Fix audit control message checks

PATCH In review Serge E. Hallyn 3 participants 3 messages Jan 15, 2005 – Jan 18, 2005

Subsystems (4)

SELinux security module Security (LSM) Audit Capabilities

lore

Share & tools

lore

Serge E. Hallyn

author

2005-01-15 20:08 UTC #0 lore raw

PATCH 1/1 Fix audit control message checks

The audit control messages are sent over netlink. Permission checks are done on the process receiving the message, which may not be the same as the process sending the message. This patch switches the netlink_send security hooks to calculate the effective capabilities based on the sender. Then audit_receive_msg performs capability checks based on that.

It also introduces the CAP_AUDIT_WRITE and CAP_AUDIT_CONTROL capabilities, and replaces the previous CAP_SYS_ADMIN checks in audit code with the appropriate checks.

Please apply.

Changelog:
1/15/2005: Simplified dummy_netlink_send given that dummy now
keeps track of capabilities.
1/14/2005: Many fixes based on feedback from [email protected]
list.
1/14/2005: Removed the netlink_msg_type helper function. 1/07/2005: Swith to using CAP_AUDIT_WRITE and CAP_AUDIT_CONTROL.

thanks,
-serge

Signed-off-by Serge Hallyn <[email protected]>

include/linux/capability.h +4 -0

Index: linux-2.6.10/include/linux/capability.h
===================================================================
@@ -284,6 +284,10 @@ typedef __u32 kernel_cap_t;
 
 #define CAP_LEASE            28
 
+#define CAP_AUDIT_WRITE      29
+
+#define CAP_AUDIT_CONTROL    30
+
 #ifdef __KERNEL__
 /* 
  * Bounding set

kernel/audit.c +46 -7

92 lines not on this page · raw message

kernel/auditsc.c +0 -2

Index: linux-2.6.10/kernel/auditsc.c
===================================================================
@@ -250,8 +250,6 @@ int audit_receive_filter(int type, int p
 		audit_send_reply(pid, seq, AUDIT_LIST, 1, 1, NULL, 0);
 		break;
 	case AUDIT_ADD:
-		if (!capable(CAP_SYS_ADMIN))
-			return -EPERM;
 		if (!(entry = kmalloc(sizeof(*entry), GFP_KERNEL)))
 			return -ENOMEM;
 		if (audit_copy_rule(&entry->rule, data)) {

security/dummy.c +1 -4

Index: linux-2.6.10/security/dummy.c
===================================================================
@@ -685,10 +685,7 @@ static int dummy_sem_semop (struct sem_a
 
 static int dummy_netlink_send (struct sock *sk, struct sk_buff *skb)
 {
-	if (current->euid == 0)
-		cap_raise (NETLINK_CB (skb).eff_cap, CAP_NET_ADMIN);
-	else
-		NETLINK_CB (skb).eff_cap = 0;
+	NETLINK_CB(skb).eff_cap = current->cap_effective;
 	return 0;
 }

security/selinux/hooks.c +13 -5

Index: linux-2.6.10/security/selinux/hooks.c
===================================================================
@@ -3502,12 +3502,20 @@ static inline int selinux_nlmsg_perm(str
 
 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
 {
-	int err = 0;
+	struct task_security_struct *tsec;
+	struct av_decision avd;
+	int err;
 
-	if (capable(CAP_NET_ADMIN))
-		cap_raise (NETLINK_CB (skb).eff_cap, CAP_NET_ADMIN);
-	else
-		NETLINK_CB(skb).eff_cap = 0;
+	err = secondary_ops->netlink_send(sk, skb);
+	if (err)
+		return err;
+	
+	tsec = current->security;
+
+	avd.allowed = 0;
+	(void)avc_has_perm_noaudit(tsec->sid, tsec->sid,
+				SECCLASS_CAPABILITY, ~0, &avd);
+	cap_mask(NETLINK_CB(skb).eff_cap, avd.allowed);
 
 	if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
 		err = selinux_nlmsg_perm(sk, skb);

Stephen Smalley

2005-01-18 13:38 UTC #1 lore raw

Quoted 21 lines · Serge E. Hallyn

The audit control messages are sent over netlink. Permission checks are done on the process receiving the message, which may not be the same as the process sending the message. This patch switches the netlink_send security hooks to calculate the effective capabilities based on the sender. Then audit_receive_msg performs capability checks based on that.
It also introduces the CAP_AUDIT_WRITE and CAP_AUDIT_CONTROL capabilities, and replaces the previous CAP_SYS_ADMIN checks in audit code with the appropriate checks.
Please apply.
Changelog:
1/15/2005: Simplified dummy_netlink_send given that dummy now
keeps track of capabilities.
1/14/2005: Many fixes based on feedback from [email protected]
list.
1/14/2005: Removed the netlink_msg_type helper function. 1/07/2005: Swith to using CAP_AUDIT_WRITE and CAP_AUDIT_CONTROL.

Quoted 4 lines

thanks,
-serge
Signed-off-by Serge Hallyn <[email protected]>

Signed-off-by Stephen Smalley <[email protected]>

Signature · 2 lines

Stephen Smalley <[email protected]>
National Security Agency

Chris Wright

2005-01-18 19:30 UTC #2 lore raw

Quoted 22 lines · * Stephen Smalley ([email protected]) wrote:

Quoted 21 lines · Serge E. Hallyn
The audit control messages are sent over netlink. Permission checks are done on the process receiving the message, which may not be the same as the process sending the message. This patch switches the netlink_send security hooks to calculate the effective capabilities based on the sender. Then audit_receive_msg performs capability checks based on that.
It also introduces the CAP_AUDIT_WRITE and CAP_AUDIT_CONTROL capabilities, and replaces the previous CAP_SYS_ADMIN checks in audit code with the appropriate checks.
Please apply.
Changelog:
1/15/2005: Simplified dummy_netlink_send given that dummy now
keeps track of capabilities.
1/14/2005: Many fixes based on feedback from [email protected]
list.
1/14/2005: Removed the netlink_msg_type helper function. 1/07/2005: Swith to using CAP_AUDIT_WRITE and CAP_AUDIT_CONTROL.

Quoted 6 lines

Quoted 4 lines
thanks,
-serge
Signed-off-by Serge Hallyn <[email protected]>
Signed-off-by Stephen Smalley <[email protected]>

Signed-off-by Chris Wright <[email protected]>

thanks,
-chris

Signature · 1 line

Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net