audit: Add new syscalls to the perm=w filter
Subsystems (2)
PATCH 1/1 audit: Add new syscalls to the perm=w filter
The audit subsystem allows selecting audit events based on watches for a particular behavior like writing to a file. A lot of syscalls have been added without updating the list. This patch adds 2 syscalls to the write filters: fallocate and renameat2.
--- include/asm-generic/audit_dir_write.h | 4 ++++ include/asm-generic/audit_write.h | 3 +++ 2 files changed, 7 insertions(+)
include/asm-generic/audit_dir_write.h +4 -0
@@ -30,3 +30,7 @@ __NR_renameat, __NR_linkat, __NR_symlinkat,#endif +#ifdef __NR_renameat2 +__NR_renameat2, +#endif +
include/asm-generic/audit_write.h +3 -0
@@ -19,3 +19,6 @@ __NR_ftruncate64,#ifdef __NR_bind __NR_bind, /* bind can affect fs object only in one way... */#endif +#ifdef __NR_fallocate +__NR_fallocate, +#endif
Signature · 1 line
2.13.6
Quoted 6 lines · Steve Grubb
The audit subsystem allows selecting audit events based on watches for a particular behavior like writing to a file. A lot of syscalls have been added without updating the list. This patch adds 2 syscalls to the write filters: fallocate and renameat2.
Signed-off-by sgrubb <[email protected]>
Quoted 32 lines
--- include/asm-generic/audit_dir_write.h | 4 ++++ include/asm-generic/audit_write.h | 3 +++ 2 files changed, 7 insertions(+)include/asm-generic/audit_dir_write.h +4
-0@@ -30,3 +30,7 @@ __NR_renameat, __NR_linkat, __NR_symlinkat,#endif +#ifdef __NR_renameat2 +__NR_renameat2, +#endif +include/asm-generic/audit_write.h +3
-0@@ -19,3 +19,6 @@ __NR_ftruncate64,#ifdef __NR_bind __NR_bind, /* bind can affect fs object only in one way... */#endif +#ifdef __NR_fallocate +__NR_fallocate, +#endif Signature · 1 line
2.13.6
- RGB
--
Richard Guy Briggs <[email protected]>
Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635
Quoted 9 lines · Richard Guy Briggs
Quoted 6 lines · Steve Grubb
The audit subsystem allows selecting audit events based on watches for a particular behavior like writing to a file. A lot of syscalls have been added without updating the list. This patch adds 2 syscalls to the write filters: fallocate and renameat2.
Signed-off-by sgrubb <[email protected]>Reviewed-by Richard Guy Briggs <[email protected]>
Please add a link to the issue number in the body of the patch description:
See: https://github.com/linux-audit/audit-kernel/issues/67
Quoted 24 lines
Quoted 24 lines
--- include/asm-generic/audit_dir_write.h | 4 ++++ include/asm-generic/audit_write.h | 3 +++ 2 files changed, 7 insertions(+)include/asm-generic/audit_dir_write.h +4
-0@@ -30,3 +30,7 @@ __NR_renameat, __NR_linkat, __NR_symlinkat,#endif +#ifdef __NR_renameat2 +__NR_renameat2, +#endif +include/asm-generic/audit_write.h +0
-0@@ -19,3 +19,6 @@ __NR_ftruncate64,#ifdef __NR_bind __NR_bind, /* bind can affect fs object only in one way... */
Quoted 8 lines
Quoted 6 lines
include/asm-generic/audit_write.h +3
-0#endif +#ifdef __NR_fallocate +__NR_fallocate, +#endif Signature · 1 line
2.13.6- RGB
- RGB
--
Richard Guy Briggs <[email protected]>
Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635
Paul Moore
maintainerQuoted 7 lines · Richard Guy Briggs
Quoted 6 lines · Richard Guy Briggs
Quoted 5 lines · Steve Grubb
The audit subsystem allows selecting audit events based on watches for a particular behavior like writing to a file. A lot of syscalls have been added without updating the list. This patch adds 2 syscalls to the write filters: fallocate and renameat2.
Quoted 7 lines
Quoted 3 lines
Quoted 1 line
Signed-off-by sgrubb <[email protected]>Reviewed-by Richard Guy Briggs <[email protected]>Please add a link to the issue number in the body of the patch description:
FWIW, I don't really care if the upstream issue is included in the submitted patch; if you want to include it - great, if you don't - that's fine too. The commit description needs to stand on its own, regardless of any external issue trackers, mailing lists, etc.
I'm guessing based on your constant reminders that Steve has gotten the message at this point that you would really prefer he added the issue tracker numbers; I'm not sure you need to keep mentioning it. ;)
Quoted 46 lines
Quoted 24 lines
Quoted 24 lines
--- include/asm-generic/audit_dir_write.h | 4 ++++ include/asm-generic/audit_write.h | 3 +++ 2 files changed, 7 insertions(+)include/asm-generic/audit_dir_write.h +4
-0@@ -30,3 +30,7 @@ __NR_renameat, __NR_linkat, __NR_symlinkat,#endif +#ifdef __NR_renameat2 +__NR_renameat2, +#endif +include/asm-generic/audit_write.h +0
-0@@ -19,3 +19,6 @@ __NR_ftruncate64,#ifdef __NR_bind __NR_bind, /* bind can affect fs object only in one way... */Quoted 8 lines
Quoted 6 lines
include/asm-generic/audit_write.h +3
-1#endif +#ifdef __NR_fallocate +__NR_fallocate, +#endif --2.13.6
- RGB
- RGB
--
Richard Guy Briggs <[email protected]>
Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
Signature · 2 lines
paul moore www.paul-moore.com
Quoted 12 lines · EDT Paul Moore
Quoted 12 lines
Quoted 8 lines
Quoted 6 lines
The audit subsystem allows selecting audit events based on watches for a particular behavior like writing to a file. A lot of syscalls have been added without updating the list. This patch adds 2 syscalls to the write filters: fallocate and renameat2.
Signed-off-by sgrubb <[email protected]>Reviewed-by Richard Guy Briggs <[email protected]>Please add a link to the issue number in the body of the patch description:
Quoted 6 lines
Quoted 1 line
FWIW, I don't really care if the upstream issue is included in the submitted patch; if you want to include it - great, if you don't - that's fine too. The commit description needs to stand on its own, regardless of any external issue trackers, mailing lists, etc.
I honestly don't know what the protocol is here. Should I resend the patch with that or is that fixed up in the merge process? The reason I ask is on the user space side I never make anyone resend a patch unless its grossly wrong or incomplete. I just fix it. But that's what I do and not everyone works that way.
Quoted 3 lines
I'm guessing based on your constant reminders that Steve has gotten the message at this point that you would really prefer he added the issue tracker numbers;
I get it, but in the case of the bind/unbind I didn't even know there was a tracker.
-Steve
Paul Moore
maintainerQuoted 20 lines · Steve Grubb
Quoted 12 lines · EDT Paul Moore
Quoted 12 lines
Quoted 8 lines
Quoted 6 lines
The audit subsystem allows selecting audit events based on watches for a particular behavior like writing to a file. A lot of syscalls have been added without updating the list. This patch adds 2 syscalls to the write filters: fallocate and renameat2.
Signed-off-by sgrubb <[email protected]>Reviewed-by Richard Guy Briggs <[email protected]>Please add a link to the issue number in the body of the patch description:
Quoted 6 lines
Quoted 1 line
FWIW, I don't really care if the upstream issue is included in the submitted patch; if you want to include it - great, if you don't - that's fine too. The commit description needs to stand on its own, regardless of any external issue trackers, mailing lists, etc.
Quoted 5 lines
I honestly don't know what the protocol is here. Should I resend the patch with that or is that fixed up in the merge process? The reason I ask is on the user space side I never make anyone resend a patch unless its grossly wrong or incomplete. I just fix it. But that's what I do and not everyone works that way.
It really depends on the situation, there is no strict rule to follow, although if I'm expecting you to respin a patch I'll let you know. In the comment above I said that I didn't care either way (about the GH issue), that means you don't need to worry about it. I also said I'd fixup your sign-off line when I apply the patch, there is no need to respin, although you do need to fix that from this point on (future new patches as well as any I ask you to respin).
In general, heavy editing by the maintainer is discouraged; exceptions are made for merge fuzz, trivial fixes, agreed upon tweaks, etc. There is also a bit of a human factor if we are truly honest, but I try to minimize that as much as possible (am I in a good mood and wiling to fix the code? has the contributor annoyed me lately? etc.). At the end of the day, every maintainer is a bit different.
Signature · 2 lines
paul moore www.paul-moore.com
Paul Moore
maintainerQuoted 10 lines · Steve Grubb
The audit subsystem allows selecting audit events based on watches for a particular behavior like writing to a file. A lot of syscalls have been added without updating the list. This patch adds 2 syscalls to the write filters: fallocate and renameat2.
Signed-off-by sgrubb <[email protected]>--- include/asm-generic/audit_dir_write.h | 4 ++++ include/asm-generic/audit_write.h | 3 +++ 2 files changed, 7 insertions(+)
FWIW, I expect that this syscall list is almost always going to be out of date; it's just the way this feature is designed. That doesn't mean I'm not going to merge fixes, I just want to make sure expectations are set accordingly.
Before I merge this Steve, can you explain why fallocate() should be on the write list? It doesn't actually write any user data to disk, it actually doesn't write anything, all it does is play with the amount of space allocated for the given fd on the storage device. I don't really care either way, this just struck me as odd and I want to make sure you have a good reason (hint: add it to the patch description).
Quoted 23 lines
include/asm-generic/audit_dir_write.h +4
-0@@ -30,3 +30,7 @@ __NR_renameat, __NR_linkat, __NR_symlinkat,#endif +#ifdef __NR_renameat2 +__NR_renameat2, +#endif +include/asm-generic/audit_write.h +3
-0@@ -19,3 +19,6 @@ __NR_ftruncate64,#ifdef __NR_bind __NR_bind, /* bind can affect fs object only in one way... */#endif +#ifdef __NR_fallocate +__NR_fallocate, +#endif
Signature · 2 lines
paul moore www.paul-moore.com
Paul Moore
maintainerQuoted 17 lines · Paul Moore
Quoted 10 lines · Steve Grubb
The audit subsystem allows selecting audit events based on watches for a particular behavior like writing to a file. A lot of syscalls have been added without updating the list. This patch adds 2 syscalls to the write filters: fallocate and renameat2.
Signed-off-by sgrubb <[email protected]>--- include/asm-generic/audit_dir_write.h | 4 ++++ include/asm-generic/audit_write.h | 3 +++ 2 files changed, 7 insertions(+)FWIW, I expect that this syscall list is almost always going to be out of date; it's just the way this feature is designed. That doesn't mean I'm not going to merge fixes, I just want to make sure expectations are set accordingly.
Quoted 7 lines
Before I merge this Steve, can you explain why
fallocate()should be on the write list? It doesn't actually write any user data to disk, it actually doesn't write anything, all it does is play with the amount of space allocated for the given fd on the storage device. I don't really care either way, this just struck me as odd and I want to make sure you have a good reason (hint: add it to the patch description).
Oh, one more thing; it's administrative and not tied to a particular patch ... there is no need to add write "PATCH 1/1" when there is just one patch, a simple "PATCH" is sufficient. The extra "1/1" just adds a bit of extra work as I need to clean it up before merging; it's not a big deal, but if I still see you doing it a month from now I may have to get a bit salty ;)
Signature · 2 lines
paul moore www.paul-moore.com
Paul Moore
maintainerQuoted 8 lines · Paul Moore
Quoted 7 lines · Paul Moore
Quoted 6 lines · Steve Grubb
The audit subsystem allows selecting audit events based on watches for a particular behavior like writing to a file. A lot of syscalls have been added without updating the list. This patch adds 2 syscalls to the write filters: fallocate and renameat2.
Signed-off-by sgrubb <[email protected]>
One more one more thing ;)
You are supposed to use your "Full Name" and not a username, see Documentation/process/5.Posting.rst
for more information. I'm going to go ahead and substitute "Steve
Grubb" because that is how you are sending your emails, but please correct this in the future; sign-off lines are very important.
Quoted 24 lines
Quoted 10 lines
Quoted 4 lines
--- include/asm-generic/audit_dir_write.h | 4 ++++ include/asm-generic/audit_write.h | 3 +++ 2 files changed, 7 insertions(+)FWIW, I expect that this syscall list is almost always going to be out of date; it's just the way this feature is designed. That doesn't mean I'm not going to merge fixes, I just want to make sure expectations are set accordingly.
Quoted 7 lines
Before I merge this Steve, can you explain why
fallocate()should be on the write list? It doesn't actually write any user data to disk, it actually doesn't write anything, all it does is play with the amount of space allocated for the given fd on the storage device. I don't really care either way, this just struck me as odd and I want to make sure you have a good reason (hint: add it to the patch description).Oh, one more thing; it's administrative and not tied to a particular patch ... there is no need to add write "PATCH 1/1" when there is just one patch, a simple "PATCH" is sufficient. The extra "1/1" just adds a bit of extra work as I need to clean it up before merging; it's not a big deal, but if I still see you doing it a month from now I may have to get a bit salty ;)
Signature · 2 lines
paul moore www.paul-moore.com
Quoted 9 lines · EDT Paul Moore
Quoted 8 lines · Steve Grubb
The audit subsystem allows selecting audit events based on watches for a particular behavior like writing to a file. A lot of syscalls have been added without updating the list. This patch adds 2 syscalls to the write filters: fallocate and renameat2.
Signed-off-by sgrubb <[email protected]>---
Quoted 8 lines
Quoted 3 lines
include/asm-generic/audit_dir_write.h | 4 ++++ include/asm-generic/audit_write.h | 3 +++ 2 files changed, 7 insertions(+)FWIW, I expect that this syscall list is almost always going to be out of date; it's just the way this feature is designed. That doesn't mean I'm not going to merge fixes, I just want to make sure expectations are set accordingly.
I understand...but we are years behind. I just wanted to close the gap on a couple obvious syscalls since everyone else is busy with more important bugs. I have not done an indepth review, so there may still be others. For example, do we consider time stamp of a file one of its attributes? If so, then utimensat may need to be brought in. I also have no idea what to make of name_to_handle_at and open_by_handle_at.
Quoted 2 lines
Before I merge this Steve, can you explain why
fallocate()should be on the write list?
Its a whole lot like ftruncate.
$ touch gh $ ls -l gh -rw-rw-r--. 1 sgrubb sgrubb 0 Oct 16 16:21 gh
strace fallocate -o 0 -l 1024 -z gh
<snip>open("gh", O_RDWR) = 3fallocate(3, FALLOC_FL_ZERO_RANGE, 0, 1024) = 0
fsync(3) = 0
close(3) = 0
<snip>
$ ls -l gh -rw-rw-r--. 1 sgrubb sgrubb 1024 Oct 16 16:21 gh
File went from 0 bytes to 1024 bytes.
Quoted 3 lines
It doesn't actually write any user data to disk, it actually doesn't write anything, all it does is play with the amount of space allocated for the given fd on the storage device.
It has a bunch of flags which can zeroize holes or extents.
Quoted 3 lines
I don't really care either way, this just struck me as odd and I want to make sure you have a good reason (hint: add it to the patch description).
Understandable. But its close enough to ftruncate that I think it qualifies.
-Steve
Quoted 29 lines
Quoted 29 lines
(quoted diff) +0
-0
b/include/asm-generic/audit_dir_write.hindex7b61db4fe72b..d9a53eaeea35100644include/asm-generic/audit_dir_write.h +4
-0@@ -30,3 +30,7 @@ __NR_renameat, __NR_linkat, __NR_symlinkat,#endif +#ifdef __NR_renameat2 +__NR_renameat2, +#endif +(quoted diff) +0
-0
b/include/asm-generic/audit_write.hindex274575d7129f..4fa65816acd3100644include/asm-generic/audit_write.h +3
-0@@ -19,3 +19,6 @@ __NR_ftruncate64,#ifdef __NR_bind __NR_bind, /* bind can affect fs object only in one way... */#endif +#ifdef __NR_fallocate +__NR_fallocate, +#endif
Paul Moore
maintainerQuoted 14 lines · Steve Grubb
Quoted 13 lines · EDT Paul Moore
Quoted 11 lines · Steve Grubb
The audit subsystem allows selecting audit events based on watches for a particular behavior like writing to a file. A lot of syscalls have been added without updating the list. This patch adds 2 syscalls to the write filters: fallocate and renameat2.
Signed-off-by sgrubb <[email protected]>---
include/asm-generic/audit_dir_write.h | 4 ++++ include/asm-generic/audit_write.h | 3 +++ 2 files changed, 7 insertions(+)
Quoted 7 lines
Quoted 4 lines
FWIW, I expect that this syscall list is almost always going to be out of date; it's just the way this feature is designed. That doesn't mean I'm not going to merge fixes, I just want to make sure expectations are set accordingly.
I understand...but we are years behind. I just wanted to close the gap on a couple obvious syscalls since everyone else is busy with more important bugs.
No worries, I'm perfectly fine with chipping away at things, I just wanted to make sure that people aren't expecting this to be current. The way it's designed I can almost guarantee it will always lag.
Quoted 5 lines
Quoted 3 lines
I don't really care either way, this just struck me as odd and I want to make sure you have a good reason (hint: add it to the patch description).
Understandable. But its close enough to ftruncate that I think it qualifies.
That's fine, I didn't feel very strongly about it either way. I'll merge this tomorrow when I'm back in front of the system with my audit kernel repo.
Signature · 2 lines
paul moore www.paul-moore.com
Quoted 31 lines · Paul Moore
Quoted 14 lines · Steve Grubb
Quoted 13 lines · EDT Paul Moore
Quoted 11 lines · Steve Grubb
The audit subsystem allows selecting audit events based on watches for a particular behavior like writing to a file. A lot of syscalls have been added without updating the list. This patch adds 2 syscalls to the write filters: fallocate and renameat2.
Signed-off-by sgrubb <[email protected]>---
include/asm-generic/audit_dir_write.h | 4 ++++ include/asm-generic/audit_write.h | 3 +++ 2 files changed, 7 insertions(+)Quoted 7 lines
Quoted 4 lines
FWIW, I expect that this syscall list is almost always going to be out of date; it's just the way this feature is designed. That doesn't mean I'm not going to merge fixes, I just want to make sure expectations are set accordingly.
I understand...but we are years behind. I just wanted to close the gap on a couple obvious syscalls since everyone else is busy with more important bugs.
No worries, I'm perfectly fine with chipping away at things, I just wanted to make sure that people aren't expecting this to be current. The way it's designed I can almost guarantee it will always lag.
Quoted 4 lines
Quoted 3 lines
I don't really care either way, this just struck me as odd and I want to make sure you have a good reason (hint: add it to the patch description).
Quoted 5 lines
Quoted 1 line
Understandable. But its close enough to ftruncate that I think it qualifies.
That's fine, I didn't feel very strongly about it either way. I'll merge this tomorrow when I'm back in front of the system with my audit kernel repo.
Merged into audit/next.
Signature · 2 lines
paul moore www.paul-moore.com