userspace: audit: ausearch doesn't return entries for AppArmor events that exist in the log

This patch came from our L3 department. AppArmor LSM is logging using the common_lsm_audit() call but the audit userspace parsing code expects to see an SELinux tclass field. This patch doesn't address the lack of support for AppArmor in "aureport --avc". Talking to Seth Arnold, Canonical apparently has patches for this; if this is true perhaps they can post for inclusion.

Based-on-work-by William Preston <[email protected]>

Signed-off-by Tony Jones <[email protected]>

src/ausearch-parse.c 2014-05-21 14:53:55.000000000 +0200 renamed from src/ausearch-parse.c 2014-05-21 14:45:22.000000000 +0200 +8 -11

@@ -1735,17 +1735,15 @@ static int parse_avc(const lnode *n, sea
 
        // Now get the class...its at the end, so we do things different
        str = strstr(term, "tclass=");
-       if (str == NULL) {
-               rc = 9;
-               goto err;
+       if (str) {
+               str += 7;
+               term = strchr(str, ' ');
+               if (term)
+                       *term = 0;
+               an.avc_class = strdup(str);
+               if (term)
+                       *term = ' ';
        }
-       str += 7;
-       term = strchr(str, ' ');
-       if (term)
-               *term = 0;
-       an.avc_class = strdup(str);
-       if (term)
-               *term = ' ';
 
        if (audit_avc_init(s) == 0) {
                alist_append(s->avc, &an);
 
--

Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit

Quoted 6 lines · Tony Jones

This patch came from our L3 department. AppArmor LSM is logging using the common_lsm_audit() call but the audit userspace parsing code expects to see an SELinux tclass field. This patch doesn't address the lack of support for AppArmor in "aureport --avc". Talking to Seth Arnold, Canonical apparently has patches for this; if this is true perhaps they can post for inclusion.

Making the audit tools work with AppArmor generated events has been on my todo list for quite a while, but no patches exist.

I'm surprised that this patch makes ausearch work correctly for AppArmor AVC events. The first thing that parse_avc() does is look for the "avc: " term in the AVCs that SELinux generates. AppArmor's AVCs don't include that string, so an.avc_result and an.avc_perm would not be set, would they?

Quoted 40 lines

Based-on-work-by William Preston <[email protected]>

Signed-off-by Tony Jones <[email protected]>

src/ausearch-parse.c 2014-05-21 14:53:55.000000000 +0200 renamed from src/ausearch-parse.c 2014-05-21 14:45:22.000000000 +0200 +8 -10

@@ -1735,17 +1735,15 @@ static int parse_avc(const lnode *n, sea
 
        // Now get the class...its at the end, so we do things different
        str = strstr(term, "tclass=");
 
-       if (str == NULL) {
-               rc = 9;
-               goto err;
+       if (str) {
+               str += 7;
+               term = strchr(str, ' ');
+               if (term)
+                       *term = 0;
+               an.avc_class = strdup(str);
+               if (term)
+                       *term = ' ';
 
        }
 
-       str += 7;
-       term = strchr(str, ' ');
-       if (term)
-               *term = 0;
-       an.avc_class = strdup(str);
-       if (term)
-               *term = ' ';

        if (audit_avc_init(s) == 0) {
        
                alist_append(s->avc, &an);

--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit

Quoted 7 lines · Tyler Hicks

Quoted 6 lines · Tony Jones

This patch came from our L3 department. AppArmor LSM is logging using the common_lsm_audit() call but the audit userspace parsing code expects to see an SELinux tclass field. This patch doesn't address the lack of support for AppArmor in "aureport --avc". Talking to Seth Arnold, Canonical apparently has patches for this; if this is true perhaps they can post for inclusion.

Quoted 8 lines

Making the audit tools work with AppArmor generated events has been on my todo list for quite a while, but no patches exist.

I'm surprised that this patch makes ausearch work correctly for AppArmor AVC events. The first thing that parse_avc() does is look for the "avc: " term in the AVCs that SELinux generates. AppArmor's AVCs don't include that string, so an.avc_result and an.avc_perm would not be set, would they?

I have a feeling a whole lot of testing is needed for apparmor, smack, tomoyo, or any other LSM besides SE Linux. (Maybe they work fine? I don't know.) Ausearch/report, auparse, and auvirt would all need updating. I'd also suggest sending patches to the ausearch test suite so that it can verify correctness of finding events.

One last area, perhaps the prelude plugin might need some updating as well....but then again the prelude project kind of died any ways.

-Steve

Quoted 40 lines

Quoted 40 lines

Based-on-work-by William Preston <[email protected]>

Signed-off-by Tony Jones <[email protected]>

src/ausearch-parse.c 2014-05-21 14:53:55.000000000 +0200 renamed from src/ausearch-parse.c 2014-05-21 14:45:22.000000000 +0200 +8 -10

@@ -1735,17 +1735,15 @@ static int parse_avc(const lnode *n, sea
 
        // Now get the class...its at the end, so we do things different
        str = strstr(term, "tclass=");
 
-       if (str == NULL) {
-               rc = 9;
-               goto err;
+       if (str) {
+               str += 7;
+               term = strchr(str, ' ');
+               if (term)
+                       *term = 0;
+               an.avc_class = strdup(str);
+               if (term)
+                       *term = ' ';
 
        }
 
-       str += 7;
-       term = strchr(str, ' ');
-       if (term)
-               *term = 0;
-       an.avc_class = strdup(str);
-       if (term)
-               *term = ' ';

        if (audit_avc_init(s) == 0) {
        
                alist_append(s->avc, &an);

--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit

I'm surprised that this patch makes ausearch work correctly for AppArmor AVC events. The first thing that parse_avc() does is look for the "avc: " term in the AVCs that SELinux generates. AppArmor's AVCs don't include that string, so an.avc_result and an.avc_perm would not be set, would they?

Quoted 5 lines · Tyler Hicks

I'm surprised that this patch makes ausearch work correctly for AppArmor AVC events. The first thing that parse_avc() does is look for the "avc: " term in the AVCs that SELinux generates. AppArmor's AVCs don't include that string, so an.avc_result and an.avc_perm would not be set, would they?

That patch does "work" (tested w/ svn trunk).

After I read your comment I
looked at the code and I was confused also as 'avc_result == AVC_UNSET' but find_avc() which checks against UNSET isn't being called, rather the record gets selected for output by 'n = list_get_cur(l)'
[ausearch-match.c:113]. I would need to spend more time to fully
understand what is happening in the code.

Without patch, ausearch just outputs "<no matches>"

Yep. So, the question is really how to fix this. Should we have a different function that is swung in with #ifdef WITH_APPARMOR called parse_aa_avc? Then it can be tuned exactly for AppArmor's needs? Later, the kernel event number can be changed and the switch/case can pick that up. Also, are there other AA events that are missing in action? The ausearch-test should tell you.

This patch came from our L3 department. AppArmor LSM is logging using the common_lsm_audit() call but the audit userspace parsing code expects to see an SELinux tclass field. This patch doesn't address the lack of support for AppArmor in "aureport --avc". Talking to Seth Arnold, Canonical apparently has patches for this; if this is true perhaps they can post for inclusion.

Based-on-work-by William Preston <[email protected]>

Signed-off-by Tony Jones <[email protected]>

src/ausearch-parse.c 2014-05-21 14:53:55.000000000 +0200 renamed from src/ausearch-parse.c 2014-05-21 14:45:22.000000000 +0200 +8 -9

-               goto err;
+       if (str) {
+               str += 7;
+               term = strchr(str, ' ');
+               if (term)
+                       *term = 0;
+               an.avc_class = strdup(str);
+               if (term)
+                       *term = ' ';
        }
-       str += 7;
-       term = strchr(str, ' ');
-       if (term)
-               *term = 0;
-       an.avc_class = strdup(str);
-       if (term)
-               *term = ' ';
 
        if (audit_avc_init(s) == 0) {
                alist_append(s->avc, &an);
 
--

Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit

This patch came from our L3 department. AppArmor LSM is logging using the common_lsm_audit() call but the audit userspace parsing code expects to see an SELinux tclass field. This patch doesn't address the lack of support for AppArmor in "aureport --avc". Talking to Seth Arnold, Canonical apparently has patches for this; if this is true perhaps they can post for inclusion.

Based-on-work-by William Preston <[email protected]>

Signed-off-by Tony Jones <[email protected]>

src/ausearch-parse.c 2014-05-21 14:53:55.000000000 +0200 renamed from src/ausearch-parse.c 2014-05-21 14:45:22.000000000 +0200 +8 -10

@@ -1735,17 +1735,15 @@ static int parse_avc(const lnode *n, sea
 
        // Now get the class...its at the end, so we do things different
        str = strstr(term, "tclass=");
-       if (str == NULL) {
-               rc = 9;
-               goto err;
+       if (str) {
+               str += 7;
+               term = strchr(str, ' ');
+               if (term)
+                       *term = 0;
+               an.avc_class = strdup(str);
+               if (term)
+                       *term = ' ';
        }
-       str += 7;
-       term = strchr(str, ' ');
-       if (term)
-               *term = 0;
-       an.avc_class = strdup(str);
-       if (term)
-               *term = ' ';
 
        if (audit_avc_init(s) == 0) {
                alist_append(s->avc, &an);

Quoted 6 lines · Tony Jones

This patch came from our L3 department. AppArmor LSM is logging using the common_lsm_audit() call but the audit userspace parsing code expects to see an SELinux tclass field. This patch doesn't address the lack of support for AppArmor in "aureport --avc". Talking to Seth Arnold, Canonical apparently has patches for this; if this is true perhaps they can post for inclusion.

Quoted 2 lines

Based-on-work-by William Preston <[email protected]>

Signed-off-by Tony Jones <[email protected]>

I was looking at this patch and was wondering something. Does AppArmor produce AUDIT_AVC events?

If not, how does the code even get into parse_avc? IOW, is there another part of the patch missing in the switch statement that direct AUDIT_APPARMOR_* events into parse_avc?

-Steve

Quoted 18 lines

src/ausearch-parse.c 2014-05-21 14:53:55.000000000 +0200 renamed from src/ausearch-parse.c 2014-05-21 14:45:22.000000000 +0200 +8 -3

@@ -1735,17 +1735,15 @@ static int parse_avc(const lnode *n, sea
 
        // Now get the class...its at the end, so we do things different
        str = strstr(term, "tclass=");
-       if (str == NULL) {
-               rc = 9;
-               goto err;
+       if (str) {
+               str += 7;
+               term = strchr(str, ' ');
+               if (term)
+                       *term = 0;
+               an.avc_class = strdup(str);
+               if (term)
+                       *term = ' ';
        }

src/ausearch-parse.c 2014-05-21 14:53:55.000000000 +0200 static int parse_avc(const lnode *n, sea · line 1749

Quoted 10 lines

src/ausearch-parse.c 2014-05-21 14:53:55.000000000 +0200 renamed from src/ausearch-parse.c 2014-05-21 14:45:22.000000000 +0200 +0 -7

-       str += 7;
-       term = strchr(str, ' ');
-       if (term)
-               *term = 0;
-       an.avc_class = strdup(str);
-       if (term)
-               *term = ' ';
 
        if (audit_avc_init(s) == 0) {
                alist_append(s->avc, &an);

--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit

Quoted 12 lines · Steve Grubb

Quoted 11 lines · Tony Jones

This patch came from our L3 department. AppArmor LSM is logging using the
common_lsm_audit() call but the audit userspace parsing code expects to see
an SELinux tclass field. This patch doesn't address the lack of support for
AppArmor in "aureport --avc". Talking to Seth Arnold, Canonical apparently
has patches for this; if this is true perhaps they can post for inclusion.

Quoted 5 lines

Quoted 2 lines

Based-on-work-by William Preston <[email protected]>

Signed-off-by Tony Jones <[email protected]>

I was looking at this patch and was wondering something. Does AppArmor produce AUDIT_AVC events?

It does. Here's an odd ball that I picked out of my audit log:

type=AVC msg=audit(1400295012.391:11143): apparmor="DENIED" operation="mount" info="failed type match" profile="lxc-container-default" name="/sys/fs/cgroup/systemd/" pid=15761 comm="mount" fstype="cgroup" srcname="systemd" flags="rw, nosuid, nodev, noexec"

Quoted 3 lines

If not, how does the code even get into parse_avc? IOW, is there another part of the patch missing in the switch statement that direct AUDIT_APPARMOR_* events into parse_avc?

As you can see above, they already flow through parse_avc().

I spent a little time today getting a patch together to parse the 'apparmor="DENIED" operation="mount"' portion parsed to fill an.avc_result and an.avc_perm.

It worked well with ausearch and aureport during some quick manual testing. I'd like to do some more testing next week and, hopefully, add some automated tests before I send it to the list.

This is a big mistake, IMHO. In theory, this is what should have happened:
An access decisionl event should have been named in the 1500 block. It would
then be free to include the field it needs in the order it needs. The ausearch would get a function parse_aa_decision. That function would stuff a struct specially tuned for AA usage. Aureport would gain a new report.

Quoted 13 lines · Tyler Hicks

Quoted 12 lines · Steve Grubb

Quoted 11 lines · Tony Jones

This patch came from our L3 department. AppArmor LSM is logging using the
common_lsm_audit() call but the audit userspace parsing code expects to see
an SELinux tclass field. This patch doesn't address the lack of support for
AppArmor in "aureport --avc". Talking to Seth Arnold, Canonical apparently
has patches for this; if this is true perhaps they can post for inclusion.

Quoted 7 lines

Quoted 5 lines

Quoted 2 lines

Based-on-work-by William Preston <[email protected]>

Signed-off-by Tony Jones <[email protected]>

I was looking at this patch and was wondering something. Does AppArmor produce AUDIT_AVC events?

It does. Here's an odd ball that I picked out of my audit log:

Uh-oh. I gave out the 1500 - 1599 block of events to App Armor so that this problem would never happen.

libaudit.h:
#define AUDIT_FIRST_SELINUX 1400
#define AUDIT_LAST_SELINUX 1499
#define AUDIT_FIRST_APPARMOR 1500
#define AUDIT_LAST_APPARMOR 1599

When you have an event of the same number, it has to have the same fields in the same order with same value representation. As you can see the reporting tools is sensitive to this because they are optimized to handle huge log files. Hmmm....

Quoted 9 lines

type=AVC msg=audit(1400295012.391:11143): apparmor="DENIED" operation="mount" info="failed type match" profile="lxc-container-default" name="/sys/fs/cgroup/systemd/" pid=15761 comm="mount" fstype="cgroup" srcname="systemd" flags="rw, nosuid, nodev, noexec"

Quoted 3 lines

If not, how does the code even get into parse_avc? IOW, is there another part of the patch missing in the switch statement that direct AUDIT_APPARMOR_* events into parse_avc?

As you can see above, they already flow through parse_avc().

This is a big mistake, IMHO. In theory, this is what should have happened:
An access decisionl event should have been named in the 1500 block. It would
then be free to include the field it needs in the order it needs. The ausearch would get a function parse_aa_decision. That function would stuff a struct specially tuned for AA usage. Aureport would gain a new report.

Quoted 4 lines

I spent a little time today getting a patch together to parse the 'apparmor="DENIED" operation="mount"' portion parsed to fill an.avc_result and an.avc_perm.

Quoted 3 lines

It worked well with ausearch and aureport during some quick manual testing. I'd like to do some more testing next week and, hopefully, add some automated tests before I send it to the list.

Well...I wished it had been clear a long time ago that the 1500 block was free to do anything with for AA's needs so we don't overload the usage. Not sure what to do about this.

Quoted 22 lines · Steve Grubb

Quoted 13 lines · Tyler Hicks

Quoted 12 lines · Steve Grubb

Quoted 11 lines · Tony Jones

This patch came from our L3 department. AppArmor LSM is logging using the
common_lsm_audit() call but the audit userspace parsing code expects to see
an SELinux tclass field. This patch doesn't address the lack of support for
AppArmor in "aureport --avc". Talking to Seth Arnold, Canonical apparently
has patches for this; if this is true perhaps they can post for inclusion.

Quoted 7 lines

Quoted 5 lines

Quoted 2 lines

Based-on-work-by William Preston <[email protected]>

Signed-off-by Tony Jones <[email protected]>

I was looking at this patch and was wondering something. Does AppArmor produce AUDIT_AVC events?

It does. Here's an odd ball that I picked out of my audit log:

Quoted 8 lines

Uh-oh. I gave out the 1500 - 1599 block of events to App Armor so that this problem would never happen.

libaudit.h:
#define AUDIT_FIRST_SELINUX 1400
#define AUDIT_LAST_SELINUX 1499
#define AUDIT_FIRST_APPARMOR 1500
#define AUDIT_LAST_APPARMOR 1599

I wasn't involved with AppArmor when it was going through upstream acceptance reviews, but I've asked around to get the history.

As Tony mentioned, AppArmor was originally using the 1500-1599 block. At some point (I couldn't find it in the list archives), it was said that AppArmor needs to use common_lsm_audit() which unconditionally uses AUDIT_AVC.

[Added Eric to cc]

Quoted 32 lines · Steve Grubb

Quoted 22 lines · Tyler Hicks

Quoted 13 lines · Steve Grubb

Quoted 12 lines · Tony Jones

Quoted 11 lines

This patch came from our L3 department. AppArmor LSM is logging using the
common_lsm_audit() call but the audit userspace parsing code expects to see
an SELinux tclass field. This patch doesn't address the lack of support for
AppArmor in "aureport --avc". Talking to Seth Arnold, Canonical apparently
has patches for this; if this is true perhaps they can post for inclusion.

Quoted 7 lines

Quoted 5 lines

Quoted 2 lines

Based-on-work-by William Preston <[email protected]>

Signed-off-by Tony Jones <[email protected]>

I was looking at this patch and was wondering something. Does AppArmor produce AUDIT_AVC events?

It does. Here's an odd ball that I picked out of my audit log:

Quoted 8 lines

Uh-oh. I gave out the 1500 - 1599 block of events to App Armor so that this problem would never happen.

libaudit.h:
#define AUDIT_FIRST_SELINUX 1400
#define AUDIT_LAST_SELINUX 1499
#define AUDIT_FIRST_APPARMOR 1500
#define AUDIT_LAST_APPARMOR 1599

Quoted 7 lines

I wasn't involved with AppArmor when it was going through upstream acceptance reviews, but I've asked around to get the history.

As Tony mentioned, AppArmor was originally using the 1500-1599 block. At some point (I couldn't find it in the list archives), it was said that AppArmor needs to use common_lsm_audit() which unconditionally uses AUDIT_AVC.

I found the review that caused AppArmor to switch to the common LSM audit function:

https://lkml.org/lkml/2009/11/9/232

That email is almost 5 years old and minds can change over that time, but Eric seemed to be against adding new audit event types for each LSM. Instead, he wanted a lsm=<LSM> pair to be included in the message.

AppArmor can accommodate either approach so I think Steve and Eric ought to come to an agreement on what non-SELinux LSMs should do when auditing.

Tyler

--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit

Quoted 1 line · Tyler Hicks

[Added Eric to cc]

You didn't actually add Eric to the Cc: Adding him.

Quoted 65 lines · Tyler Hicks

Quoted 32 lines · Steve Grubb

Quoted 22 lines · Tyler Hicks

Quoted 13 lines · Steve Grubb

Quoted 12 lines · Tony Jones

Quoted 11 lines

This patch came from our L3 department. AppArmor LSM is logging using the
common_lsm_audit() call but the audit userspace parsing code expects to see
an SELinux tclass field. This patch doesn't address the lack of support for
AppArmor in "aureport --avc". Talking to Seth Arnold, Canonical apparently
has patches for this; if this is true perhaps they can post for inclusion.

Quoted 7 lines

Quoted 5 lines

Quoted 2 lines

Based-on-work-by William Preston <[email protected]>

Signed-off-by Tony Jones <[email protected]>

I was looking at this patch and was wondering something. Does AppArmor produce AUDIT_AVC events?

It does. Here's an odd ball that I picked out of my audit log:

Quoted 8 lines

Uh-oh. I gave out the 1500 - 1599 block of events to App Armor so that this problem would never happen.

libaudit.h:
#define AUDIT_FIRST_SELINUX 1400
#define AUDIT_LAST_SELINUX 1499
#define AUDIT_FIRST_APPARMOR 1500
#define AUDIT_LAST_APPARMOR 1599

Quoted 7 lines

I wasn't involved with AppArmor when it was going through upstream acceptance reviews, but I've asked around to get the history.

As Tony mentioned, AppArmor was originally using the 1500-1599 block. At some point (I couldn't find it in the list archives), it was said that AppArmor needs to use common_lsm_audit() which unconditionally uses AUDIT_AVC.

I found the review that caused AppArmor to switch to the common LSM audit function:

https://lkml.org/lkml/2009/11/9/232

That email is almost 5 years old and minds can change over that time, but Eric seemed to be against adding new audit event types for each LSM. Instead, he wanted a lsm=<LSM> pair to be included in the message.

AppArmor can accommodate either approach so I think Steve and Eric ought to come to an agreement on what non-SELinux LSMs should do when auditing.

Tyler

--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit