Audit: add session id to audit messages
Subsystems (4)
Eric Paris
maintainerPATCH 1/1 Audit: add session id to audit messages
In order to correlate audit records to an individual login add a session id. This is incremented every time a user logs in and is included in almost all messages which currently output the auid. The field is labeled ses= or oses=
---
This patch does not currently implement sessionid information for audit messages generated from netlink messages. That means no sessionid will be found in things like userspace generated audit messages, audit system configuration changes, or changes to labeled networking. A patch to support those messages (and the requisite changes to netlink) will be forthcoming.
This patch applies on top of the previous OBJ_PID record changes.
Example records:
type=LOGIN msg=audit(1197663142.722:137): login pid=2764 uid=0 old auid=0 new auid=0 old ses=1 new ses=13
type=SYSCALL msg=audit(1197665485.338:142): arch=c000003e syscall=62 success=yes exit=0 a0=1 a1=f a2=0 a3=0 items=0 ppid=2184 pid=2189 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=13 comm="bash" exe="/bin/bash" subj=root:system_r:unconfined_t:s0-s0:c0.c1023 key=(null) type=OBJ_PID msg=audit(1197665485.338:142): opid=1 oauid=-1 ouid=0 oses=-1 obj=system_u:system_r:init_t:s0 ocomm="init"
drivers/char/tty_audit.c | 21 +++++++++++----- include/linux/audit.h | 2 + kernel/auditsc.c | 50 ++++++++++++++++++++++++++++++++-------- net/core/dev.c | 5 ++- security/selinux/selinuxfs.c | 17 ++++++++----- security/selinux/ss/services.c | 5 ++- 6 files changed, 72 insertions(+), 28 deletions(-)
drivers/char/tty_audit.c +14 -7
@@ -73,7 +73,7 @@ static void tty_audit_buf_put(struct tty_audit_buf *buf)* @tsk with @loginuid. @buf->mutex must be locked. */ static void tty_audit_buf_push (struct task_struct *tsk,uid_t loginuid, -struct tty_audit_buf *buf) +unsigned int sessionid,struct tty_audit_buf *buf) {struct audit_buffer *ab;
@@ -85,9 +85,9 @@ static void tty_audit_buf_push(struct task_struct *tsk, uid_t loginuid,if (ab) {char name[sizeof (tsk->comm)]; -audit_log_format (ab,"tty pid=%u uid=%u auid=%u major=%d " -"minor=%d comm=" , tsk->pid, tsk->uid, - loginuid, buf->major, buf->minor); +audit_log_format (ab,"tty pid=%u uid=%u auid=%u ses=%u " +"major=%d minor=%d comm=" , tsk->pid, tsk->uid, + loginuid, sessionid, buf->major, buf->minor);get_task_comm (name, tsk);audit_log_untrustedstring (ab, name);audit_log_format (ab," data=" );
@@ -105,8 +105,10 @@ static void tty_audit_buf_push(struct task_struct *tsk, uid_t loginuid,*/ static void tty_audit_buf_push_current (struct tty_audit_buf *buf) { -tty_audit_buf_push (current,audit_get_loginuid (current->audit_context), - buf); +struct audit_context *ctx = current->audit_context; +uid_t auid =audit_get_loginuid (ctx); +unsigned int sessionid =audit_get_sessionid (ctx); +tty_audit_buf_push (current, auid, sessionid, buf); }/**
@@ -152,6 +154,11 @@ void tty_audit_fork(struct signal_struct *sig)void tty_audit_push_task (struct task_struct *tsk,uid_t loginuid) {struct tty_audit_buf *buf; +/* FIXME I think this is correct. Check against netlink once that is +* I really need to read this code more closely. But that's for +* another patch. +*/ +unsigned int sessionid =audit_get_sessionid (tsk->audit_context);spin_lock_irq (&tsk->sighand->siglock); buf = tsk->signal->tty_audit_buf;
@@ -162,7 +169,7 @@ void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid)return ;mutex_lock (&buf->mutex); -tty_audit_buf_push (tsk, loginuid, buf); +tty_audit_buf_push (tsk, loginuid, sessionid, buf);mutex_unlock (&buf->mutex);tty_audit_buf_put (buf);
include/linux/audit.h +2 -0
@@ -408,6 +408,7 @@ extern void auditsc_get_stamp(struct audit_context *ctx, struct timespec *t, unsigned int *serial);extern int audit_set_loginuid (struct task_struct *task,uid_t loginuid);extern uid_t audit_get_loginuid (struct audit_context *ctx); +extern unsigned int audit_get_sessionid (struct audit_context *ctx);extern void audit_log_task_context (struct audit_buffer *ab);extern int __audit_ipc_obj (struct kern_ipc_perm *ipcp);extern int __audit_ipc_set_perm (unsigned long qbytes,uid_t uid,gid_t gid,mode_t mode);
@@ -487,6 +488,7 @@ extern int audit_signals;#define audit_core_dumps (i) do { ; } while (0)#define auditsc_get_stamp (c,t,s) do { BUG(); } while (0)#define audit_get_loginuid (c) ({ -1; }) +#define audit_get_sessionid (c) ({ -1; })#define audit_log_task_context (b) do { ; } while (0)#define audit_ipc_obj (i) ({ 0; })#define audit_ipc_set_perm (q,u,g,m) ({ 0; })
kernel/auditsc.c +40 -10
181 lines not on this page · raw message
net/core/dev.c +3 -2
@@ -2759,10 +2759,11 @@ static void __dev_set_promiscuity(struct net_device *dev, int inc) "left");audit_log (current->audit_context,GFP_ATOMIC ,AUDIT_ANOM_PROMISCUOUS , -"dev=%s prom=%d old_prom=%d auid=%u" , +"dev=%s prom=%d old_prom=%d auid=%u ses=%u" , dev->name, (dev->flags &IFF_PROMISC ), (old_flags &IFF_PROMISC ), -audit_get_loginuid (current->audit_context)); +audit_get_loginuid (current->audit_context), +audit_get_sessionid (current->audit_context));if (dev->change_rx_flags) dev->change_rx_flags (dev,IFF_PROMISC );
security/selinux/selinuxfs.c +10 -7
@@ -158,9 +158,10 @@ static ssize_t sel_write_enforce(struct file * file, const char __user * buf,if (length) goto out;audit_log (current->audit_context,GFP_KERNEL ,AUDIT_MAC_STATUS , -"enforcing=%d old_enforcing=%d auid=%u" , new_value, - selinux_enforcing, -audit_get_loginuid (current->audit_context)); +"enforcing=%d old_enforcing=%d auid=%u ses=%u" , + new_value, selinux_enforcing, +audit_get_loginuid (current->audit_context), +audit_get_sessionid (current->audit_context)); selinux_enforcing = new_value;if (selinux_enforcing)avc_ss_reset (0 );
@@ -229,8 +230,9 @@ static ssize_t sel_write_disable(struct file * file, const char __user * buf,if (length <0 ) goto out;audit_log (current->audit_context,GFP_KERNEL ,AUDIT_MAC_STATUS , -"selinux=0 auid=%u" , -audit_get_loginuid (current->audit_context)); +"selinux=0 auid=%u ses=%u" , +audit_get_loginuid (current->audit_context), +audit_get_sessionid (current->audit_context)); } length = count;
@@ -335,8 +337,9 @@ out1: (security_get_allow_unknown() ? "allow" : "deny")));audit_log (current->audit_context,GFP_KERNEL ,AUDIT_MAC_POLICY_LOAD , -"policy loaded auid=%u" , -audit_get_loginuid (current->audit_context)); +"policy loaded auid=%u ses=%u" , +audit_get_loginuid (current->audit_context), +audit_get_sessionid (current->audit_context)); out:mutex_unlock (&sel_mutex);vfree (data);
security/selinux/ss/services.c +3 -2
@@ -1897,11 +1897,12 @@ int security_set_bools(int len, int *values)if (!!values[i] != policydb.bool_val_to_struct[i]->state) {audit_log (current->audit_context,GFP_ATOMIC ,AUDIT_MAC_CONFIG_CHANGE , -"bool=%s val=%d old_val=%d auid=%u" , +"bool=%s val=%d old_val=%d auid=%u ses=%u" , policydb.p_bool_val_to_name[i], !!values[i], policydb.bool_val_to_struct[i]->state, -audit_get_loginuid (current->audit_context)); +audit_get_loginuid (current->audit_context), +audit_get_sessionid (current->audit_context)); }if (values[i]) { policydb.bool_val_to_struct[i]->state =1 ;
Quoted 4 lines · On Friday 14 December 2007 14:42:30 Eric Paris wrote:
In order to correlate audit records to an individual login add a session id. This is incremented every time a user logs in and is included in almost all messages which currently output the auid. The field is labeled ses= or oses=
I haven't actually compiled and run this patch, but reviewing what its doing looks good to me. ACK.
-Steve