Skip to contentSkip to conversation

log more info for directory entry change events

PATCH In review Amy Griffis 2 participants 4 messages Jun 9, 2006 – Jun 12, 2006

Subsystems (3)
VFS Audit Fsnotify: filesystem notification infrastructure
lore
Share & tools
lore

Amy Griffis

author
#0 lore raw

PATCH 1/1 log more info for directory entry change events

When an audit event involves changes to a directory entry, include a PATH record for the directory itself. A few other notable changes:

- fixed audit_inode_child() hooks in fsnotify_move()
- removed unused flags arg from audit_inode()
- added audit log routines for logging a portion of a string

Here's some sample output.

before patch:
type=SYSCALL msg=audit(1149821605.320:26): arch=40000003 syscall=39 success=yes exit=0 a0=bf8d3c7c a1=1ff a2=804e1b8 a3=bf8d3c7c items=1 ppid=739 pid=800 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS0 comm="mkdir" exe="/bin/mkdir" subj=root:system_r:unconfined_t:s0-s0:c0.c255 type=CWD msg=audit(1149821605.320:26): cwd="/root"
type=PATH msg=audit(1149821605.320:26): item=0 name="foo" parent=164068 inode=164010 dev=03:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=root:object_r:user_home_t:s0

after patch:
type=SYSCALL msg=audit(1149822032.332:24): arch=40000003 syscall=39 success=yes exit=0 a0=bfdd9c7c a1=1ff a2=804e1b8 a3=bfdd9c7c items=2 ppid=714 pid=777 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS0 comm="mkdir" exe="/bin/mkdir" subj=root:system_r:unconfined_t:s0-s0:c0.c255 type=CWD msg=audit(1149822032.332:24): cwd="/root"
type=PATH msg=audit(1149822032.332:24): item=0 name="/root" inode=164068 dev=03:00 mode=040750 ouid=0 ogid=0 rdev=00:00 obj=root:object_r:user_home_dir_t:s0
type=PATH msg=audit(1149822032.332:24): item=1 name="foo" inode=164010 dev=03:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=root:object_r:user_home_t:s0

Signed-off-by Amy Griffis <[email protected]>

---

 fs/namei.c               |    2 -
 fs/open.c                |    4 +
 fs/xattr.c               |    4 +
 include/linux/audit.h    |   15 +++---
 include/linux/fsnotify.h |    3 -
 kernel/audit.c           |   54 +++++++++++++++++++-
 kernel/audit.h           |    3 +
 kernel/auditfilter.c     |    8 ++-
 kernel/auditsc.c         |  123 ++++++++++++++++++++++++++--------------------
 9 files changed, 142 insertions(+), 74 deletions(-)

4080b3bfb911fc9501a7256ed59da3c159ced915

fs/namei.c +1 -1
index 96723ae..6c5ae0d 100644
@@ -1125,7 +1125,7 @@ out:
 	if (likely(retval == 0)) {
 		if (unlikely(current->audit_context && nd && nd->dentry &&
 				nd->dentry->d_inode))
-		audit_inode(name, nd->dentry->d_inode, flags);
+		audit_inode(name, nd->dentry->d_inode);
 	}
 	return retval;
fs/open.c +2 -2
index 317b7c7..4f178ac 100644
@@ -633,7 +633,7 @@ asmlinkage long sys_fchmod(unsigned int 
 	dentry = file->f_dentry;
 	inode = dentry->d_inode;
 
-	audit_inode(NULL, inode, 0);
+	audit_inode(NULL, inode);
 
 	err = -EROFS;
 	if (IS_RDONLY(inode))

@@ -786,7 +786,7 @@ asmlinkage long sys_fchown(unsigned int 
 	if (file) {
 		struct dentry * dentry;
 		dentry = file->f_dentry;
-		audit_inode(NULL, dentry->d_inode, 0);
+		audit_inode(NULL, dentry->d_inode);
 		error = chown_common(dentry, user, group);
 		fput(file);
 	}
fs/xattr.c +2 -2
index e416190..c32f15b 100644
@@ -242,7 +242,7 @@ sys_fsetxattr(int fd, char __user *name,
 	if (!f)
 		return error;
 	dentry = f->f_dentry;
-	audit_inode(NULL, dentry->d_inode, 0);
+	audit_inode(NULL, dentry->d_inode);
 	error = setxattr(dentry, name, value, size, flags);
 	fput(f);
 	return error;

@@ -469,7 +469,7 @@ sys_fremovexattr(int fd, char __user *na
 	if (!f)
 		return error;
 	dentry = f->f_dentry;
-	audit_inode(NULL, dentry->d_inode, 0);
+	audit_inode(NULL, dentry->d_inode);
 	error = removexattr(dentry, name);
 	fput(f);
 	return error;
include/linux/audit.h +9 -6
index c783275..295defe 100644
@@ -310,7 +310,7 @@ extern void audit_syscall_entry(int arch
 extern void audit_syscall_exit(int failed, long return_code);
 extern void __audit_getname(const char *name);
 extern void audit_putname(const char *name);
-extern void __audit_inode(const char *name, const struct inode *inode, unsigned flags);
+extern void __audit_inode(const char *name, const struct inode *inode);
 extern void __audit_inode_child(const char *dname, const struct inode *inode,
 				unsigned long pino);
 static inline void audit_getname(const char *name)

@@ -318,10 +318,9 @@ static inline void audit_getname(const c
 	if (unlikely(current->audit_context))
 		__audit_getname(name);
 }
-static inline void audit_inode(const char *name, const struct inode *inode,
-			       unsigned flags) {
+static inline void audit_inode(const char *name, const struct inode *inode) {
 	if (unlikely(current->audit_context))
-		__audit_inode(name, inode, flags);
+		__audit_inode(name, inode);
 }
 static inline void audit_inode_child(const char *dname, 
 				     const struct inode *inode, 

@@ -398,9 +397,9 @@ #define audit_syscall_entry(ta,a,b,c,d,e
 #define audit_syscall_exit(f,r) do { ; } while (0)
 #define audit_getname(n) do { ; } while (0)
 #define audit_putname(n) do { ; } while (0)
-#define __audit_inode(n,i,f) do { ; } while (0)
+#define __audit_inode(n,i) do { ; } while (0)
 #define __audit_inode_child(d,i,p) do { ; } while (0)
-#define audit_inode(n,i,f) do { ; } while (0)
+#define audit_inode(n,i) do { ; } while (0)
 #define audit_inode_child(d,i,p) do { ; } while (0)
 #define auditsc_get_stamp(c,t,s) do { BUG(); } while (0)
 #define audit_get_loginuid(c) ({ -1; })

@@ -435,6 +434,9 @@ extern void		    audit_log_hex(struct au
 					  size_t len);
 extern const char *	    audit_log_untrustedstring(struct audit_buffer *ab,
 						      const char *string);
+extern const char *	    audit_log_n_untrustedstring(struct audit_buffer *ab,
+							unsigned n,
+							const char *string);
 extern void		    audit_log_d_path(struct audit_buffer *ab,
 					     const char *prefix,
 					     struct dentry *dentry,

@@ -452,6 +454,7 @@ #define audit_log_format(b,f,...) do { ;
 #define audit_log_end(b) do { ; } while (0)
 #define audit_log_hex(a,b,l) do { ; } while (0)
 #define audit_log_untrustedstring(a,s) do { ; } while (0)
+#define audit_log_n_untrustedstring(a,n,s) do { ; } while (0)
 #define audit_log_d_path(b,p,d,v) do { ; } while (0)
 #endif
 #endif
include/linux/fsnotify.h +1 -2
index a9d3044..cc5dec7 100644
@@ -67,8 +67,7 @@ static inline void fsnotify_move(struct 
 	if (source) {
 		inotify_inode_queue_event(source, IN_MOVE_SELF, 0, NULL, NULL);
 	}
-	audit_inode_child(old_name, source, old_dir->i_ino);
-	audit_inode_child(new_name, target, new_dir->i_ino);
+	audit_inode_child(new_name, source, new_dir->i_ino);
 }
 
 /*
kernel/audit.c +50 -4

80 lines not on this page · raw message

kernel/audit.h +2 -1
index 58fa44c..8323e41 100644
@@ -104,7 +104,8 @@ static inline int audit_hash_ino(u32 ino
 }
 
 extern int audit_comparator(const u32 left, const u32 op, const u32 right);
-extern int audit_compare_dname_path(const char *dname, const char *path);
+extern int audit_compare_dname_path(const char *dname, const char *path,
+				    int *dirlen);
 extern struct sk_buff *	    audit_make_reply(int pid, int seq, int type,
 					     int done, int multi,
 					     void *payload, int size);
kernel/auditfilter.c +6 -2
index 461f404..30015fd 100644
@@ -787,7 +787,7 @@ static inline void audit_update_watch(st
 
 	mutex_lock(&audit_filter_mutex);
 	list_for_each_entry_safe(owatch, nextw, &parent->watches, wlist) {
-		if (audit_compare_dname_path(dname, owatch->path))
+		if (audit_compare_dname_path(dname, owatch->path, NULL))
 			continue;
 
 		/* If the update involves invalidating rules, do the inode-based

@@ -1387,7 +1387,8 @@ int audit_comparator(const u32 left, con
 
 /* Compare given dentry name with last component in given path,
  * return of 0 indicates a match. */
-int audit_compare_dname_path(const char *dname, const char *path)
+int audit_compare_dname_path(const char *dname, const char *path,
+			     int *dirlen)
 {
 	int dlen, plen;
 	const char *p;

@@ -1416,6 +1417,9 @@ int audit_compare_dname_path(const char 
 			p++;
 	}
 
+	/* return length of path's directory component */
+	if (dirlen)
+		*dirlen = p - path;
 	return strncmp(p, dname, dlen);
 }
kernel/auditsc.c +69 -54

229 lines not on this page · raw message

Signature · 1 line
1.3.0
#1 lore raw

include/linux/audit.h extern void audit_log_hex(struct au

Quoted 6 lines · Amy Griffis
include/linux/audit.h +5 -0
+extern const char *	    audit_log_n_untrustedstring(struct audit_buffer *ab,
+							unsigned n,
+							const char *string);
 
+static void audit_log_n_string(struct audit_buffer *ab, size_t slen,
+			       const char *string)

... and size_t != unsigned. Fixed in git tree.

#2 lore raw
Quoted 8 lines · Alexander Viro

include/linux/audit.h extern void audit_log_hex(struct au

Quoted 6 lines · Amy Griffis
include/linux/audit.h +5 -0
+extern const char *	    audit_log_n_untrustedstring(struct audit_buffer *ab,
+							unsigned n,
+							const char *string);
 
+static void audit_log_n_string(struct audit_buffer *ab, size_t slen,
+			       const char *string)

Er...

kernel/audit.c void audit_log_hex(struct audit_buffer * · line 1098

Quoted 2 lines
kernel/audit.c +2 -0
+const char *audit_log_n_untrustedstring(struct audit_buffer *ab, size_t len,
+                                       const char *string)

actually.

Quoted 1 line

... and size_t != unsigned. Fixed in git tree.

author
#3 lore raw
Quoted 12 lines · Alexander Viro
Quoted 8 lines · Alexander Viro

include/linux/audit.h extern void audit_log_hex(struct au

Quoted 6 lines · Amy Griffis
include/linux/audit.h +5 -0
+extern const char *	    audit_log_n_untrustedstring(struct audit_buffer *ab,
+							unsigned n,
+							const char *string);
 
+static void audit_log_n_string(struct audit_buffer *ab, size_t slen,
+			       const char *string)

Er...

Quoted 6 lines

kernel/audit.c void audit_log_hex(struct audit_buffer * · line 1098

Quoted 2 lines
kernel/audit.c +2 -0
+const char *audit_log_n_untrustedstring(struct audit_buffer *ab, size_t len,
+                                       const char *string)

actually.

Quoted 1 line

... and size_t != unsigned. Fixed in git tree.

Thanks, Al.