Skip to contentSkip to conversation

Add the checking of key field for a watch or syscall given

PATCH Applied zhangxiliang 2 participants 7 messages Aug 2, 2008 – Aug 5, 2008

Subsystems (2)
Library code Audit
lore
Share & tools
lore

zhangxiliang

author
#0 lore raw

PATCH 4/4 Add the checking of key field for a watch or syscall given

Hello Steve,

When field is AUDIT_FILTERKEY, it should need a watch or syscall given prior to it. So I add checking and error message "-19" to realize it.

Do you agree with me? This is the patches for latest code in audit SVN project.

Signed-off-by Zhang Xiliang <[email protected]>
---
 lib/libaudit.c |    3 +++
 src/auditctl.c |    7 ++++++-
 2 files changed, 9 insertions(+), 1 deletions(-)
lib/libaudit.c +3 -0
index 4d20261..8dd5baa 100644
@@ -75,6 +75,7 @@ static const struct nv_list failure_actions[] =
   { NULL,		0 }
 };
 
+int audit_permadded hidden = 0;
 int audit_archadded hidden = 0;
 int audit_syscalladded hidden = 0;
 unsigned int audit_elf hidden = 0U;

@@ -920,6 +921,8 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair,
 		case AUDIT_SUBJ_SEN:
 		case AUDIT_SUBJ_CLR:
 		case AUDIT_FILTERKEY:
+			if (field == AUDIT_FILTERKEY && !(audit_syscalladded || audit_permadded))
+                                return -19;
 			vlen = strlen(v);
 			if (field == AUDIT_FILTERKEY &&
 					vlen > AUDIT_MAX_KEY_LEN)
src/auditctl.c +6 -1
index 0d38ac1..2c99e09 100644
@@ -67,7 +67,6 @@ enum { OLD, NEW };
 int which;
 static struct audit_rule  rule;
 static struct audit_rule_data *rule_new = NULL;
-int audit_permadded;
 static char key[AUDIT_MAX_KEY_LEN+1];
 static int keylen;
 static int printed;

@@ -77,6 +76,7 @@ static const char key_sep[2] = { AUDIT_KEY_SEPARATOR, 0 };
 extern int audit_archadded;
 extern int audit_syscalladded;
 extern unsigned int audit_elf;
+extern int audit_permadded;
 
 /*
  * This function will reset everything used for each loop when loading 

@@ -799,6 +799,11 @@ static int setopt(int count, char *vars[])
 					"Field %s can not be used with exclude filter list\n", optarg);
 				retval = -1;
 				break;
+			case -19:
+				fprintf(stderr,
+					"Key field needs a watch or syscall given prior to it\n");
+				retval = -1;
+				break;
 			default:
 				retval = -1;
 				break;
Signature · 2 lines
Regards
Zhang Xiliang
#1 lore raw
Quoted 4 lines · On Saturday 02 August 2008 06:16:48 zhangxiliang wrote:

When field is AUDIT_FILTERKEY, it should need a watch or syscall given prior to it. So I add checking and error message "-19" to realize it.

Do you agree with me?

Yes, but where does permadded get set?

Thanks,
-Steve

author
#2 lore raw

Steve Grubb said the following on 2008-08-05 8:06:

Quoted 7 lines · On Saturday 02 August 2008 06:16:48 zhangxiliang wrote:
Quoted 4 lines

When field is AUDIT_FILTERKEY, it should need a watch or syscall given prior to it. So I add checking and error message "-19" to realize it.

Do you agree with me?

Yes, but where does permadded get set?

"permadded" set in "lib/libaudit.c" as follows：
int audit_permadded hidden = 0;
int audit_archadded hidden = 0;
int audit_syscalladded hidden = 0

It declares in "src/auditctl.c" as follows:
extern int audit_permadded;

Quoted 6 lines

Thanks,
-Steve

#3 lore raw
Quoted 11 lines · On Monday 04 August 2008 20:36:37 zhangxiliang wrote:
Quoted 6 lines
Quoted 4 lines

When field is AUDIT_FILTERKEY, it should need a watch or syscall given prior to it. So I add checking and error message "-19" to realize it.

Do you agree with me?

Yes, but where does permadded get set?

"permadded" set in "lib/libaudit.c" as follows：
 int audit_permadded hidden = 0;
 int audit_archadded hidden = 0;
 int audit_syscalladded hidden = 0

Right, but I don't see where it gets set to a 1.

Thanks,
-Steve

author
#4 lore raw

Steve Grubb said the following on 2008-08-05 9:59:

Quoted 3 lines

Right, but I don't see where it gets set to a 1.

Thank you for your suggestion.
I found the audit_permadded is set to 1 in audit_setup_perms() and setopt() after the AUDIT_PERM field. But I think it is not enough.

When the watch is added and AUDIT_PERM is not added, the perm r,w,x,a should be added by kernel default. So I think the audit_permadded should be set to 1 after a watch added.
I make a new patch for it. The "key" patch and new patch should use together.

Subject: [PATCH] When the watch is set, the audit_permadded should be set to 1

Signed-off-by Zhang Xiliang <[email protected]>
---
 lib/libaudit.c |    6 ++++++
 1 files changed, 6 insertions(+), 0 deletions(-)
lib/libaudit.c +6 -0
index 71267de..9a317c5 100644
@@ -580,6 +580,8 @@ int audit_add_watch_dir(int type, struct audit_rule_data **rulep,
 	rule->fieldflags[1] = AUDIT_EQUAL;
 	rule->values[1] = AUDIT_PERM_READ | AUDIT_PERM_WRITE |
 				AUDIT_PERM_EXEC | AUDIT_PERM_ATTR;
+	
+	audit_permadded = 1;
 
 	return  0;
 }

@@ -941,6 +943,10 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair,
 				rule = *rulep;
 			}
 			strncpy(&rule->buf[offset], v, vlen);
+
+			if(flags && (AUDIT_WATCH || AUDIT_DIR))
+				audit_permadded = 1;
+
 			break;
 		case AUDIT_ARCH:
 			if (audit_syscalladded)
Applied
#5 lore raw
Quoted 4 lines · On Tuesday 05 August 2008 02:47:26 zhangxiliang wrote:

When the watch is added and AUDIT_PERM is not added, the perm r,w,x,a should be added by kernel default. So I think the audit_permadded should be set to 1 after a watch added. I make a new patch for it. The "key" patch and new patch should use together.

Applied. Thanks for the patch.

-Steve

Applied
#6 lore raw
In reply to zhangxiliang
Quoted 5 lines · On Saturday 02 August 2008 06:16:48 zhangxiliang wrote:

When field is AUDIT_FILTERKEY, it should need a watch or syscall given prior to it. So I add checking and error message "-19" to realize it.

Do you agree with me? This is the patches for latest code in audit SVN project.

Applied. Thanks for the patch.

-Steve