audit: log binding and unbinding to netlink multicast socket
PATCH 2/2 audit: log binding and unbinding to netlink multicast socket
Log information about programs connecting and disconnecting to the audit netlink multicast socket. This is needed so that during investigations a security officer can tell who or what had access to the audit trail. This helps to meet the FAU_SAR.2 requirement for Common Criteria.
--- include/uapi/linux/audit.h | 1 + kernel/audit.c | 30 ++++++++++++++++++++++++++++-- 2 files changed, 29 insertions(+), 2 deletions(-)
include/uapi/linux/audit.h +1 -0
@@ -110,6 +110,7 @@#define AUDIT_SECCOMP 1326/* Secure Computing event */ #define AUDIT_PROCTITLE 1327/* Proctitle emit event */ #define AUDIT_FEATURE_CHANGE 1328/* audit log listing feature changes */ +#define AUDIT_EVENT_LISTENER 1329/* task joined multicast read socket */ #define AUDIT_AVC 1400/* SE Linux avc denial or grant */ #define AUDIT_SELINUX_ERR 1401/* Internal SE Linux Errors */
kernel/audit.c +26 -2
@@ -1135,13 +1135,36 @@ void audit_log_task_simple(struct audit_buffer *ab, struct task_struct *tsk) }EXPORT_SYMBOL (audit_log_task_simple); +static void audit_log_bind (int group,const char *op,int err) +{ +struct audit_buffer *ab; + + ab =audit_log_start (NULL ,GFP_KERNEL ,AUDIT_EVENT_LISTENER ); +if (!ab) +return ; + +audit_log_task_simple (ab, current); +audit_log_format (ab," nlnk-grp=%d" , group); +audit_log_format (ab," op=%s" , op); +audit_log_format (ab," res=%d" , !err); +audit_log_end (ab); +} +/* Run custom bind function on netlink socket group connect or bind requests. */ static int audit_bind (struct net *net,int group) { +int err =0 ; +if (!capable (CAP_AUDIT_READ )) -return -EPERM ; + err = -EPERM ; +audit_log_bind (group,"connect" , err); -return 0 ; +return err; +} + +static void audit_unbind (struct net *net,int group) +{ +audit_log_bind (group,"disconnect" ,0 ); }static int __net_init audit_net_init (struct net *net)
@@ -1151,6 +1176,7 @@ static int __net_init audit_net_init(struct net *net) .bind = audit_bind, .flags = NL_CFG_F_NONROOT_RECV, .groups = AUDIT_NLGRP_MAX, + .unbind = audit_unbind, };struct audit_net *aunet =net_generic (net, audit_net_id);
Signature · 1 line
2.4.3
Quoted 10 lines · Steve Grubb
Log information about programs connecting and disconnecting to the audit netlink multicast socket. This is needed so that during investigations a security officer can tell who or what had access to the audit trail. This helps to meet the FAU_SAR.2 requirement for Common Criteria.
Signed-off-by Steve Grubb <[email protected]>--- include/uapi/linux/audit.h | 1 + kernel/audit.c | 30 ++++++++++++++++++++++++++++-- 2 files changed, 29 insertions(+), 2 deletions(-)
...
kernel/audit.c void audit_log_task_simple(struct audit_buffer *ab, · line 1139
Quoted 10 lines
kernel/audit.c +2
-0@@ -1135,13 +1135,36 @@ void audit_log_task_simple(struct audit_buffer *ab, struct task_struct *tsk) }EXPORT_SYMBOL (audit_log_task_simple); +static void audit_log_bind (int group,const char *op,int err) +{
Hmmm, how about a name tweak to indicate multicast? How about audit_log_multicast_bind()?
kernel/audit.c void audit_log_task_simple(struct audit_buffer *ab, struct task_struct *tsk) · line 1150
Quoted 11 lines
kernel/audit.c +11
-0+struct audit_buffer *ab; + + ab =audit_log_start (NULL ,GFP_KERNEL ,AUDIT_EVENT_LISTENER ); +if (!ab) +return ; + +audit_log_task_simple (ab, current); +audit_log_format (ab," nlnk-grp=%d" , group); +audit_log_format (ab," op=%s" , op); +audit_log_format (ab," res=%d" , !err); +audit_log_end (ab);
Any reason we can't do this with one audit_log_format() call?
audit_log_format(ab, "nlnk-grp=%d op=%s res=%d", group, op, !err);
Signature · 2 lines
paul moore security @ redhat