audit: implement container identifier
Subsystems (13)
v10 cover audit: implement container identifier
Implement kernel audit container identifier.
This patchset is an eighth based on the proposal document (V4) posted:
https://www.redhat.com/archives/linux-audit/2019-September/msg00052.html
The first patch was the last patch from ghak81 that was absorbed into this patchset since its primary justification is the rest of this patchset. It abstracts the audit kernel internal api to be able to better regulate audit operations.
The second patch implements the proc fs write to set the audit container identifier of a process, emitting an AUDIT_CONTAINER_OP record to announce the registration of that audit container identifier on that process. The ID can be read from the same file. This patch requires userspace support for record acceptance and proper type display. The ID is stored as an object that includes owner information to check for descendancy, allow process injection into a container and prevent id reuse by other orchestrators. The same record type is emitted once all tasks using that audit container identifier have exited.
The 3rd implements the auxiliary record AUDIT_CONTAINER_ID if an audit container identifier is associated with an event. This patch requires userspace support for proper type display.
The 4th adds audit daemon signalling provenance through audit_sig_info2.
The 5th creates a local audit context to be able to bind a standalone record with a locally created auxiliary record.
The 6th patch adds audit container identifier records to the user standalone records.
The 7th adds audit container identifier filtering to the exit, exclude and user lists. This patch adds the AUDIT_CONTID field and requires auditctl userspace support for the --contid option.
The 8th adds network namespace audit container identifier labelling based on member tasks' audit container identifier labels which supports standalone netfilter records that don't have a task context and lists each container to which that net namespace belongs.
The 9th checks that the target is a descendant for nesting and refactors to avoid a duplicate of the copied function.
The 10th adds tracking and reporting for container nesting. This enables kernel filtering and userspace searches of nested audit container identifiers.
The 11th adds a mechanism to allow a process to be designated as a container orchestrator/engine in non-init user namespaces.
Example: Set an audit container identifier of 123456 to the "sleep" task:
sleep 2&
child=$!
echo 123456 > /proc/$child/audit_containerid; echo $? ausearch -ts recent -i -m container_op
echo child:$child contid:$( cat /proc/$child/audit_containerid)
This should produce an event such as:
type=PROCTITLE msg=audit(2020-11-26 11:03:36.566:174604) : proctitle=-bash
type=SYSCALL msg=audit(2020-11-26 11:03:36.566:174604) : arch=x86_64 syscall=write success=no exit=ENOTUNIQ(Name not unique on network) a0=0x1 a1=0x55cf347b27c0a2=0x7 a3=0x55cf3480ded0 items=0 ppid=483 pid=507 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=bash exe=/usr/bin/bash subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) type=CONTAINER_OP msg=audit(2020-11-26 11:03:36.566:174604) : op=set opid=9069 contid=123456 old-contid=unset
Example: Set a filter on an audit container identifier 123459 on /tmp/tmpcontainerid:
contid=123459
key=tmpcontainerid
auditctl -a exit,always -F dir=/tmp -F perm=wa -F contid=$contid -F key=$key perl -e "sleep 1; open(my \$tmpfile, '>', \"/tmp/$key\"); close(\$tmpfile);" & child=$!
echo $contid > /proc/$child/audit_containerid
sleep 2
ausearch -i -ts recent -k $key
auditctl -d exit,always -F dir=/tmp -F perm=wa -F contid=$contid -F key=$key rm -f /tmp/$key
This should produce an event such as:
type=CONTAINER_ID msg=audit(2020-11-26 12:46:31.707:26953) : record=1 contid=123459 type=PROCTITLE msg=audit(2020-11-26 12:46:31.707:26953) : proctitle=perl -e sleep 1; open(my $tmpfile, '>', "/tmp/tmpcontainerid"); close($tmpfile); type=PATH msg=audit(2020-11-26 12:46:31.707:26953) : item=1 name=/tmp/tmpcontainerid inode=25656 dev=00:26 mode=file,644 ouid=root ogid=root rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 type=PATH msg=audit(2020-11-26 12:46:31.707:26953) : item=0 name=/tmp/ inode=8985 dev=00:26 mode=dir,sticky,777 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:tmp_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 type=CWD msg=audit(2020-11-26 12:46:31.707:26953) : cwd=/root type=SYSCALL msg=audit(2020-11-26 12:46:31.707:26953) : arch=x86_64 syscall=openat success=yes exit=3 a0=0xffffffffffffff9c a1=0x5621f2b81900 a2=O_WRONLY|O_CREAT|O_TRUNC a3=0x1b6 items=2 ppid=628 pid=2232 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=perl exe=/usr/bin/perl subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=tmpcontainerid record=1
Example: Test multiple containers on one netns:
sleep 5 & child1=$! containerid1=123451 echo $containerid1 > /proc/$child1/audit_containerid sleep 5 & child2=$! containerid2=123452 echo $containerid2 > /proc/$child2/audit_containerid iptables -I INPUT -i lo -p icmp --icmp-type echo-request -j AUDIT --type accept iptables -I INPUT -t mangle -i lo -p icmp --icmp-type echo-request -j MARK --set-mark 0x12345555 sleep 1; bash -c "ping -q -c 1 127.0.0.1 >/dev/null 2>&1" sleep 1; ausearch -i -m NETFILTER_PKT -ts boot|grep mark=0x12345555 ausearch -i -m NETFILTER_PKT -ts boot|grep contid=|grep $containerid1|grep $containerid2
This would produce an event such as:
type=NETFILTER_PKT msg=audit(2020-11-26 14:16:13.369:244) : mark=0x12345555 saddr=127.0.0.1 daddr=127.0.0.1 proto=icmp record=1 type=CONTAINER_ID msg=audit(2020-11-26 14:16:13.369:244) : record=1 contid=123452,123451
Includes the last patch of https://github.com/linux-audit/audit-kernel/issues/81
Please see the github audit kernel issue for the main feature:
https://github.com/linux-audit/audit-kernel/issues/90
and the kernel filter code:
https://github.com/linux-audit/audit-kernel/issues/91
and the network support:
https://github.com/linux-audit/audit-kernel/issues/92
Please see the github audit userspace issue for supporting record types:
https://github.com/linux-audit/audit-userspace/issues/51
and filter code:
https://github.com/linux-audit/audit-userspace/issues/40
Please see the github audit testsuiite issue for the test case:
https://github.com/linux-audit/audit-testsuite/issues/64
https://github.com/rgbriggs/audit-testsuite/tree/ghat64-contid
https://githu.com/linux-audit/audit-testsuite/pull/91
Please see the github audit wiki for the feature overview:
https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID
The code is also posted at:
git://toccata2.tricolour.ca/linux-2.6-rgb.git ghak90-contid.v10
Changelog:
v10
- rebase on ghak124, ghak96, ghak84, actual wait, 5.9-rc1, ghak120, 5.10-rc1, io_uring
- localize struct struct audit_task_info to audit.c, move related functions from proc/base.c, audit.h, auditsc.c to audit.c
- add Documentation/ABI for /proc/PID/audit_*containerid
- convert from rcu to spin lock around contid put and optimize other spinlock use
- swap task_lock and tasklist_lock in audit_set_contid (deadlock with sys_prlimit64)
- restructure audit_set_contid intro (elsif ladder)
- open code audit_contid_valid and audit_contid_set
- rename contobj_get to contobj_get_bytask, contobj_hold to contobj_get
- squash in audit contid drop, change new contid to -1
- squash in proc audit contid read
- add count param to audit_contobj_put to reduce locking, free target_cid keyed on target_pid
- add record= field to CONTAINER_ID record to link to OBJ_PID, SYSCALL, NETFILTER_PKT
- add helper function audit_log_container_id_ctx
- rename audit_sig_atsk to audit_sig_adtsk
- add missing contobj_put in audit_log_exit and of audit_sig_cid in AUDIT_SIGNAL_INFO
- switch from -ESHUTDOWN to -ENOTUNIQ for as yet unreaped contid
- add helper audit_contid_comparator in audit.c (part of hide)
- move audit_contobj_netns to audit.c (part of hide)
- fix spin_lock with irq option for network interrupt support
- add missing check for audit_get_capcontid in audit_set_contid
- check individual patch complilation
- patch description cleanups (in_syscall vs local, contid nesting examples)
- remove unnecessary audit_log_format() calls
- remove unnecessary rcu locking aroung net_generic call()
v9
- rebase on v5.8-rc1
- fix whitespace and oversize lines where practicable
- remove harmless duplicate S_IRUSR in capcontid
- return -EBUSY for both threading and children (drop -EALREADY)
- return -EEXIST if already set and not nesting (drop -ECHILD)
- fix unbalanced brace and remove elseif ladder
- drop check for same contid set again as redundant (drop -EADDRINUSE)
- get reference to contobj's parent taskstruct
- protect all contid list updates with audit_contobj_list_lock
- protect refcounts with rcu read lock
- convert _audit_contobj to _audit_contobj_get, which calls _audit_contobj_hold
- convert audit_log_container_id() and audit_log_contid() from u64 to contobj, simplifying
- issue death certificate on contid after exit of last task
- keep contobj ref to block reuse with -ESHUTDOWN until auditd exit or signal info
- report all contids nested
- rework sig_info2 format to accommodate contid list
- fix zero-length array in include/linux/audit.h struct audit_sig_info2 data[]
- found bug in audit_alloc_local, don't check audit_ever_enabled, since all callers check audit_enabled
- remove warning at declaration of audit_sig_cid of reuse since reuse is now blocked
- report descendancy checking errcodes under -EXDEV (drop -EBADSLT)
- add missed check, replace audit_contid_isowner with audit_contid_isnesting
- limit calls to audit_log_format() with if(iter->parent) ...
- list only one contid in contid, nested in old-contid to avoid duplication
- switch to comma delimiter, carrat modifier in nested contid list
- special case -1 for AUDIT_CID_UNSET printing
- drop contid depth limit and netns contid limit patches
- enforce capcontid policy on contid write and read
- squash conversion to contobj into contid intro patch
v8
- rebase on v5.5-rc1 audit/next
- remove subject attrs in CONTAINER_OP record
- group audit_contid_list_lock with audit_contid_hash
- in audit_{set,log}_contid(), break out of loop after finding target
- use target var to size kmalloc
- rework audit_cont_owner() to bool audit_contid_isowner() and move to where used
- create static void audit_cont_hold(struct audit_contobj *cont) { refcount_inc(&cont->refcount); }
- rename audit_cont{,_*} refs to audit_contobj{,_*}
- prefix special local functions with _ [audit_contobj*()]
- protect contid list traversals with rcu_read_lock() and updates with audit_contid_list_lock
- protect real_parent in audit_contid_depth() with rcu_dereference
- give new contid field nesting format in patch description
- squash task_is_descendant()
- squash support for NETFILTER_PKT into network namespaces
- limit nesting depth based on record length overflow, bandwidth and storage
- implent control for audit container identifier nesting depth limit
- make room for audit_bpf patches (bump CONTAINER_ID to 1335)
- squash proc interface into capcontid
- remove netlink access to loginuid/sessionid/contid/capcontid
- delete 32k contid limit patch
- document potential overlap between signal delivery and contid reuse
- document audit_contobj_list_lock coverage
- document disappearing orch task injection limitation
- limit the number of containers that can be associated with a network namespace
- implent control for audit container identifier netns count limit
v7
- remove BUG() in audit_comparator64()
- rebase on v5.2-rc1 audit/next
- resolve merge conflict with ghak111 (signal_info regardless syscall)
- resolve merge conflict with ghak73 (audit_field_valid)
- resolve merge conflict with ghak64 (saddr_fam filter)
- resolve merge conflict with ghak10 (ntp audit) change AUDIT_CONTAINER_ID from 1332 to 1334
- rebase on v5.3-rc1 audit/next
- track container owner
- only permit setting contid of descendants for nesting
- track drop of contid and permit reuse
- track and report container nesting
- permit filtering on any nested contid
- set/get contid and loginuid/sessionid via netlink
- implement capcontid to enable orchestrators in non-init user
namespaces
- limit number of containers
- limit depth of container nesting
v6
- change TMPBUFLEN from 11 to 21 to cover the decimal value of contid u64 (nhorman)
- fix bug overwriting ctx in struct audit_sig_info, move cid above ctx[0] (nhorman)
- fix bug skipping remaining fields and not advancing bufp when copying out contid in audit_krule_to_data (omosnacec)
- add acks, tidy commit descriptions, other formatting fixes (checkpatch wrong on audit_log_lost)
- cast ull for u64 prints
- target_cid tracking was moved from the ptrace/signal patch to container_op
- target ptrace and signal records were moved from the ptrace/signal patch to container_id
- auditd signaller tracking was moved to a new AUDIT_SIGNAL_INFO2 request and record
- ditch unnecessary list_empty() checks
- check for null net and aunet in audit_netns_contid_add()
- swap CONTAINER_OP contid/old-contid order to ease parsing
v5
- address loginuid and sessionid syscall scope in ghak104
- address audit_context in CONFIG_AUDIT vs CONFIG_AUDITSYSCALL in ghak105
- remove tty patch, addressed in ghak106
- rebase on audit/next v5.0-rc1 w/ghak59/ghak104/ghak103/ghak100/ghak107/ghak105/ghak106/ghak105sup
- update CONTAINER_ID to CONTAINER_OP in patch description
- move audit_context in audit_task_info to CONFIG_AUDITSYSCALL
- move audit_alloc() and audit_free() out of CONFIG_AUDITSYSCALL and into CONFIG_AUDIT and create audit_{alloc,free}_syscall
- use plain kmem_cache_alloc() rather than kmem_cache_zalloc() in audit_alloc()
- fix audit_get_contid() declaration type error
- move audit_set_contid() from auditsc.c to audit.c
- audit_log_contid() returns void
- audit_log_contid() handed contid rather than tsk
- switch from AUDIT_CONTAINER to AUDIT_CONTAINER_ID for aux record
- move audit_log_contid(tsk/contid) & audit_contid_set(tsk)/audit_contid_valid(contid)
- switch from tsk to current
- audit_alloc_local() calls audit_log_lost() on failure to allocate a context
- add AUDIT_USER* non-syscall contid record
- cosmetic cleanup double parens, goto out on err
- ditch audit_get_ns_contid_list_lock(), fix aunet lock race
- switch from all-cpu read spinlock to rcu, keep spinlock for write
- update audit_alloc_local() to use ktime_get_coarse_real_ts64()
- add nft_log support
- add call from do_exit() in audit_free() to remove contid from netns
- relegate AUDIT_CONTAINER ref= field (was op=) to debug patch
v4
- preface set with ghak81:"collect audit task parameters"
- add shallyn and sgrubb acks
- rename feature bitmap macro
- rename cid_valid() to audit_contid_valid()
- rename AUDIT_CONTAINER_ID to AUDIT_CONTAINER_OP
- delete audit_get_contid_list() from headers
- move work into inner if, delete "found"
- change netns contid list function names
- move exports for audit_log_contid audit_alloc_local audit_free_context to non-syscall patch
- list contids CSV
- pass in gfp flags to audit_alloc_local() (fix audit_alloc_context callers)
- use "local" in lieu of abusing in_syscall for auditsc_get_stamp()
- read_lock(&tasklist_lock) around children and thread check
- task_lock(tsk) should be taken before first check of tsk->audit
- add spin lock to contid list in aunet
- restrict /proc read to CAP_AUDIT_CONTROL
- remove set again prohibition and inherited flag
- delete contidion spelling fix from patchset, send to netdev/linux-wireless
v3
- switched from containerid in task_struct to audit_task_info (depends on ghak81)
- drop INVALID_CID in favour of only AUDIT_CID_UNSET
- check for !audit_task_info, throw -ENOPROTOOPT on set
- changed -EPERM to -EEXIST for parent check
- return AUDIT_CID_UNSET if !audit_enabled
- squash child/thread check patch into AUDIT_CONTAINER_ID patch
- changed -EPERM to -EBUSY for child check
- separate child and thread checks, use -EALREADY for latter
- move addition of op= from ptrace/signal patch to AUDIT_CONTAINER patch
- fix && to || bashism in ptrace/signal patch
- uninline and export function for audit_free_context()
- drop CONFIG_CHANGE, FEATURE_CHANGE, ANOM_ABEND, ANOM_SECCOMP patches
- move audit_enabled check (xt_AUDIT)
- switched from containerid list in struct net to net_generic's struct audit_net
- move containerid list iteration into audit (xt_AUDIT)
- create function to move namespace switch into audit
- switched /proc/PID/ entry from containerid to audit_containerid
- call kzalloc with GFP_ATOMIC on in_atomic() in audit_alloc_context()
- call kzalloc with GFP_ATOMIC on in_atomic() in audit_log_container_info()
- use xt_net(par) instead of sock_net(skb->sk) to get net
- switched record and field names: initial CONTAINER_ID, aux CONTAINER, field CONTID
- allow to set own contid
- open code audit_set_containerid
- add contid inherited flag
- ccontainerid and pcontainerid eliminated due to inherited flag
- change name of container list funcitons
- rename containerid to contid
- convert initial container record to syscall aux
- fix spelling mistake of contidion in net/rfkill/core.c to avoid contid name collision
v2
- add check for children and threads
- add network namespace container identifier list
- add NETFILTER_PKT audit container identifier logging
- patch description and documentation clean-up and example
- reap unused ppid
Richard Guy Briggs (11):
audit: collect audit task parameters
audit: add container id
audit: log container info of syscalls
audit: add contid support for signalling the audit daemon
audit: add support for non-syscall auxiliary records
audit: add containerid support for user records
audit: add containerid filtering
audit: add support for containerid to network namespaces
audit: contid check descendancy and nesting
audit: track container nesting
audit: add capcontid to set contid outside init_user_ns
.../ABI/testing/procfs-audit_containerid | 29 + fs/io-wq.c | 8 +- fs/io_uring.c | 16 +- fs/proc/base.c | 110 ++- include/linux/audit.h | 83 +- include/linux/sched.h | 10 +- include/uapi/linux/audit.h | 10 +- init/init_task.c | 3 +- init/main.c | 2 + kernel/audit.c | 877 +++++++++++++++++- kernel/audit.h | 19 + kernel/auditfilter.c | 46 + kernel/auditsc.c | 109 ++- kernel/fork.c | 1 - kernel/nsproxy.c | 4 + kernel/sched/core.c | 33 + net/netfilter/nft_log.c | 14 +- net/netfilter/xt_AUDIT.c | 14 +- security/selinux/nlmsgtab.c | 1 + security/yama/yama_lsm.c | 33 - 20 files changed, 1294 insertions(+), 128 deletions(-) create mode 100644 Documentation/ABI/testing/procfs-audit_containerid
Signature · 6 lines
2.18.4 _______________________________________________ Containers mailing list [email protected] https://lists.linuxfoundation.org/mailman/listinfo/containers
PATCH v10 1/11 audit: collect audit task parameters
The audit-related parameters in struct task_struct should ideally be collected together and accessed through a standard audit API and the audit structures made opaque to other kernel subsystems.
Collect the existing loginuid, sessionid and audit_context together in a new opaque struct audit_task_info called "audit" in struct task_struct.
Use kmem_cache to manage this pool of memory. Un-inline audit_free() to be able to always recover that memory.
Please see the upstream github issues
https://github.com/linux-audit/audit-kernel/issues/81
https://github.com/linux-audit/audit-kernel/issues/90
--- fs/io-wq.c | 8 +-- fs/io_uring.c | 16 ++--- include/linux/audit.h | 49 +++++--------- include/linux/sched.h | 7 +- init/init_task.c | 3 +- init/main.c | 2 + kernel/audit.c | 154 +++++++++++++++++++++++++++++++++++++++++- kernel/audit.h | 7 ++ kernel/auditsc.c | 24 ++++--- kernel/fork.c | 1 - 10 files changed, 205 insertions(+), 66 deletions(-)
fs/io-wq.c +4 -4
@@ -496,8 +496,8 @@ static void io_impersonate_work(struct io_worker *worker, current->signal->rlim[RLIMIT_FSIZE ].rlim_cur =RLIM_INFINITY ;io_wq_switch_blkcg (worker, work);#ifdef CONFIG_AUDIT - current->loginuid = work->identity->loginuid; - current->sessionid = work->identity->sessionid; +audit_set_loginuid_iouring (work->identity->loginuid); +audit_set_sessionid_iouring (work->identity->sessionid);#endif }
@@ -512,8 +512,8 @@ static void io_assign_current_work(struct io_worker *worker, }#ifdef CONFIG_AUDIT - current->loginuid =KUIDT_INIT (AUDIT_UID_UNSET ); - current->sessionid =AUDIT_SID_UNSET ; +audit_set_loginuid_iouring (KUIDT_INIT (AUDIT_UID_UNSET )); +audit_set_sessionid_iouring (AUDIT_SID_UNSET );#endif spin_lock_irq (&worker->lock);
fs/io_uring.c +8 -8
@@ -1064,8 +1064,8 @@ static void io_init_identity(struct io_identity *id) id->fs = current->fs; id->fsize =rlimit (RLIMIT_FSIZE );#ifdef CONFIG_AUDIT - id->loginuid = current->loginuid; - id->sessionid = current->sessionid; + id->loginuid =audit_get_loginuid (current); + id->sessionid =audit_get_sessionid (current);#endif refcount_set (&id->count,1 ); }
@@ -1335,8 +1335,8 @@ static bool io_grab_identity(struct io_kiocb *req) req->work.flags |=IO_WQ_WORK_CREDS ; }#ifdef CONFIG_AUDIT -if (!uid_eq (current->loginuid, id->loginuid) || - current->sessionid != id->sessionid) +if (!uid_eq (audit_get_loginuid (current), id->loginuid) || +audit_get_sessionid (current) != id->sessionid)return false;#endif if (!(req->work.flags & IO_WQ_WORK_FS) &&
@@ -6771,8 +6771,8 @@ static int io_sq_thread(void *data) }io_sq_thread_associate_blkcg (ctx, &cur_css);#ifdef CONFIG_AUDIT - current->loginuid = ctx->loginuid; - current->sessionid = ctx->sessionid; +audit_set_loginuid_iouring (ctx->loginuid); +audit_set_sessionid_iouring (ctx->sessionid);#endif ret |=__io_sq_thread (ctx, start_jiffies, cap_entries);
@@ -9205,8 +9205,8 @@ static int io_uring_create(unsigned entries, struct io_uring_params *p, ctx->user = user; ctx->creds =get_current_cred ();#ifdef CONFIG_AUDIT - ctx->loginuid = current->loginuid; - ctx->sessionid = current->sessionid; + ctx->loginuid =audit_get_loginuid (current); + ctx->sessionid =audit_get_sessionid (current);#endif ctx->sqo_task =get_task_struct (current);
include/linux/audit.h +17 -32
99 lines not on this page · raw message
include/linux/sched.h +1 -6
@@ -36,7 +36,6 @@#include <linux/kcsan.h> /* task_struct member predeclarations (sorted alphabetically): */ -struct audit_context ;struct backing_dev_info ;struct bio_list ;struct blk_plug ;
@@ -958,11 +957,7 @@ struct task_struct {struct callback_head *task_works;#ifdef CONFIG_AUDIT -#ifdef CONFIG_AUDITSYSCALL -struct audit_context *audit_context; -#endif -kuid_t loginuid; -unsigned int sessionid; +void *audit;#endif struct seccomp seccomp;
init/init_task.c +1 -2
@@ -134,8 +134,7 @@ struct task_struct init_task .thread_group = LIST_HEAD_INIT(init_task.thread_group), .thread_node = LIST_HEAD_INIT(init_signals.thread_head),#ifdef CONFIG_AUDIT - .loginuid = INVALID_UID, - .sessionid = AUDIT_SID_UNSET, + .audit = NULL,#endif #ifdef CONFIG_PERF_EVENTS .perf_event_mutex = __MUTEX_INITIALIZER(init_task.perf_event_mutex),
init/main.c +2 -0
@@ -98,6 +98,7 @@#include <linux/mem_encrypt.h> #include <linux/kcsan.h> #include <linux/init_syscalls.h> +#include <linux/audit.h> #include <asm/io.h> #include <asm/bugs.h>
@@ -1036,6 +1037,7 @@ asmlinkage __visible void __init __no_sanitize_address start_kernel(void)nsfs_init ();cpuset_init ();cgroup_init (); +audit_task_init ();taskstats_init_early ();delayacct_init ();
kernel/audit.c +152 -2
178 lines not on this page · raw message
kernel/audit.h +7 -0
@@ -251,6 +251,10 @@ extern void audit_put_tty(struct tty_struct *tty);extern unsigned int audit_serial (void );extern int auditsc_get_stamp (struct audit_context *ctx,struct timespec64 *t,unsigned int *serial); +extern void audit_set_context (struct task_struct *task,struct audit_context *ctx); +extern struct audit_context *_audit_context (struct task_struct *tsk); +extern int audit_alloc_syscall (struct task_struct *tsk); +extern void audit_free_syscall (struct task_struct *tsk);extern void audit_put_watch (struct audit_watch *watch);extern void audit_get_watch (struct audit_watch *watch);
@@ -292,6 +296,9 @@ extern void audit_filter_inodes(struct task_struct *tsk,extern struct list_head *audit_killed_trees (void );#else /* CONFIG_AUDITSYSCALL */ #define auditsc_get_stamp (c, t, s) 0 +#define audit_alloc_syscall (t) 0 +#define audit_free_syscall (t) {} +#define audit_put_watch (w) {}#define audit_get_watch (w) {}#define audit_to_watch (k, p, l, o) (-EINVAL)
kernel/auditsc.c +13 -11
@@ -932,23 +932,25 @@ static inline struct audit_context *audit_alloc_context(enum audit_state state)return context; } -/** -* audit_alloc - allocate an audit context block for a task +/* +* audit_alloc_syscall - allocate an audit context block for a task * @tsk: task * * Filter on the task information and allocate a per-task audit context * if necessary. Doing so turns on system call auditing for the -* specified task. This is called from copy_process, so no lock is -* needed. +* specified task. This is called from copy_process via audit_alloc, so +* no lock is needed. */ -int audit_alloc (struct task_struct *tsk) +int audit_alloc_syscall (struct task_struct *tsk) {struct audit_context *context;enum audit_state state;char *key =NULL ; -if (likely (!audit_ever_enabled)) +if (likely (!audit_ever_enabled)) { +audit_set_context (tsk,NULL );return 0 ;/* Return if not auditing. */ + } state =audit_filter_task (tsk, &key);if (state ==AUDIT_DISABLED ) {
@@ -958,7 +960,7 @@ int audit_alloc(struct task_struct *tsk)if (!(context =audit_alloc_context (state))) {kfree (key); -audit_log_lost ("out of memory in audit_alloc" ); +audit_log_lost ("out of memory in audit_alloc_syscall" );return -ENOMEM ; } context->filterkey = key;
@@ -1603,14 +1605,14 @@ static void audit_log_exit(void) }/** -* __audit_free - free a per-task audit context +* audit_free_syscall - free per-task audit context info * @tsk: task whose audit context block to free * -* Called from copy_process and do_exit +* Called from audit_free */ -void __audit_free (struct task_struct *tsk) +void audit_free_syscall (struct task_struct *tsk) { -struct audit_context *context = tsk->audit_context; +struct audit_context *context =_audit_context (tsk);if (!context)return ;
kernel/fork.c +0 -1
@@ -2024,7 +2024,6 @@ static __latent_entropy struct task_struct *copy_process(posix_cputimers_init (&p->posix_cputimers); p->io_context =NULL ; -audit_set_context (p,NULL );cgroup_fork (p);#ifdef CONFIG_NUMA p->mempolicy =mpol_dup (p->mempolicy);
Signature · 6 lines
2.18.4 _______________________________________________ Containers mailing list [email protected] https://lists.linuxfoundation.org/mailman/listinfo/containers
Paul Moore
maintainerRe: [PATCH ghak90 v10 01/11] audit: collect audit task parameters
Quoted 11 lines · Richard Guy Briggs
The audit-related parameters in struct
task_structshould ideally be collected together and accessed through a standard audit API and the audit structures made opaque to other kernel subsystems.Collect the existing loginuid, sessionid and
audit_contexttogether in a new opaque structaudit_task_infocalled "audit" in structtask_struct.Use
kmem_cacheto manage this pool of memory. Un-inlineaudit_free()to be able to always recover that memory.
Quoted 7 lines
Please see the upstream github issues
https://github.com/linux-audit/audit-kernel/issues/81
https://github.com/linux-audit/audit-kernel/issues/90Signed-off-by Richard Guy Briggs <[email protected]>Acked-by Neil Horman <[email protected]>Reviewed-by Ondrej Mosnacek <[email protected]>
Did Neil and Ondrej really ACK/Review the changes that you made here in v10 or are you just carrying over the ACK/Review? I'm hopeful it is the former, because I'm going to be a little upset if it is the latter.
Quoted 12 lines
--- fs/io-wq.c | 8 +-- fs/io_uring.c | 16 ++--- include/linux/audit.h | 49 +++++--------- include/linux/sched.h | 7 +- init/init_task.c | 3 +- init/main.c | 2 + kernel/audit.c | 154 +++++++++++++++++++++++++++++++++++++++++- kernel/audit.h | 7 ++ kernel/auditsc.c | 24 ++++--- kernel/fork.c | 1 - 10 files changed, 205 insertions(+), 66 deletions(-)
Signature · 6 lines
paul moore www.paul-moore.com _______________________________________________ Containers mailing list [email protected] https://lists.linuxfoundation.org/mailman/listinfo/containers
Re: [PATCH ghak90 v10 01/11] audit: collect audit task parameters
Quoted 16 lines · Paul Moore
Quoted 15 lines · Richard Guy Briggs
The audit-related parameters in struct
task_structshould ideally be collected together and accessed through a standard audit API and the audit structures made opaque to other kernel subsystems.Collect the existing loginuid, sessionid and
audit_contexttogether in a new opaque structaudit_task_infocalled "audit" in structtask_struct.Use
kmem_cacheto manage this pool of memory. Un-inlineaudit_free()to be able to always recover that memory.Please see the upstream github issues
https://github.com/linux-audit/audit-kernel/issues/81
https://github.com/linux-audit/audit-kernel/issues/90
Quoted 8 lines
Quoted 3 lines
Signed-off-by Richard Guy Briggs <[email protected]>Acked-by Neil Horman <[email protected]>Reviewed-by Ondrej Mosnacek <[email protected]>Did Neil and Ondrej really ACK/Review the changes that you made here in v10 or are you just carrying over the ACK/Review? I'm hopeful it is the former, because I'm going to be a little upset if it is the latter.
It is the latter, sorry. So, this needs to be reposted without their ACK/Review lines.
Quoted 4 lines
Quoted 4 lines
--- fs/io-wq.c | 8 +-- fs/io_uring.c | 16 ++--- include/linux/audit.h | 49 +++++---------
Quoted 13 lines
Quoted 8 lines
include/linux/sched.h | 7 +- init/init_task.c | 3 +- init/main.c | 2 + kernel/audit.c | 154 +++++++++++++++++++++++++++++++++++++++++- kernel/audit.h | 7 ++ kernel/auditsc.c | 24 ++++--- kernel/fork.c | 1 - 10 files changed, 205 insertions(+), 66 deletions(-)Signature · 2 lines
paul moore www.paul-moore.com
- RGB
--
Richard Guy Briggs <[email protected]>
Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
PATCH v10 2/11 audit: add container id
In reply to Richard Guy BriggsImplement the proc fs write to set the audit container identifier of a process, emitting an AUDIT_CONTAINER_OP record to document the event.
This is a write from the container orchestrator task to a proc entry of the form /proc/PID/audit_containerid where PID is the process ID of the newly created task that is to become the first task in a container, or an additional task added to a container.
The write expects up to a u64 value (unset: 18446744073709551615).
The writer must have capability CAP_AUDIT_CONTROL.
This will produce a record such as this:time->Thu Nov 26 10:24:46 2020
type=PROCTITLE msg=audit(1606404286.956:174546): proctitle=2F7573722F62696E2F7065726C002D7700636F6E7461696E657269642F74657374
type=SYSCALL msg=audit(1606404286.956:174546): arch=c000003e syscall=1 success=yes exit=19 a0=6 a1=557446a6a650 a2=13 a3=8 items=0 ppid=6827 pid=8724 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS0 ses=1 comm="perl" exe="/usr/bin/perl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) type=CONTAINER_OP msg=audit(1606404286.956:174546): op=set opid=8771 contid=4112973747854606336 old-contid=-1
The "op" field indicates an initial set. The "opid" field is the object's PID, the process being "contained". New and old audit container identifier values are given in the "contid" fields.
It is not permitted to unset the audit container identifier. A child inherits its parent's audit container identifier.
Store the audit container identifier in a refcounted kernel object that is added to the master list of audit container identifiers. This will allow multiple container orchestrators/engines to work on the same machine without danger of inadvertantly re-using an existing identifier. It will also allow an orchestrator to inject a process into an existing container by checking if the original container owner is the one injecting the task. A hash table list is used to optimize searches.
audit: log drop of contid on exit of last task
Since the life of each audit container indentifier is being tracked, we can match the creation event with the destruction event. Log the destruction of the audit container identifier when the last process in that container exits.
Add support for reading the audit container identifier from the proc filesystem. This is a read from the proc entry of the form /proc/PID/audit_containerid where PID is the process ID of the task whose audit container identifier is sought. The read expects up to a u64 value (unset: 18446744073709551615). This read requires CAP_AUDIT_CONTROL.
Add an entry to Documentation/ABI for /proc/$pid/audit_containerid.
Please see the github audit kernel issue for the main feature:
https://github.com/linux-audit/audit-kernel/issues/90
Please see the github audit userspace issue for supporting additions:
https://github.com/linux-audit/audit-userspace/issues/51
Please see the github audit testsuiite issue for the test case:
https://github.com/linux-audit/audit-testsuite/issues/64
Please see the github audit wiki for the feature overview:
https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID
--- .../ABI/testing/procfs-audit_containerid | 13 ++ fs/proc/base.c | 56 ++++- include/linux/audit.h | 5 + include/uapi/linux/audit.h | 2 + kernel/audit.c | 210 ++++++++++++++++++ kernel/audit.h | 2 + kernel/auditsc.c | 2 + 7 files changed, 289 insertions(+), 1 deletion(-) create mode 100644 Documentation/ABI/testing/procfs-audit_containerid
Documentation/ABI/testing/procfs-audit_containerid new file +13 -0
@@ -0,0 +1,13 @@ +What: Audit Container Identifier +Date: 2020-?? +KernelVersion: 5.10? +Contact: [email protected] +Format: u64 +Users: auditd, libaudit, audit-testsuite, podman(?), container orchestrators +Description: + The /proc/$pid/audit_containerid pseudofile it written + to set and read to get the audit container identifier of + process $pid. The accessor must have CAP_AUDIT_CONTROL + or have its own /proc/$pid/capcontainerid set to write + or read. +
fs/proc/base.c +55 -1
80 lines not on this page · raw message
include/linux/audit.h +5 -0
@@ -204,6 +204,11 @@ extern kuid_t audit_get_loginuid(struct task_struct *tsk);extern unsigned int audit_get_sessionid (struct task_struct *tsk);extern void audit_set_sessionid_iouring (unsigned int sessionid); +extern int audit_get_contid_proc (char *tmpbuf,int TMPBUFLEN , +struct task_struct *task); + +extern int audit_set_contid (struct task_struct *tsk,u64 contid); +extern u32 audit_enabled;extern int audit_signal_info (int sig,struct task_struct *t);
include/uapi/linux/audit.h +2 -0
@@ -71,6 +71,7 @@#define AUDIT_TTY_SET 1017/* Set TTY auditing status */ #define AUDIT_SET_FEATURE 1018/* Turn an audit feature on or off */ #define AUDIT_GET_FEATURE 1019/* Get which features are enabled */ +#define AUDIT_CONTAINER_OP 1020/* Define the container id and info */ #define AUDIT_FIRST_USER_MSG 1100/* Userspace messages mostly uninteresting to kernel */ #define AUDIT_USER_AVC 1107/* We filter this differently */
@@ -495,6 +496,7 @@ struct audit_tty_status {#define AUDIT_UID_UNSET (unsigned int)-1#define AUDIT_SID_UNSET ((unsigned int)-1) +#define AUDIT_CID_UNSET ((u64)-1)/* audit_rule_data supports filter rules with both integer and string * fields. It corresponds with AUDIT_ADD_RULE, AUDIT_DEL_RULE and
kernel/audit.c +210 -0
261 lines not on this page · raw message
kernel/audit.h +2 -0
@@ -210,6 +210,8 @@ static inline int audit_hash_ino(u32 ino)return (ino & (AUDIT_INODE_BUCKETS -1 )); } +extern void audit_log_container_drop (void ); +/* Indicates that audit should log the full pathname. */ #define AUDIT_NAME_FULL -1
kernel/auditsc.c +2 -0
@@ -1596,6 +1596,8 @@ static void audit_log_exit(void)audit_log_proctitle (); +audit_log_container_drop (); +/* Send end of event record to help user space know we are finished */ ab =audit_log_start (context,GFP_KERNEL ,AUDIT_EOE );if (ab)
Signature · 6 lines
2.18.4 -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
PATCH v10 3/11 audit: log container info of syscalls
In reply to Richard Guy BriggsCreate a new audit record AUDIT_CONTAINER_ID to document the audit container identifier of a process if it is present.
Called from audit_log_exit(), syscalls are covered.
Include target_cid references from ptrace and signal.
A sample raw event:time->Thu Nov 26 10:24:40 2020
type=PROCTITLE msg=audit(1606404280.226:174542): proctitle=2F7573722F62696E2F7065726C002D7700636F6E7461696E657269642F74657374
type=PATH msg=audit(1606404280.226:174542): item=1 name="/tmp/audit-testsuite-dir-8riQ/testsuite-1606404267-WNldVJCr" inode=428 dev=00:1f mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 nametype=CREATE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=PATH msg=audit(1606404280.226:174542): item=0 name="/tmp/audit-testsuite-dir-8riQ/" inode=427 dev=00:1f mode=040700 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 nametype=PARENT cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(1606404280.226:174542): cwd="/root/rgb/git/audit-testsuite/tests"
type=SYSCALL msg=audit(1606404280.226:174542): arch=c000003e syscall=257 success=yes exit=6 a0=ffffff9c a1=557446bd5f10 a2=80241 a3=1b6 items=2 ppid=8724 pid=8758 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS0 ses=1 comm="perl" exe="/usr/bin/perl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="testsuite-1606404267-WNldVJCr" record=1 type=CONTAINER_ID msg=audit(1606404280.226:174542): record=1 contid=527940429489930240
Please see the github audit kernel issue for the main feature:
https://github.com/linux-audit/audit-kernel/issues/90
Please see the github audit userspace issue for supporting additions:
https://github.com/linux-audit/audit-userspace/issues/51
Please see the github audit testsuiite issue for the test case:
https://github.com/linux-audit/audit-testsuite/issues/64
Please see the github audit wiki for the feature overview:
https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID
--- include/uapi/linux/audit.h | 1 + kernel/audit.c | 69 ++++++++++++++++++++++++++++++++++++++ kernel/audit.h | 6 ++++ kernel/auditsc.c | 49 ++++++++++++++++++++++----- 4 files changed, 117 insertions(+), 8 deletions(-)
include/uapi/linux/audit.h +1 -0
@@ -119,6 +119,7 @@#define AUDIT_TIME_ADJNTPVAL 1333/* NTP value adjustment */ #define AUDIT_BPF 1334/* BPF subsystem */ #define AUDIT_EVENT_LISTENER 1335/* Task joined multicast read socket */ +#define AUDIT_CONTAINER_ID 1336/* Container ID */ #define AUDIT_AVC 1400/* SE Linux avc denial or grant */ #define AUDIT_SELINUX_ERR 1401/* Internal SE Linux Errors */
kernel/audit.c +69 -0
87 lines not on this page · raw message
kernel/audit.h +6 -0
@@ -135,6 +135,8 @@ struct audit_context {kuid_t target_uid;unsigned int target_sessionid;u32 target_sid; +void *target_cid; +int contid_records;char target_comm[TASK_COMM_LEN ];struct audit_tree_refs *trees, *first_trees;
@@ -211,6 +213,10 @@ static inline int audit_hash_ino(u32 ino) }extern void audit_log_container_drop (void ); +extern void *audit_contobj_get_bytask (struct task_struct *tsk); +extern void audit_contobj_put (void **cont,int count); +extern int audit_log_container_id (struct audit_context *context,void *cont); +extern int audit_log_container_id_ctx (struct audit_context *context);/* Indicates that audit should log the full pathname. */ #define AUDIT_NAME_FULL -1
kernel/auditsc.c +41 -8
143 lines not on this page · raw message
Signature · 6 lines
2.18.4 -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
PATCH v10 4/11 audit: add contid support for signalling the audit daemon
In reply to Richard Guy BriggsAdd audit container identifier support to the action of signalling the audit daemon.
Since this would need to add an element to the audit_sig_info struct, a new record type AUDIT_SIGNAL_INFO2 was created with a new audit_sig_info2 struct. Corresponding support is required in the userspace code to reflect the new record request and reply type. An older userspace won't break since it won't know to request this record type.
--- include/linux/audit.h | 7 +++ include/uapi/linux/audit.h | 1 + kernel/audit.c | 116 ++++++++++++++++++++++++++++++++++-- security/selinux/nlmsgtab.c | 1 + 4 files changed, 120 insertions(+), 5 deletions(-)
include/linux/audit.h +7 -0
@@ -23,6 +23,13 @@ struct audit_sig_info {char ctx[]; }; +struct audit_sig_info2 { +uid_t uid; +pid_t pid; +u32 cid_len; +char data[]; +}; +struct audit_buffer ;struct audit_context ;struct inode ;
include/uapi/linux/audit.h +1 -0
@@ -72,6 +72,7 @@#define AUDIT_SET_FEATURE 1018/* Turn an audit feature on or off */ #define AUDIT_GET_FEATURE 1019/* Get which features are enabled */ #define AUDIT_CONTAINER_OP 1020/* Define the container id and info */ +#define AUDIT_SIGNAL_INFO2 1021/* Get info auditd signal sender */ #define AUDIT_FIRST_USER_MSG 1100/* Userspace messages mostly uninteresting to kernel */ #define AUDIT_USER_AVC 1107/* We filter this differently */
kernel/audit.c +111 -5
180 lines not on this page · raw message
security/selinux/nlmsgtab.c +1 -0
@@ -137,6 +137,7 @@ static const struct nlmsg_perm nlmsg_audit_perms[] = { AUDIT_DEL_RULE, NETLINK_AUDIT_SOCKET__NLMSG_WRITE }, { AUDIT_USER, NETLINK_AUDIT_SOCKET__NLMSG_RELAY }, { AUDIT_SIGNAL_INFO, NETLINK_AUDIT_SOCKET__NLMSG_READ }, + { AUDIT_SIGNAL_INFO2, NETLINK_AUDIT_SOCKET__NLMSG_READ }, { AUDIT_TRIM, NETLINK_AUDIT_SOCKET__NLMSG_WRITE }, { AUDIT_MAKE_EQUIV, NETLINK_AUDIT_SOCKET__NLMSG_WRITE }, { AUDIT_TTY_GET, NETLINK_AUDIT_SOCKET__NLMSG_READ },
Signature · 6 lines
2.18.4 _______________________________________________ Containers mailing list [email protected] https://lists.linuxfoundation.org/mailman/listinfo/containers
PATCH v10 5/11 audit: add support for non-syscall auxiliary records
In reply to Richard Guy BriggsStandalone audit records have the timestamp and serial number generated on the fly and as such are unique, making them standalone. This new function audit_alloc_local() generates a local audit context that will be used only for a standalone record and its auxiliary record(s). The context is discarded immediately after the local associated records are produced.
A new flag, "local" was used rather than "in_syscall" since it would be overloading the original purpose and meaning. Events using this function may not be triggered by a syscall but still need records linked by timestamp and serial.
--- include/linux/audit.h | 8 ++++++++ kernel/audit.h | 1 + kernel/auditsc.c | 31 ++++++++++++++++++++++++++----- 3 files changed, 35 insertions(+), 5 deletions(-)
include/linux/audit.h +8 -0
@@ -304,6 +304,8 @@ static inline int audit_signal_info(int sig, struct task_struct *t)/* These are defined in auditsc.c */ /* Public API */ +extern struct audit_context *audit_alloc_local (gfp_t gfpflags); +extern void audit_free_context (struct audit_context *context);extern void __audit_syscall_entry (int major,unsigned long a0,unsigned long a1,unsigned long a2,unsigned long a3);extern void __audit_syscall_exit (int ret_success,long ret_value);
@@ -555,6 +557,12 @@ static inline void audit_log_nfcfg(const char *name, u8 af,extern int audit_n_rules;extern int audit_signals;#else /* CONFIG_AUDITSYSCALL */ +static inline struct audit_context *audit_alloc_local (gfp_t gfpflags) +{ +return NULL ; +} +static inline void audit_free_context (struct audit_context *context) +{ }static inline void audit_syscall_entry (int major,unsigned long a0,unsigned long a1,unsigned long a2,unsigned long a3)
kernel/audit.h +1 -0
@@ -98,6 +98,7 @@ struct audit_proctitle {struct audit_context {int dummy;/* must be the first element */ int in_syscall;/* 1 if task is in a syscall */ +bool local;/* local context needed */ enum audit_state state, current_state;unsigned int serial;/* serial number for record */ int major;/* syscall number */
kernel/auditsc.c +26 -5
@@ -920,11 +920,12 @@ static inline void audit_free_aux(struct audit_context *context) } } -static inline struct audit_context *audit_alloc_context (enum audit_state state) +static inline struct audit_context *audit_alloc_context (enum audit_state state, +gfp_t gfpflags) {struct audit_context *context; - context =kzalloc (sizeof (*context),GFP_KERNEL ); + context =kzalloc (sizeof (*context), gfpflags);if (!context)return NULL ; context->state = state;
@@ -962,7 +963,8 @@ int audit_alloc_syscall(struct task_struct *tsk)return 0 ; } -if (!(context =audit_alloc_context (state))) { + context =audit_alloc_context (state,GFP_KERNEL ); +if (!context) {kfree (key);audit_log_lost ("out of memory in audit_alloc_syscall" );return -ENOMEM ;
@@ -974,8 +976,26 @@ int audit_alloc_syscall(struct task_struct *tsk)return 0 ; } -static inline void audit_free_context (struct audit_context *context) +struct audit_context *audit_alloc_local (gfp_t gfpflags) { +struct audit_context *context; + + context =audit_alloc_context (AUDIT_RECORD_CONTEXT , gfpflags); +if (!context) { +audit_log_lost ("out of memory in audit_alloc_local" ); +return NULL ; + } + context->serial =audit_serial (); +ktime_get_coarse_real_ts64 (&context->ctime); + context->local = true; +return context; +} +EXPORT_SYMBOL (audit_alloc_local); + +void audit_free_context (struct audit_context *context) +{ +if (!context) +return ;audit_free_module (context);audit_free_names (context);unroll_tree_refs (context,NULL ,0 );
@@ -986,6 +1006,7 @@ static inline void audit_free_context(struct audit_context *context)audit_proctitle_free (context);kfree (context); } +EXPORT_SYMBOL (audit_free_context); static int audit_log_pid_context(struct audit_context *context, pid_t pid, kuid_t auid, kuid_t uid, unsigned int sessionid,
@@ -2223,7 +2244,7 @@ EXPORT_SYMBOL_GPL(__audit_inode_child);int auditsc_get_stamp (struct audit_context *ctx,struct timespec64 *t,unsigned int *serial) { -if (!ctx->in_syscall) +if (!ctx->in_syscall && !ctx->local)return 0 ;if (!ctx->serial) ctx->serial =audit_serial ();
Signature · 6 lines
2.18.4 -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
PATCH v10 6/11 audit: add containerid support for user records
In reply to Richard Guy BriggsAdd audit container identifier auxiliary record to user event standalone records.
--- kernel/audit.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
kernel/audit.c +5 -7
@@ -1338,12 +1338,6 @@ static void audit_log_common_recv_msg(struct audit_context *context,audit_log_task_context (*ab); } -static inline void audit_log_user_recv_msg (struct audit_buffer **ab, -u16 msg_type) -{ -audit_log_common_recv_msg (NULL , ab, msg_type); -} -int is_audit_feature_set (int i) {return af.features &AUDIT_FEATURE_TO_MASK (i);
@@ -1619,6 +1613,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) err =audit_filter (msg_type,AUDIT_FILTER_USER );if (err ==1 ) {/* match or error */ char *str = data; +struct audit_context *context; err =0 ;if (msg_type ==AUDIT_USER_TTY ) {
@@ -1626,7 +1621,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)if (err)break ; } -audit_log_user_recv_msg (&ab, msg_type); + context =audit_alloc_local (GFP_KERNEL ); +audit_log_common_recv_msg (context, &ab, msg_type);if (msg_type !=AUDIT_USER_TTY ) {/* ensure NULL termination */ str[data_len -1 ] ='\0' ;
@@ -1640,6 +1636,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)audit_log_n_untrustedstring (ab, str, data_len); }audit_log_end (ab); +audit_log_container_id_ctx (context); +audit_free_context (context); }break ;case AUDIT_ADD_RULE :
Signature · 6 lines
2.18.4 _______________________________________________ Containers mailing list [email protected] https://lists.linuxfoundation.org/mailman/listinfo/containers
PATCH v10 7/11 audit: add containerid filtering
In reply to Richard Guy BriggsImplement audit container identifier filtering using the AUDIT_CONTID field name to send an 8-character string representing a u64 since the value field is only u32.
Sending it as two u32 was considered, but gathering and comparing two fields was more complex.
The feature indicator is AUDIT_FEATURE_BITMAP_CONTAINERID.
Please see the github audit kernel issue for the contid filter feature:
https://github.com/linux-audit/audit-kernel/issues/91
Please see the github audit userspace issue for filter additions:
https://github.com/linux-audit/audit-userspace/issues/40
Please see the github audit testsuiite issue for the test case:
https://github.com/linux-audit/audit-testsuite/issues/64
Please see the github audit wiki for the feature overview:
https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID
--- include/linux/audit.h | 1 + include/uapi/linux/audit.h | 5 ++++- kernel/audit.c | 5 +++++ kernel/audit.h | 3 +++ kernel/auditfilter.c | 46 ++++++++++++++++++++++++++++++++++++++ kernel/auditsc.c | 3 +++ 6 files changed, 62 insertions(+), 1 deletion(-)
include/linux/audit.h +1 -0
@@ -69,6 +69,7 @@ struct audit_field {u32 type;union {u32 val; +u64 val64;kuid_t uid;kgid_t gid;struct {
include/uapi/linux/audit.h +4 -1
@@ -271,6 +271,7 @@#define AUDIT_LOGINUID_SET 24#define AUDIT_SESSIONID 25/* Session ID */ #define AUDIT_FSTYPE 26/* FileSystem Type */ +#define AUDIT_CONTID 27/* Container ID */ /* These are ONLY useful when checking * at syscall exit time (AUDIT_AT_EXIT). */
@@ -353,6 +354,7 @@ enum {#define AUDIT_FEATURE_BITMAP_SESSIONID_FILTER 0x00000010#define AUDIT_FEATURE_BITMAP_LOST_RESET 0x00000020#define AUDIT_FEATURE_BITMAP_FILTER_FS 0x00000040 +#define AUDIT_FEATURE_BITMAP_CONTAINERID 0x00000080#define AUDIT_FEATURE_BITMAP_ALL (AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT | \ AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME | \
@@ -360,7 +362,8 @@ enum { AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND | \ AUDIT_FEATURE_BITMAP_SESSIONID_FILTER | \ AUDIT_FEATURE_BITMAP_LOST_RESET | \ - AUDIT_FEATURE_BITMAP_FILTER_FS) + AUDIT_FEATURE_BITMAP_FILTER_FS | \ + AUDIT_FEATURE_BITMAP_CONTAINERID)/* deprecated: AUDIT_VERSION_* */ #define AUDIT_VERSION_LATEST AUDIT_FEATURE_BITMAP_ALL
kernel/audit.c +5 -0
@@ -2488,6 +2488,11 @@ int audit_log_container_id_ctx(struct audit_context *context)return record; } +int audit_contid_comparator (struct task_struct *tsk,u32 op,u64 right) +{ +return audit_comparator64 (audit_get_contid (tsk), op, right); +} +void audit_log_key (struct audit_buffer *ab,char *key) {audit_log_format (ab," key=" );
kernel/audit.h +3 -0
@@ -218,12 +218,15 @@ extern void *audit_contobj_get_bytask(struct task_struct *tsk);extern void audit_contobj_put (void **cont,int count);extern int audit_log_container_id (struct audit_context *context,void *cont);extern int audit_log_container_id_ctx (struct audit_context *context); +extern int audit_contid_comparator (struct task_struct *tsk,const u32 op, +const u64 right);/* Indicates that audit should log the full pathname. */ #define AUDIT_NAME_FULL -1extern int audit_match_class (int class,unsigned syscall);extern int audit_comparator (const u32 left,const u32 op,const u32 right); +extern int audit_comparator64 (const u64 left,const u32 op,const u64 right);extern int audit_uid_comparator (kuid_t left,u32 op,kuid_t right);extern int audit_gid_comparator (kgid_t left,u32 op,kgid_t right);extern int parent_len (const char *path);
kernel/auditfilter.c +46 -0
82 lines not on this page · raw message
kernel/auditsc.c +3 -0
@@ -656,6 +656,9 @@ static int audit_filter_rules(struct task_struct *tsk, result =audit_comparator (ctx->sockaddr->ss_family, f->op, f->val);break ; +case AUDIT_CONTID : + result =audit_contid_comparator (tsk, f->op, f->val64); +break ;case AUDIT_SUBJ_USER :case AUDIT_SUBJ_ROLE :case AUDIT_SUBJ_TYPE :
Signature · 6 lines
2.18.4 -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
PATCH v10 8/11 audit: add support for containerid to network namespaces
In reply to Richard Guy BriggsThis also adds support to qualify NETFILTER_PKT records.
Audit events could happen in a network namespace outside of a task context due to packets received from the net that trigger an auditing rule prior to being associated with a running task. The network namespace could be in use by multiple containers by association to the tasks in that network namespace. We still want a way to attribute these events to any potential containers. Keep a list per network namespace to track these audit container identifiiers.
Add/increment the audit container identifier on:
- initial setting of the audit container identifier via /proc
- clone/fork call that inherits an audit container identifier
- unshare call that inherits an audit container identifier
- setns call that inherits an audit container identifier Delete/decrement the audit container identifier on:
- an inherited audit container identifier dropped when child set
- process exit
- unshare call that drops a net namespace
- setns call that drops a net namespace
Add audit container identifier auxiliary record(s) to NETFILTER_PKT event standalone records. Iterate through all potential audit container identifiers associated with a network namespace.
Sample event:
type=NETFILTER_PKT msg=audit(2020-11-26 10:24:47.984:174549) : mark=0x15766399 saddr=127.0.0.1 daddr=127.0.0.1 proto=icmp record=1 type=CONTAINER_ID msg=audit(2020-11-26 10:24:47.984:174549) : record=1 contid=4112973747854606336,1916436506412318720
Please see the github audit kernel issue for contid net support:
https://github.com/linux-audit/audit-kernel/issues/92
Please see the github audit testsuiite issue for the test case:
https://github.com/linux-audit/audit-testsuite/issues/64
Please see the github audit wiki for the feature overview:
https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID
--- include/linux/audit.h | 17 +++ kernel/audit.c | 229 ++++++++++++++++++++++++++++++++++----- kernel/nsproxy.c | 4 + net/netfilter/nft_log.c | 14 ++- net/netfilter/xt_AUDIT.c | 14 ++- 5 files changed, 249 insertions(+), 29 deletions(-)
include/linux/audit.h +17 -0
@@ -217,6 +217,12 @@ extern int audit_get_contid_proc(char *tmpbuf, int TMPBUFLEN,extern int audit_set_contid (struct task_struct *tsk,u64 contid); +extern void audit_copy_namespaces (struct net *net,struct task_struct *tsk); +extern void audit_switch_task_namespaces (struct nsproxy *ns, +struct task_struct *p); +extern int audit_log_netns_contid_list (struct net *net, +struct audit_context *context); +extern u32 audit_enabled;extern int audit_signal_info (int sig,struct task_struct *t);
@@ -281,6 +287,17 @@ static inline unsigned int audit_get_sessionid(struct task_struct *tsk)return AUDIT_SID_UNSET ; } +static inline void audit_copy_namespaces (struct net *net,struct task_struct *tsk) +{ } +static inline void audit_switch_task_namespaces (struct nsproxy *ns, +struct task_struct *p) +{ } +static inline int audit_log_netns_contid_list (struct net *net, +struct audit_context *context) +{ +return 0 ; +} +#define audit_enabled AUDIT_OFFstatic inline int audit_signal_info (int sig,struct task_struct *t)
kernel/audit.c +204 -25
387 lines not on this page · raw message
kernel/nsproxy.c +4 -0
@@ -26,6 +26,7 @@#include <linux/syscalls.h> #include <linux/cgroup.h> #include <linux/perf_event.h> +#include <linux/audit.h> static struct kmem_cache *nsproxy_cachep;
@@ -187,6 +188,8 @@ int copy_namespaces(unsigned long flags, struct task_struct *tsk) } tsk->nsproxy = new_ns; +if (flags &CLONE_NEWNET ) +audit_copy_namespaces (new_ns->net_ns, tsk);return 0 ; }
@@ -249,6 +252,7 @@ void switch_task_namespaces(struct task_struct *p, struct nsproxy *new) ns = p->nsproxy; p->nsproxy = new;task_unlock (p); +audit_switch_task_namespaces (ns, p);if (ns &&atomic_dec_and_test (&ns->count))free_nsproxy (ns);
net/netfilter/nft_log.c +12 -2
@@ -66,13 +66,19 @@ static void nft_log_eval_audit(const struct nft_pktinfo *pkt)struct sk_buff *skb = pkt->skb;struct audit_buffer *ab;int fam =-1 ; +struct audit_context *context; +struct net *net; +int record;if (!audit_enabled)return ; - ab =audit_log_start (NULL ,GFP_ATOMIC ,AUDIT_NETFILTER_PKT ); + context =audit_alloc_local (GFP_ATOMIC ); + net =xt_net (&pkt->xt); + record =audit_log_netns_contid_list (net, context); + ab =audit_log_start (context,GFP_ATOMIC ,AUDIT_NETFILTER_PKT );if (!ab) -return ; + goto errout;audit_log_format (ab,"mark=%#x" , skb->mark);
@@ -98,7 +104,11 @@ static void nft_log_eval_audit(const struct nft_pktinfo *pkt)if (fam ==-1 )audit_log_format (ab," saddr=? daddr=? proto=-1" ); +if (record) +audit_log_format (ab," record=%d" , record);audit_log_end (ab); +errout: +audit_free_context (context); } static void nft_log_eval(const struct nft_expr *expr,
net/netfilter/xt_AUDIT.c +12 -2
@@ -68,10 +68,16 @@ audit_tg(struct sk_buff *skb, const struct xt_action_param *par) {struct audit_buffer *ab;int fam =-1 ; +struct audit_context *context; +struct net *net; +int record;if (audit_enabled ==AUDIT_OFF ) - goto errout; - ab =audit_log_start (NULL ,GFP_ATOMIC ,AUDIT_NETFILTER_PKT ); + goto out; + context =audit_alloc_local (GFP_ATOMIC ); + net =xt_net (par); + record =audit_log_netns_contid_list (net, context); + ab =audit_log_start (context,GFP_ATOMIC ,AUDIT_NETFILTER_PKT );if (ab ==NULL ) goto errout;
@@ -99,9 +105,13 @@ audit_tg(struct sk_buff *skb, const struct xt_action_param *par)if (fam ==-1 )audit_log_format (ab," saddr=? daddr=? proto=-1" ); +if (record) +audit_log_format (ab," record=%d" , record);audit_log_end (ab); errout: +audit_free_context (context); +out:return XT_CONTINUE ; }
Signature · 6 lines
2.18.4 -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
PATCH v10 9/11 audit: contid check descendancy and nesting
In reply to Richard Guy BriggsRequire the target task to be a descendant of the container orchestrator/engine.
You would only change the audit container ID from one set or inherited value to another if you were nesting containers.
If changing the contid, the container orchestrator/engine must be a descendant and not same orchestrator as the one that set it so it is not possible to change the contid of another orchestrator's container.
Since the task_is_descendant() function is used in YAMA and in audit, remove the duplication and pull the function into kernel/core/sched.c
--- include/linux/sched.h | 3 +++ kernel/audit.c | 26 +++++++++++++++++++++++--- kernel/sched/core.c | 33 +++++++++++++++++++++++++++++++++ security/yama/yama_lsm.c | 33 --------------------------------- 4 files changed, 59 insertions(+), 36 deletions(-)
include/linux/sched.h +3 -0
@@ -2055,4 +2055,7 @@ int sched_trace_rq_nr_running(struct rq *rq);const struct cpumask *sched_trace_rd_span (struct root_domain *rd); +extern int task_is_descendant (struct task_struct *parent, +struct task_struct *child); +#endif
kernel/audit.c +23 -3
@@ -475,11 +475,13 @@ void audit_free(struct task_struct *tsk)rcu_read_lock (); cont =_audit_contobj_get_bytask (tsk);rcu_read_unlock (); -spin_lock_irqsave (&_audit_contobj_list_lock, flags);if (ns) {audit_netns_contid_del (ns->net_ns, cont); +spin_lock_irqsave (&_audit_contobj_list_lock, flags);_audit_contobj_put (cont); +spin_unlock_irqrestore (&_audit_contobj_list_lock, flags); } +spin_lock_irqsave (&_audit_contobj_list_lock, flags);_audit_contobj_put (cont);spin_unlock_irqrestore (&_audit_contobj_list_lock, flags);audit_free_syscall (tsk);
@@ -2923,6 +2925,21 @@ int audit_signal_info(int sig, struct task_struct *t)return audit_signal_info_syscall (t); } +static bool audit_contid_isnesting (struct task_struct *tsk) +{ +bool isowner = false; +bool ownerisparent = false; +struct audit_task_info *info = tsk->audit; + +rcu_read_lock (); +if (info && info->cont) { + isowner = current == info->cont->owner; + ownerisparent =task_is_descendant (info->cont->owner, current); + } +rcu_read_unlock (); +return !isowner && ownerisparent; +} +/* * audit_set_contid - set current task's audit contid * @tsk: target task
@@ -2963,8 +2980,11 @@ int audit_set_contid(struct task_struct *tsk, u64 contid) !(thread_group_leader(tsk) && thread_group_empty(tsk))) {/* if task has children or is not single-threaded, deny */ rc = -EBUSY ; - } else if (info->cont) { -/* if contid is already set, deny */ + } else if (tsk == current || !task_is_descendant(current, tsk)) { +/* if task is not descendant, block */ + rc = -EXDEV ; + } else if (info->cont && !audit_contid_isnesting(tsk)) { +/* only allow contid setting again if nesting */ rc = -EEXIST ; }rcu_read_lock ();
kernel/sched/core.c +33 -0
@@ -8436,6 +8436,39 @@ void dump_cpu_task(int cpu)sched_show_task (cpu_curr (cpu)); } +/* +* task_is_descendant - walk up a process family tree looking for a match +* @parent: the process to compare against while walking up from child +* @child: the process to start from while looking upwards for parent +* +* Returns 1 if child is a descendant of parent, 0 if not. +*/ +int task_is_descendant (struct task_struct *parent, +struct task_struct *child) +{ +int rc =0 ; +struct task_struct *walker = child; + +if (!parent || !child) +return 0 ; + +rcu_read_lock (); +if (!thread_group_leader (parent)) + parent =rcu_dereference (parent->group_leader); +while (walker->pid >0 ) { +if (!thread_group_leader (walker)) + walker =rcu_dereference (walker->group_leader); +if (walker == parent) { + rc =1 ; +break ; + } + walker =rcu_dereference (walker->real_parent); + } +rcu_read_unlock (); + +return rc; +} +/* * Nice levels are multiplicative, with a gentle 10% change for every * nice level changed. I.e. when a CPU-bound task goes from nice 0 to
security/yama/yama_lsm.c +0 -33
@@ -262,39 +262,6 @@ static int yama_task_prctl(int option, unsigned long arg2, unsigned long arg3,return rc; } -/** -* task_is_descendant - walk up a process family tree looking for a match -* @parent: the process to compare against while walking up from child -* @child: the process to start from while looking upwards for parent -* -* Returns 1 if child is a descendant of parent, 0 if not. -*/ -static int task_is_descendant (struct task_struct *parent, -struct task_struct *child) -{ -int rc =0 ; -struct task_struct *walker = child; - -if (!parent || !child) -return 0 ; - -rcu_read_lock (); -if (!thread_group_leader (parent)) - parent =rcu_dereference (parent->group_leader); -while (walker->pid >0 ) { -if (!thread_group_leader (walker)) - walker =rcu_dereference (walker->group_leader); -if (walker == parent) { - rc =1 ; -break ; - } - walker =rcu_dereference (walker->real_parent); - } -rcu_read_unlock (); - -return rc; -} -/** * ptracer_exception_found - tracer registered as exception for this tracee * @tracer: the task_struct of the process attempting ptrace
Signature · 6 lines
2.18.4 -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
PATCH v10 10/11 audit: track container nesting
In reply to Richard Guy BriggsTrack the parent container of a container to be able to filter and report nesting.
Now that we have a way to track and check the parent container of a container, modify the contid field format to be able to report that nesting using a carrat ("^") modifier to indicate nesting. The original field format was "contid=<contid>" for task-associated records and "contid=<contid>[,<contid>[...]]" for network-namespace-associated records. The new field format is "contid=<contid>[,^<contid>[...]][,<contid>[...]]".
For task event example, an orchestrator in contid 1 spawns tasks in contid 2 and contid 3, then the task in contid 2 spawns a task in contid 4. An event happens in the task in contid 4:
type=SYSCALL ...
type=CONTAINER_ID msg=audit(<date.time>:<serno>): contid=4,^2,^1For a network namespace event example, an orchestrator in contid 1 in network namespace A spawns peer tasks 2 and 3 in network namespace B. An event happens in network namespace B:
type=NETFILTER_PKT ...
type=CONTAINER_ID msg=audit(<date.time>:<serno>): contid=2,^1,3,^1--- kernel/audit.c | 75 +++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 62 insertions(+), 13 deletions(-)
kernel/audit.c +62 -13
@@ -231,6 +231,7 @@ struct audit_contobj {refcount_t refcount;refcount_t sigflag;struct rcu_head rcu; +struct audit_contobj *parent; };struct audit_task_info {
@@ -253,6 +254,7 @@ struct audit_contobj_netns {static void audit_netns_contid_add (struct net *net,struct audit_contobj *cont);static void audit_netns_contid_del (struct net *net,struct audit_contobj *cont); +static void audit_log_contid (struct audit_buffer *ab,struct audit_contobj *cont);void __init audit_task_init (void ) {
@@ -378,6 +380,7 @@ static void _audit_contobj_put_sig(struct audit_contobj *cont)refcount_set (&cont->sigflag,0 );if (!refcount_read (&cont->refcount)) {put_task_struct (cont->owner); +_audit_contobj_put (cont->parent);list_del_rcu (&cont->list);kfree_rcu (cont, rcu); }
@@ -721,11 +724,11 @@ int audit_log_netns_contid_list(struct net *net, struct audit_context *context)audit_log_lost ("out of memory in audit_log_netns_contid_list" ); goto out; } -audit_log_format (ab,"record=1 contid=%llu" , - cont->obj->id); +audit_log_format (ab,"record=1 contid=" ); }else { -audit_log_format (ab,",%llu" , cont->obj->id); +audit_log_format (ab,"," ); } +audit_log_contid (ab, cont->obj); }audit_log_end (ab); out:
@@ -1905,6 +1908,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)case AUDIT_SIGNAL_INFO2 : {char *contidstr =NULL ;unsigned int contidstrlen =0 ; +struct audit_contobj *cont = audit_sig_cid; len =0 ;if (audit_sig_sid) {
@@ -1914,13 +1918,27 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)return err; }if (audit_sig_cid) { - contidstr =kmalloc (21 ,GFP_KERNEL ); + contidstr =kmalloc (AUDIT_MESSAGE_TEXT_MAX ,GFP_KERNEL );if (!contidstr) {if (audit_sig_sid)security_release_secctx (ctx, len);return -ENOMEM ; } - contidstrlen =scnprintf (contidstr,20 ,"%llu" , audit_sig_cid->id); +rcu_read_lock (); +while (cont) { +if (cont->parent) + contidstrlen +=scnprintf (contidstr, +AUDIT_MESSAGE_TEXT_MAX - + contidstrlen, +"%llu,^" , cont->id); +else + contidstrlen +=scnprintf (contidstr, +AUDIT_MESSAGE_TEXT_MAX - + contidstrlen, +"%llu" , cont->id); + cont = cont->parent; + } +rcu_read_unlock (); } sig_data2 =kmalloc (sizeof (*sig_data2) + contidstrlen + len,GFP_KERNEL );if (!sig_data2) {
@@ -2607,6 +2625,23 @@ void audit_log_session_info(struct audit_buffer *ab)audit_log_format (ab,"auid=%u ses=%u" , auid, sessionid); } +static void audit_log_contid (struct audit_buffer *ab,struct audit_contobj *cont) +{ +if (!cont) { +audit_log_format (ab,"-1" ); +return ; + } +rcu_read_lock (); +while (cont) { +if (cont->parent) +audit_log_format (ab,"%llu,^" , cont->id); +else +audit_log_format (ab,"%llu" , cont->id); + cont = cont->parent; + } +rcu_read_unlock (); +} +/* * _audit_log_container_id - report container info * @context: task or local context for record
@@ -2626,8 +2661,9 @@ static int _audit_log_container_id(struct audit_context *context, ab =audit_log_start (context,GFP_KERNEL ,AUDIT_CONTAINER_ID );if (!ab)return 0 ; -audit_log_format (ab,"record=%d contid=%llu" , - record = ++context->contid_records, contobj->id); +audit_log_format (ab,"record=%d contid=" , + record = ++context->contid_records); +audit_log_contid (ab, contobj);audit_log_end (ab);return record; }
@@ -2663,7 +2699,18 @@ int audit_log_container_id_ctx(struct audit_context *context)int audit_contid_comparator (struct task_struct *tsk,u32 op,u64 right) { -return audit_comparator64 (audit_get_contid (tsk), op, right); +struct audit_contobj *cont =NULL ; +int h; +int result =0 ; +u64 left =audit_get_contid (tsk); + + h =audit_hash_contid (left); +list_for_each_entry_rcu (cont, &audit_contid_hash[h], list) { + result =audit_comparator64 (cont->id, op, right); +if (result) +break ; + } +return result; }void audit_log_key (struct audit_buffer *ab,char *key)
@@ -3018,6 +3065,7 @@ int audit_set_contid(struct task_struct *tsk, u64 contid)INIT_LIST_HEAD (&newcont->list); newcont->id = contid; newcont->owner =get_task_struct (current); + newcont->parent =_audit_contobj_get_bytask (newcont->owner);refcount_set (&newcont->refcount,1 );list_add_rcu (&newcont->list, &audit_contid_hash[h]);
@@ -3046,9 +3094,9 @@ int audit_set_contid(struct task_struct *tsk, u64 contid)if (!ab)return rc; -audit_log_format (ab, -"op=set opid=%d contid=%llu old-contid=%llu" , -task_tgid_nr (tsk), contid, oldcont ? oldcont->id :-1 ); +audit_log_format (ab,"op=set opid=%d contid=%llu old-contid=" , +task_tgid_nr (tsk), contid); +audit_log_contid (ab, oldcont);spin_lock_irqsave (&_audit_contobj_list_lock, flags);_audit_contobj_put (oldcont);spin_unlock_irqrestore (&_audit_contobj_list_lock, flags);
@@ -3087,8 +3135,9 @@ void audit_log_container_drop(void) ab =audit_log_start (audit_context (),GFP_KERNEL ,AUDIT_CONTAINER_OP );if (!ab) goto out; -audit_log_format (ab,"op=drop opid=%d contid=-1 old-contid=%llu" , -task_tgid_nr (current), cont->id); +audit_log_format (ab,"op=drop opid=%d contid=-1 old-contid=" , +task_tgid_nr (current)); +audit_log_contid (ab, cont);audit_log_end (ab); out:spin_lock_irqsave (&_audit_contobj_list_lock, flags);
Signature · 6 lines
2.18.4 -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
PATCH v10 11/11 audit: add capcontid to set contid outside init_user_ns
In reply to Richard Guy BriggsProvide a mechanism similar to CAP_AUDIT_CONTROL to explicitly give a process in a non-init user namespace the capability to set audit container identifiers of individual children.
Provide the /proc/$PID/audit_capcontid interface to capcontid. Valid values are: 1==enabled, 0==disabled
Writing a "1" to this special file for the target process $PID will enable the target process to set audit container identifiers of its descendants.
A process must already have CAP_AUDIT_CONTROL in the initial user namespace or have had audit_capcontid enabled by a previous use of this feature by its parent on this process in order to be able to enable it for another process. The target process must be a descendant of the calling process.
Report this action in new message type AUDIT_SET_CAPCONTID 1022 with fields opid= capcontid= old-capcontid=
Add an entry to Documentation/ABI.
--- .../ABI/testing/procfs-audit_containerid | 16 +++++ fs/proc/base.c | 54 +++++++++++++++ include/linux/audit.h | 4 +- include/uapi/linux/audit.h | 1 + kernel/audit.c | 65 ++++++++++++++++++- 5 files changed, 137 insertions(+), 3 deletions(-)
Documentation/ABI/testing/procfs-audit_containerid +16 -0
@@ -11,3 +11,19 @@ Description: or have its own /proc/$pid/capcontainerid set to write or read. + +What: Capability to set or get the Audit Container Identifier +Date: 2020-?? +KernelVersion: 5.10? +Contact: [email protected] +Format: u32 +Users: auditd, libaudit, audit-testsuite, podman(?), container orchestrators +Description: + The /proc/$pid/audit_capcontainerid pseudofile is + written to set and is read to get the capability of + process $pid to write or to read the /proc/$pid/containerid + audit container identifier of any of its descendants. + "1" allows and "0" denies that capability. This + property is an extension to CAP_AUDIT_CONTROL outside of + the initial user namespace. +
fs/proc/base.c +54 -0
72 lines not on this page · raw message
include/linux/audit.h +3 -1
@@ -214,8 +214,10 @@ extern void audit_set_sessionid_iouring(unsigned int sessionid);extern int audit_get_contid_proc (char *tmpbuf,int TMPBUFLEN ,struct task_struct *task); - +extern int audit_get_capcontid_proc (char *tmpbuf,int TMPBUFLEN , +struct task_struct *task);extern int audit_set_contid (struct task_struct *tsk,u64 contid); +extern int audit_set_capcontid (struct task_struct *tsk,u32 enable);extern void audit_copy_namespaces (struct net *net,struct task_struct *tsk); extern void audit_switch_task_namespaces(struct nsproxy *ns,
include/uapi/linux/audit.h +1 -0
@@ -73,6 +73,7 @@#define AUDIT_GET_FEATURE 1019/* Get which features are enabled */ #define AUDIT_CONTAINER_OP 1020/* Define the container id and info */ #define AUDIT_SIGNAL_INFO2 1021/* Get info auditd signal sender */ +#define AUDIT_SET_CAPCONTID 1022/* Set cap_contid of a task */ #define AUDIT_FIRST_USER_MSG 1100/* Userspace messages mostly uninteresting to kernel */ #define AUDIT_USER_AVC 1107/* We filter this differently */
kernel/audit.c +63 -2
101 lines not on this page · raw message
Signature · 6 lines
2.18.4 _______________________________________________ Containers mailing list [email protected] https://lists.linuxfoundation.org/mailman/listinfo/containers