIDS];
+	char 			target_comm[AUDIT_AUX_PIDS][TASK_COMM_LEN];
 	int			pid_count;
 };
 

@@ -215,7 +217,9 @@ struct audit_context {
 	int		    arch;
 
 	pid_t		    target_pid;
+	pid_t		    target_uid;
 	u32		    target_sid;
+	char		    target_comm[TASK_COMM_LEN];
 
 	struct audit_tree_refs *trees, *first_trees;
 	int tree_count;

@@ -922,7 +926,7 @@ static void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk
 }
 
 static int audit_log_pid_context(struct audit_context *context, pid_t pid,
-				 u32 sid)
+				 u32 sid, pid_t uid, char *comm)
 {
 	struct audit_buffer *ab;
 	char *s = NULL;

@@ -938,6 +942,8 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid,
 		rc = 1;
 	} else
 		audit_log_format(ab, "opid=%d  obj=%s", pid, s);
+	audit_log_format(ab, " uid=%d comm=", uid);
+	audit_log_untrustedstring(ab, comm);
 	audit_log_end(ab);
 	kfree(s);
 

@@ -1168,13 +1174,16 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
 
 		for (i = 0; i < axs->pid_count; i++)
 			if (audit_log_pid_context(context, axs->target_pid[i],
-						  axs->target_sid[i]))
+						  axs->target_sid[i],
+						  axs->target_uid[i],
+						  axs->target_comm[i]))
 				call_panic = 1;
 	}
 
 	if (context->target_pid &&
 	    audit_log_pid_context(context, context->target_pid,
-				  context->target_sid))
+				  context->target_sid, context->target_uid,
+				  context->target_comm))
 			call_panic = 1;
 
 	if (context->pwd && context->pwdmnt) {

@@ -2194,6 +2203,8 @@ void __audit_ptrace(struct task_struct *t)
 
 	context->target_pid = t->pid;
 	selinux_get_task_sid(t, &context->target_sid);
+	memcpy(context->target_comm, t->comm, TASK_COMM_LEN);
+	context->target_uid = t->uid;
 }
 
 /**

@@ -2231,6 +2242,8 @@ int __audit_signal_info(int sig, struct task_struct *t)
 	if (!ctx->target_pid) {
 		ctx->target_pid = t->tgid;
 		selinux_get_task_sid(t, &ctx->target_sid);
+		memcpy(ctx->target_comm, t->comm, TASK_COMM_LEN);
+		ctx->target_uid = t->uid;
 		return 0;
 	}
 

@@ -2248,6 +2261,8 @@ int __audit_signal_info(int sig, struct task_struct *t)
 
 	axp->target_pid[axp->pid_count] = t->tgid;
 	selinux_get_task_sid(t, &axp->target_sid[axp->pid_count]);
+	memcpy(axp->target_comm[axp->pid_count], t->comm, TASK_COMM_LEN);
+	axp->target_uid[axp->pid_count] = t->uid;
 	axp->pid_count++;
 
 	return 0;
 
 
--

Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit

Quoted 2 lines

type=OBJ_PID msg=audit(12/10/2007 15:36:54.328:67) : opid=3018 obj=root:system_r:httpd_t:s0-s0:c0.c1023 uid=test comm=loop

Is uid sufficient or do you need auid, gid, euid, suid, fsuid, egid,... as well?

The subject has exe as well as comm.  Should the obj record also have both?