audit: implement container identifier

Implement the proc fs write to set the audit container identifier of a process, emitting an AUDIT_CONTAINER_OP record to document the event.

This is a write from the container orchestrator task to a proc entry of the form /proc/PID/audit_containerid where PID is the process ID of the newly created task that is to become the first task in a container, or an additional task added to a container.

The write expects up to a u64 value (unset: 18446744073709551615).

The writer must have capability CAP_AUDIT_CONTROL.

This will produce a record such as this:
type=CONTAINER_ID msg=audit(2018-06-06 12:39:29.636:26949) : op=set
opid=2209 old-contid=18446744073709551615 contid=123456 pid=628 auid=root uid=root tty=ttyS0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 comm=bash exe=/usr/bin/bash res=yes

The "op" field indicates an initial set.

The "pid" to "ses" fields are
the orchestrator while the "opid" field is the object's PID, the process being "contained". Old and new audit container identifier values are given in the "contid" fields, while res indicates its success.

It is not permitted to unset the audit container identifier. A child inherits its parent's audit container identifier.

See: https://github.com/linux-audit/audit-kernel/issues/90
See: https://github.com/linux-audit/audit-userspace/issues/51
See: https://github.com/linux-audit/audit-testsuite/issues/64
See:
https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID

Signed-off-by Richard Guy Briggs <[email protected]>

Acked-by Serge Hallyn <[email protected]>

Acked-by Steve Grubb <[email protected]>

---
 fs/proc/base.c             | 37 +++++++++++++++++++++++++
 include/linux/audit.h      | 24 ++++++++++++++++
 include/uapi/linux/audit.h |  2 ++
 kernel/auditsc.c           | 68

++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 131 insertions(+)

fs/proc/base.c +34 -0

index b657294..1b3cda1 100644
@@ -1260,6 +1260,41 @@ static ssize_t proc_sessionid_read(struct file *
 file, char __user * buf, .read		= proc_sessionid_read,
 	.llseek		= generic_file_llseek,
 };
+
+static ssize_t proc_contid_write(struct file *file, const char __user
 *buf, +				   size_t count, loff_t *ppos)
+{
+	struct inode *inode = file_inode(file);
+	u64 contid;
+	int rv;
+	struct task_struct *task = get_proc_task(inode);
+
+	if (!task)
+		return -ESRCH;
+	if (*ppos != 0) {
+		/* No partial writes. */
+		put_task_struct(task);
+		return -EINVAL;
+	}
+
+	rv = kstrtou64_from_user(buf, count, 10, &contid);
+	if (rv < 0) {
+		put_task_struct(task);
+		return rv;
+	}
+
+	rv = audit_set_contid(task, contid);
+	put_task_struct(task);
+	if (rv < 0)
+		return rv;
+	return count;
+}
+
+static const struct file_operations proc_contid_operations = {
+	.write		= proc_contid_write,
+	.llseek		= generic_file_llseek,
+};
+
 #endif
 
 #ifdef CONFIG_FAULT_INJECTION

@@ -2952,6 +2987,7 @@ static int proc_pid_patch_state(struct seq_file *m,

struct pid_namespace *ns, #ifdef CONFIG_AUDITSYSCALL

fs/proc/base.c +2 -0

 	REG("loginuid",   S_IWUSR|S_IRUGO, proc_loginuid_operations),
 	REG("sessionid",  S_IRUGO, proc_sessionid_operations),
+	REG("audit_containerid", S_IWUSR, proc_contid_operations),
 #endif
 #ifdef CONFIG_FAULT_INJECTION
 	REG("make-it-fail", S_IRUGO|S_IWUSR, proc_fault_inject_operations),

@@ -3337,6 +3373,7 @@ static int proc_tid_comm_permission(struct inode
 *inode, int mask) #ifdef CONFIG_AUDITSYSCALL
 	REG("loginuid",  S_IWUSR|S_IRUGO, proc_loginuid_operations),
 	REG("sessionid",  S_IRUGO, proc_sessionid_operations),
+	REG("audit_containerid", S_IWUSR, proc_contid_operations),
 #endif
 #ifdef CONFIG_FAULT_INJECTION
 	REG("make-it-fail", S_IRUGO|S_IWUSR, proc_fault_inject_operations),

include/linux/audit.h +24 -0

index 8964332..71a6fc6 100644
@@ -222,6 +222,7 @@ static inline void audit_log_task_info(struct
 audit_buffer *ab, struct audit_task_info {
 	kuid_t			loginuid;
 	unsigned int		sessionid;
+	u64			contid;
 	struct audit_context	*ctx;
 };
 extern struct audit_task_info init_struct_audit;

@@ -334,6 +335,7 @@ static inline void audit_ptrace(struct task_struct *t)
 extern int auditsc_get_stamp(struct audit_context *ctx,
 			      struct timespec64 *t, unsigned int *serial);
 extern int audit_set_loginuid(kuid_t loginuid);
+extern int audit_set_contid(struct task_struct *tsk, u64 contid);
 
 static inline kuid_t audit_get_loginuid(struct task_struct *tsk)
 {

@@ -351,6 +353,14 @@ static inline unsigned int audit_get_sessionid(struct
 task_struct *tsk) return AUDIT_SID_UNSET;
 }
 
+static inline u64 audit_get_contid(struct task_struct *tsk)
+{
+	if (!tsk->audit)
+		return AUDIT_CID_UNSET;
+	else
+		return tsk->audit->contid;
+}
+
 extern void __audit_ipc_obj(struct kern_ipc_perm *ipcp);
 extern void __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t
 gid, umode_t mode); extern void __audit_bprm(struct linux_binprm *bprm);

@@ -545,6 +555,10 @@ static inline unsigned int audit_get_sessionid(struct
 task_struct *tsk) {
 	return AUDIT_SID_UNSET;
 }
+static inline kuid_t audit_get_contid(struct task_struct *tsk)
+{
+	return AUDIT_CID_UNSET;
+}
 static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
 { }
 static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid,

@@ -609,6 +623,16 @@ static inline bool audit_loginuid_set(struct
 task_struct *tsk) return uid_valid(audit_get_loginuid(tsk));
 }
 
+static inline bool audit_contid_valid(u64 contid)
+{
+	return contid != AUDIT_CID_UNSET;
+}
+
+static inline bool audit_contid_set(struct task_struct *tsk)
+{
+	return audit_contid_valid(audit_get_contid(tsk));
+}
+
 static inline void audit_log_string(struct audit_buffer *ab, const char
 *buf) {
 	audit_log_n_string(ab, buf, strlen(buf));

include/uapi/linux/audit.h +1 -0

index 4e3eaba..3474f57 100644
@@ -71,6 +71,7 @@
 #define AUDIT_TTY_SET		1017	/* Set TTY auditing status */
 #define AUDIT_SET_FEATURE	1018	/* Turn an audit feature on or off */
 #define AUDIT_GET_FEATURE	1019	/* Get which features are enabled */
+#define AUDIT_CONTAINER_OP	1020	/* Define the container id and information
 */
 
 #define AUDIT_FIRST_USER_MSG	1100	/* Userspace messages mostly

uninteresting to kernel */ #define AUDIT_USER_AVC 1107 /* We filter this
differently */

include/uapi/linux/audit.h +1 -0

@@ -468,6 +469,7 @@ struct audit_tty_status {
 
 #define AUDIT_UID_UNSET (unsigned int)-1
 #define AUDIT_SID_UNSET ((unsigned int)-1)
+#define AUDIT_CID_UNSET ((u64)-1)
 
 /* audit_rule_data supports filter rules with both integer and string
  * fields.  It corresponds with AUDIT_ADD_RULE, AUDIT_DEL_RULE and

kernel/auditsc.c +43 -0

index 88779a7..6125cef 100644
@@ -956,6 +956,7 @@ int audit_alloc(struct task_struct *tsk)
 		return -ENOMEM;
 	info->loginuid = audit_get_loginuid(current);
 	info->sessionid = audit_get_sessionid(current);
+	info->contid = audit_get_contid(current);
 	tsk->audit = info;
 
 	if (likely(!audit_ever_enabled))

@@ -985,6 +986,7 @@ int audit_alloc(struct task_struct *tsk)
 struct audit_task_info init_struct_audit = {
 	.loginuid = INVALID_UID,
 	.sessionid = AUDIT_SID_UNSET,
+	.contid = AUDIT_CID_UNSET,
 	.ctx = NULL,
 };
 

@@ -2112,6 +2114,72 @@ int audit_set_loginuid(kuid_t loginuid)
 }
 
 /**
+ * audit_set_contid - set current task's audit_context contid
+ * @contid: contid value
+ *
+ * Returns 0 on success, -EPERM on permission failure.
+ *
+ * Called (set) from fs/proc/base.c::proc_contid_write().
+ */
+int audit_set_contid(struct task_struct *task, u64 contid)
+{
+	u64 oldcontid;
+	int rc = 0;
+	struct audit_buffer *ab;
+	uid_t uid;
+	struct tty_struct *tty;
+	char comm[sizeof(current->comm)];
+
+	task_lock(task);
+	/* Can't set if audit disabled */
+	if (!task->audit) {
+		task_unlock(task);
+		return -ENOPROTOOPT;
+	}
+	oldcontid = audit_get_contid(task);
+	read_lock(&tasklist_lock);
+	/* Don't allow the audit containerid to be unset */
+	if (!audit_contid_valid(contid))
+		rc = -EINVAL;
+	/* if we don't have caps, reject */
+	else if (!capable(CAP_AUDIT_CONTROL))
+		rc = -EPERM;
+	/* if task has children or is not single-threaded, deny */
+	else if (!list_empty(&task->children))
+		rc = -EBUSY;
+	else if (!(thread_group_leader(task) && thread_group_empty(task)))
+		rc = -EALREADY;
+	read_unlock(&tasklist_lock);
+	if (!rc)
+		task->audit->contid = contid;
+	task_unlock(task);
+
+	if (!audit_enabled)

kernel/auditsc.c +15 -0

+			 task_tgid_nr(current), uid,
+			 from_kuid(&init_user_ns, audit_get_loginuid(current)),
+			 tty ? tty_name(tty) : "(none)",
+			 audit_get_sessionid(current));
+	audit_put_tty(tty);
+	audit_log_task_context(ab);
+	audit_log_format(ab, " comm=");
+	audit_log_untrustedstring(ab, get_task_comm(comm, current));
+	audit_log_d_path_exe(ab, current->mm);
+	audit_log_format(ab, " res=%d", !rc);
+	audit_log_end(ab);
+	return rc;
+}
+
+/**
  * __audit_mq_open - record audit data for a POSIX MQ open
  * @oflag: open flag
  * @mode: mode bits

Create a new audit record AUDIT_CONTAINER to document the audit container identifier of a process if it is present.

Called from audit_log_exit(), syscalls are covered.

A sample raw event:
type=SYSCALL msg=audit(1519924845.499:257): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=56374e1cef30 a2=241 a3=1b6 items=2 ppid=606 pid=635 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="tmpcontainerid" type=CWD msg=audit(1519924845.499:257): cwd="/root" type=PATH msg=audit(1519924845.499:257): item=0 name="/tmp/" inode=13863 dev=00:27 mode=041777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tmp_t:s0 nametype= PARENT cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0 type=PATH

msg=audit(1519924845.499:257): item=1 name="/tmp/tmpcontainerid" inode=17729 dev=00:27 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 nametype=CREATE cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0 type=PROCTITLE msg=audit(1519924845.499:257):
proctitle=62617368002D6300736C65657020313B206563686F2074657374203E202F746D 702F746D70636F6E7461696E65726964 type=CONTAINER msg=audit(1519924845.499:257): op=task contid=123458

include/linux/audit.h +3 -0

 extern int audit_log_task_context(struct audit_buffer *ab);
 extern void audit_log_task_info(struct audit_buffer *ab,
 				struct task_struct *tsk);
+extern int audit_log_contid(struct task_struct *tsk,
+				    struct audit_context *context,
+				    char *op);
 
 extern int		    audit_update_lsm_rules(void);
 

@@ -205,6 +208,10 @@ static inline int audit_log_task_context(struct

audit_buffer *ab) static inline void audit_log_task_info(struct audit_buffer *ab,

include/linux/audit.h +4 -0

 				       struct task_struct *tsk)
 { }
+static inline int audit_log_contid(struct task_struct *tsk,
+					   struct audit_context *context,
+					   char *op)
+{ }
 #define audit_enabled AUDIT_OFF
 #endif /* CONFIG_AUDIT */

include/uapi/linux/audit.h +0 -0

index 3474f57..dc259c7 100644

include/uapi/linux/audit.h +1 -0

 #define AUDIT_KERN_MODULE	1330	/* Kernel Module events */
 #define AUDIT_FANOTIFY		1331	/* Fanotify access decision */
+#define AUDIT_CONTAINER		1332	/* Container ID */
 
 #define AUDIT_AVC		1400	/* SE Linux avc denial or grant */
 #define AUDIT_SELINUX_ERR	1401	/* Internal SE Linux Errors */

kernel/audit.c +24 -0

index 2a80587..15f54c7 100644
@@ -2045,6 +2045,30 @@ void audit_log_session_info(struct audit_buffer *ab)
 audit_log_format(ab, " auid=%u ses=%u", auid, sessionid);
 }
 
+/*
+ * audit_log_contid - report container info
+ * @tsk: task to be recorded
+ * @context: task or local context for record
+ * @op: contid string description
+ */
+int audit_log_contid(struct task_struct *tsk,
+			     struct audit_context *context, char *op)
+{
+	struct audit_buffer *ab;
+
+	if (!audit_contid_set(tsk))
+		return 0;
+	/* Generate AUDIT_CONTAINER record with container ID */
+	ab = audit_log_start(context, GFP_KERNEL, AUDIT_CONTAINER);
+	if (!ab)
+		return -ENOMEM;
+	audit_log_format(ab, "op=%s contid=%llu",
+			 op, audit_get_contid(tsk));
+	audit_log_end(ab);
+	return 0;
+}
+EXPORT_SYMBOL(audit_log_contid);
+
 void audit_log_key(struct audit_buffer *ab, char *key)
 {
 	audit_log_format(ab, " key=");

kernel/auditsc.c +3 -0

index 6125cef..39e5633 100644
@@ -1488,10 +1488,13 @@ static void audit_log_exit(struct audit_context
 *context, struct task_struct *ts
 
 	audit_log_proctitle(tsk, context);
 
+	audit_log_contid(tsk, context, "task");
+
 	/* Send end of event record to help user space know we are finished */
 	ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE);
 	if (ab)
 		audit_log_end(ab);
+
 	if (call_panic)
 		audit_panic("error converting sid to string");

}

Implement the proc fs write to set the audit container identifier of a process, emitting an AUDIT_CONTAINER_OP record to document the event.

This is a write from the container orchestrator task to a proc entry of the form /proc/PID/audit_containerid where PID is the process ID of the newly created task that is to become the first task in a container, or an additional task added to a container.

The write expects up to a u64 value (unset: 18446744073709551615).

The writer must have capability CAP_AUDIT_CONTROL.

This will produce a record such as this:
type=CONTAINER_ID msg=audit(2018-06-06 12:39:29.636:26949) : op=set opid=2209 old-contid=18446744073709551615 contid=123456 pid=628 auid=root uid=root tty=ttyS0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 comm=bash exe=/usr/bin/bash res=yes

The "op" field indicates an initial set. The "pid" to "ses" fields are the orchestrator while the "opid" field is the object's PID, the process being "contained". Old and new audit container identifier values are given in the "contid" fields, while res indicates its success.

It is not permitted to unset the audit container identifier. A child inherits its parent's audit container identifier.

See: https://github.com/linux-audit/audit-kernel/issues/90
See: https://github.com/linux-audit/audit-userspace/issues/51
See: https://github.com/linux-audit/audit-testsuite/issues/64
See: https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID

Signed-off-by Richard Guy Briggs <[email protected]>

Acked-by Serge Hallyn <[email protected]>

Acked-by Steve Grubb <[email protected]>

---
 fs/proc/base.c             | 37 +++++++++++++++++++++++++
 include/linux/audit.h      | 24 ++++++++++++++++
 include/uapi/linux/audit.h |  2 ++
 kernel/auditsc.c           | 68 ++++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 131 insertions(+)

kernel/auditsc.c +14 -0

@@ -2112,6 +2114,72 @@ int audit_set_loginuid(kuid_t loginuid)
 }
 
 /**
+ * audit_set_contid - set current task's audit_context contid
+ * @contid: contid value
+ *
+ * Returns 0 on success, -EPERM on permission failure.
+ *
+ * Called (set) from fs/proc/base.c::proc_contid_write().
+ */
+int audit_set_contid(struct task_struct *task, u64 contid)
+{
+       u64 oldcontid;
+       int rc = 0;
+       struct audit_buffer *ab;
+       uid_t uid;
+       struct tty_struct *tty;

kernel/auditsc.c +40 -0

+       /* Don't allow the audit containerid to be unset */
+       if (!audit_contid_valid(contid))
+               rc = -EINVAL;
+       /* if we don't have caps, reject */
+       else if (!capable(CAP_AUDIT_CONTROL))
+               rc = -EPERM;
+       /* if task has children or is not single-threaded, deny */
+       else if (!list_empty(&task->children))
+               rc = -EBUSY;
+       else if (!(thread_group_leader(task) && thread_group_empty(task)))
+               rc = -EALREADY;
+       read_unlock(&tasklist_lock);
+       if (!rc)
+               task->audit->contid = contid;
+       task_unlock(task);
+
+       if (!audit_enabled)
+               return rc;
+
+       ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONTAINER_OP);
+       if (!ab)
+               return rc;
+
+       uid = from_kuid(&init_user_ns, task_uid(current));
+       tty = audit_get_tty(current);
+       audit_log_format(ab, "op=set opid=%d old-contid=%llu contid=%llu pid=%d uid=%u auid=%u tty=%s ses=%u",
+                        task_tgid_nr(task), oldcontid, contid,
+                        task_tgid_nr(current), uid,
+                        from_kuid(&init_user_ns, audit_get_loginuid(current)),
+                        tty ? tty_name(tty) : "(none)",
+                        audit_get_sessionid(current));
+       audit_put_tty(tty);
+       audit_log_task_context(ab);
+       audit_log_format(ab, " comm=");
+       audit_log_untrustedstring(ab, get_task_comm(comm, current));
+       audit_log_d_path_exe(ab, current->mm);
+       audit_log_format(ab, " res=%d", !rc);
+       audit_log_end(ab);
+       return rc;
+}

Quoted 9 lines · Richard Guy Briggs

Implement the proc fs write to set the audit container identifier of a process, emitting an AUDIT_CONTAINER_OP record to document the event.

This is a write from the container orchestrator task to a proc entry of the form /proc/PID/audit_containerid where PID is the process ID of the newly created task that is to become the first task in a container, or an additional task added to a container.

Quoted 6 lines

The write expects up to a u64 value (unset: 18446744073709551615).

The writer must have capability CAP_AUDIT_CONTROL.

This will produce a record such as this:
type=CONTAINER_ID msg=audit(2018-06-06 12:39:29.636:26949) : op=set opid=2209 old-contid=18446744073709551615 contid=123456 pid=628 auid=root uid=root tty=ttyS0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 comm=bash exe=/usr/bin/bash res=yes

You need to update the record type in the example above.

Quoted 4 lines

The "op" field indicates an initial set. The "pid" to "ses" fields are the orchestrator while the "opid" field is the object's PID, the process being "contained". Old and new audit container identifier values are given in the "contid" fields, while res indicates its success.

I understand Steve's concern around the "op" field, but I think it might be a bit premature to think we might not need to do some sort of audit container ID management in the future that would want to make use of the CONTAINER_OP message type. I would like to see the "op" field preserved.

Quoted 17 lines

It is not permitted to unset the audit container identifier. A child inherits its parent's audit container identifier.

See: https://github.com/linux-audit/audit-kernel/issues/90
See: https://github.com/linux-audit/audit-userspace/issues/51
See: https://github.com/linux-audit/audit-testsuite/issues/64
See: https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID

Signed-off-by Richard Guy Briggs <[email protected]>

Acked-by Serge Hallyn <[email protected]>

Acked-by Steve Grubb <[email protected]>

---
 fs/proc/base.c             | 37 +++++++++++++++++++++++++
 include/linux/audit.h      | 24 ++++++++++++++++
 include/uapi/linux/audit.h |  2 ++
 kernel/auditsc.c           | 68 ++++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 131 insertions(+)

...

Quoted 18 lines

kernel/auditsc.c +14 -0

@@ -2112,6 +2114,72 @@ int audit_set_loginuid(kuid_t loginuid)
 }
 
 /**
+ * audit_set_contid - set current task's audit_context contid
+ * @contid: contid value
+ *
+ * Returns 0 on success, -EPERM on permission failure.
+ *
+ * Called (set) from fs/proc/base.c::proc_contid_write().
+ */
+int audit_set_contid(struct task_struct *task, u64 contid)
+{
+       u64 oldcontid;
+       int rc = 0;
+       struct audit_buffer *ab;
+       uid_t uid;
+       struct tty_struct *tty;

kernel/auditsc.c int audit_set_loginuid(kuid_t loginuid) · line 2140

Quoted 10 lines

kernel/auditsc.c +10 -0

+       char comm[sizeof(current->comm)];
+
+       task_lock(task);
+       /* Can't set if audit disabled */
+       if (!task->audit) {
+               task_unlock(task);
+               return -ENOPROTOOPT;
+       }
+       oldcontid = audit_get_contid(task);
+       read_lock(&tasklist_lock);

I assume lockdep was happy with nesting the tasklist_lock inside the task lock?

Quoted 30 lines

kernel/auditsc.c +30 -0

+       /* Don't allow the audit containerid to be unset */
+       if (!audit_contid_valid(contid))
+               rc = -EINVAL;
+       /* if we don't have caps, reject */
+       else if (!capable(CAP_AUDIT_CONTROL))
+               rc = -EPERM;
+       /* if task has children or is not single-threaded, deny */
+       else if (!list_empty(&task->children))
+               rc = -EBUSY;
+       else if (!(thread_group_leader(task) && thread_group_empty(task)))
+               rc = -EALREADY;
+       read_unlock(&tasklist_lock);
+       if (!rc)
+               task->audit->contid = contid;
+       task_unlock(task);
+
+       if (!audit_enabled)
+               return rc;
+
+       ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONTAINER_OP);
+       if (!ab)
+               return rc;
+
+       uid = from_kuid(&init_user_ns, task_uid(current));
+       tty = audit_get_tty(current);
+       audit_log_format(ab, "op=set opid=%d old-contid=%llu contid=%llu pid=%d uid=%u auid=%u tty=%s ses=%u",
+                        task_tgid_nr(task), oldcontid, contid,
+                        task_tgid_nr(current), uid,
+                        from_kuid(&init_user_ns, audit_get_loginuid(current)),
+                        tty ? tty_name(tty) : "(none)",

kernel/auditsc.c int audit_set_loginuid(kuid_t loginuid) · line 2180

Quoted 10 lines

kernel/auditsc.c +10 -0

+                        audit_get_sessionid(current));
+       audit_put_tty(tty);
+       audit_log_task_context(ab);
+       audit_log_format(ab, " comm=");
+       audit_log_untrustedstring(ab, get_task_comm(comm, current));
+       audit_log_d_path_exe(ab, current->mm);
+       audit_log_format(ab, " res=%d", !rc);
+       audit_log_end(ab);
+       return rc;
+}

--
paul moore
www.paul-moore.com

Quoted 9 lines · Richard Guy Briggs

Implement the proc fs write to set the audit container identifier of a process, emitting an AUDIT_CONTAINER_OP record to document the event.

This is a write from the container orchestrator task to a proc entry of the form /proc/PID/audit_containerid where PID is the process ID of the newly created task that is to become the first task in a container, or an additional task added to a container.

Quoted 6 lines

The write expects up to a u64 value (unset: 18446744073709551615).

The writer must have capability CAP_AUDIT_CONTROL.

This will produce a record such as this:
type=CONTAINER_ID msg=audit(2018-06-06 12:39:29.636:26949) : op=set opid=2209 old-contid=18446744073709551615 contid=123456 pid=628 auid=root uid=root tty=ttyS0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 comm=bash exe=/usr/bin/bash res=yes

You need to update the record type in the example above.

Quoted 4 lines

The "op" field indicates an initial set. The "pid" to "ses" fields are the orchestrator while the "opid" field is the object's PID, the process being "contained". Old and new audit container identifier values are given in the "contid" fields, while res indicates its success.

I understand Steve's concern around the "op" field, but I think it might be a bit premature to think we might not need to do some sort of audit container ID management in the future that would want to make use of the CONTAINER_OP message type. I would like to see the "op" field preserved.

Quoted 17 lines

It is not permitted to unset the audit container identifier. A child inherits its parent's audit container identifier.

See: https://github.com/linux-audit/audit-kernel/issues/90
See: https://github.com/linux-audit/audit-userspace/issues/51
See: https://github.com/linux-audit/audit-testsuite/issues/64
See: https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID

Signed-off-by Richard Guy Briggs <[email protected]>

Acked-by Serge Hallyn <[email protected]>

Acked-by Steve Grubb <[email protected]>

---
 fs/proc/base.c             | 37 +++++++++++++++++++++++++
 include/linux/audit.h      | 24 ++++++++++++++++
 include/uapi/linux/audit.h |  2 ++
 kernel/auditsc.c           | 68 ++++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 131 insertions(+)

...

Quoted 22 lines

kernel/auditsc.c +18 -0

@@ -2112,6 +2114,72 @@ int audit_set_loginuid(kuid_t loginuid)
 }
 
 /**
+ * audit_set_contid - set current task's audit_context contid
+ * @contid: contid value
+ *
+ * Returns 0 on success, -EPERM on permission failure.
+ *
+ * Called (set) from fs/proc/base.c::proc_contid_write().
+ */
+int audit_set_contid(struct task_struct *task, u64 contid)
+{
+       u64 oldcontid;
+       int rc = 0;
+       struct audit_buffer *ab;
+       uid_t uid;
+       struct tty_struct *tty;
+       char comm[sizeof(current->comm)];
+
+       task_lock(task);
+       /* Can't set if audit disabled */

kernel/auditsc.c int audit_set_loginuid(kuid_t loginuid) · line 2140

Quoted 6 lines

kernel/auditsc.c +6 -0

+       if (!task->audit) {
+               task_unlock(task);
+               return -ENOPROTOOPT;
+       }
+       oldcontid = audit_get_contid(task);
+       read_lock(&tasklist_lock);

I assume lockdep was happy with nesting the tasklist_lock inside the task lock?

Quoted 32 lines

kernel/auditsc.c +32 -0

+       /* Don't allow the audit containerid to be unset */
+       if (!audit_contid_valid(contid))
+               rc = -EINVAL;
+       /* if we don't have caps, reject */
+       else if (!capable(CAP_AUDIT_CONTROL))
+               rc = -EPERM;
+       /* if task has children or is not single-threaded, deny */
+       else if (!list_empty(&task->children))
+               rc = -EBUSY;
+       else if (!(thread_group_leader(task) && thread_group_empty(task)))
+               rc = -EALREADY;
+       read_unlock(&tasklist_lock);
+       if (!rc)
+               task->audit->contid = contid;
+       task_unlock(task);
+
+       if (!audit_enabled)
+               return rc;
+
+       ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONTAINER_OP);
+       if (!ab)
+               return rc;
+
+       uid = from_kuid(&init_user_ns, task_uid(current));
+       tty = audit_get_tty(current);
+       audit_log_format(ab, "op=set opid=%d old-contid=%llu contid=%llu pid=%d uid=%u auid=%u tty=%s ses=%u",
+                        task_tgid_nr(task), oldcontid, contid,
+                        task_tgid_nr(current), uid,
+                        from_kuid(&init_user_ns, audit_get_loginuid(current)),
+                        tty ? tty_name(tty) : "(none)",
+                        audit_get_sessionid(current));
+       audit_put_tty(tty);

Quoted 8 lines

kernel/auditsc.c +8 -0

+       audit_log_task_context(ab);
+       audit_log_format(ab, " comm=");
+       audit_log_untrustedstring(ab, get_task_comm(comm, current));
+       audit_log_d_path_exe(ab, current->mm);
+       audit_log_format(ab, " res=%d", !rc);
+       audit_log_end(ab);
+       return rc;
+}

Signature · 2 lines

paul moore
www.paul-moore.com

The audit-related parameters in struct task_struct should ideally be collected together and accessed through a standard audit API.

Collect the existing loginuid, sessionid and audit_context together in a new struct audit_task_info called "audit" in struct task_struct.

Use kmem_cache to manage this pool of memory. Un-inline audit_free() to be able to always recover that memory.

See: https://github.com/linux-audit/audit-kernel/issues/81

Signed-off-by Richard Guy Briggs <[email protected]>

---
 include/linux/audit.h | 34 ++++++++++++++++++++++++----------
 include/linux/sched.h |  5 +----
 init/init_task.c      |  3 +--
 init/main.c           |  2 ++
 kernel/auditsc.c      | 51 ++++++++++++++++++++++++++++++++++++++++++---------
 kernel/fork.c         |  4 +++-
 6 files changed, 73 insertions(+), 26 deletions(-)

include/linux/audit.h +5 -0

index 9334fbe..8964332 100644
@@ -219,8 +219,15 @@ static inline void audit_log_task_info(struct audit_buffer *ab,
 
 /* These are defined in auditsc.c */
                                /* Public API */
+struct audit_task_info {
+       kuid_t                  loginuid;
+       unsigned int            sessionid;
+       struct audit_context    *ctx;
+};

include/linux/sched.h +0 -0

index 87bf02d..e117272 100644

init/main.c +1 -0

index 3b4ada1..6aba171 100644
@@ -92,6 +92,7 @@
 #include <linux/rodata_test.h>
 #include <linux/jump_label.h>
 #include <linux/mem_encrypt.h>
+#include <linux/audit.h>
 
 #include <asm/io.h>
 #include <asm/bugs.h>

kernel/auditsc.c +1 -1

index fb20746..88779a7 100644
@@ -841,7 +841,7 @@ static inline struct audit_context *audit_take_context(struct task_struct *tsk,
                                                      int return_valid,
                                                      long return_code)
 {
-       struct audit_context *context = tsk->audit_context;
+       struct audit_context *context = tsk->audit->ctx;
 
        if (!context)
                return NULL;

@@ -926,6 +926,15 @@ static inline struct audit_context *audit_alloc_context(enum audit_state state)
        return context;

kernel/auditsc.c +1 -0

 /**
  * audit_alloc - allocate an audit context block for a task
  * @tsk: task

@@ -940,17 +949,28 @@ int audit_alloc(struct task_struct *tsk)
        struct audit_context *context;
        enum audit_state     state;
        char *key = NULL;
+       struct audit_task_info *info;

kernel/auditsc.c +8 -0

                clear_tsk_thread_flag(tsk, TIF_SYSCALL_AUDIT);
                return 0;
        }
 
        if (!(context = audit_alloc_context(state))) {
+               tsk->audit = NULL;
+               kmem_cache_free(audit_task_cache, info);
                kfree(key);
                audit_log_lost("out of memory in audit_alloc");
                return -ENOMEM;

@@ -962,6 +982,12 @@ int audit_alloc(struct task_struct *tsk)
        return 0;
 }
 
+struct audit_task_info init_struct_audit = {
+       .loginuid = INVALID_UID,
+       .sessionid = AUDIT_SID_UNSET,
+       .ctx = NULL,
+};
+
 static inline void audit_free_context(struct audit_context *context)
 {
        audit_free_names(context);

Create a new audit record AUDIT_CONTAINER to document the audit container identifier of a process if it is present.

Called from audit_log_exit(), syscalls are covered.

A sample raw event:
type=SYSCALL msg=audit(1519924845.499:257): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=56374e1cef30 a2=241 a3=1b6 items=2 ppid=606 pid=635 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="tmpcontainerid" type=CWD msg=audit(1519924845.499:257): cwd="/root"
type=PATH msg=audit(1519924845.499:257): item=0 name="/tmp/" inode=13863 dev=00:27 mode=041777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tmp_t:s0 nametype= PARENT cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=PATH msg=audit(1519924845.499:257): item=1 name="/tmp/tmpcontainerid" inode=17729 dev=00:27 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 nametype=CREATE cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=PROCTITLE msg=audit(1519924845.499:257): proctitle=62617368002D6300736C65657020313B206563686F2074657374203E202F746D702F746D70636F6E7461696E65726964
type=CONTAINER msg=audit(1519924845.499:257): op=task contid=123458

See: https://github.com/linux-audit/audit-kernel/issues/90
See: https://github.com/linux-audit/audit-userspace/issues/51
See: https://github.com/linux-audit/audit-testsuite/issues/64
See: https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID

Signed-off-by Richard Guy Briggs <[email protected]>

Acked-by Serge Hallyn <[email protected]>

Acked-by Steve Grubb <[email protected]>

---
 include/linux/audit.h      |  7 +++++++
 include/uapi/linux/audit.h |  1 +
 kernel/audit.c             | 24 ++++++++++++++++++++++++
 kernel/auditsc.c           |  3 +++
 4 files changed, 35 insertions(+)

kernel/audit.c +13 -0

@@ -2045,6 +2045,30 @@ void audit_log_session_info(struct audit_buffer *ab)
        audit_log_format(ab, " auid=%u ses=%u", auid, sessionid);
 }
 
+/*
+ * audit_log_contid - report container info
+ * @tsk: task to be recorded
+ * @context: task or local context for record
+ * @op: contid string description
+ */
+int audit_log_contid(struct task_struct *tsk,
+                            struct audit_context *context, char *op)
+{
+       struct audit_buffer *ab;
+
+       if (!audit_contid_set(tsk))
+               return 0;

Add audit container identifier support to ptrace and signals. In particular, the "op" field provides a way to label the auxiliary record to which it is associated.

Signed-off-by Richard Guy Briggs <[email protected]>

Acked-by Serge Hallyn <[email protected]>

---
 include/linux/audit.h | 11 +++++------
 kernel/audit.c        | 13 +++++++------
 kernel/audit.h        |  2 ++
 kernel/auditsc.c      | 21 ++++++++++++++++-----
 4 files changed, 30 insertions(+), 17 deletions(-)

include/linux/audit.h +2 -3

@@ -155,9 +156,8 @@ extern void             audit_log_key(struct audit_buffer *ab,
 extern int audit_log_task_context(struct audit_buffer *ab);
 extern void audit_log_task_info(struct audit_buffer *ab,
                                struct task_struct *tsk);
-extern int audit_log_contid(struct task_struct *tsk,
-                                   struct audit_context *context,
-                                   char *op);
+extern int audit_log_contid(struct audit_context *context,
+                                    char *op, u64 contid);
 
 extern int                 audit_update_lsm_rules(void);

kernel/audit.c +4 -4

@@ -2047,23 +2049,22 @@ void audit_log_session_info(struct audit_buffer *ab)
 
 /*
  * audit_log_contid - report container info
- * @tsk: task to be recorded
  * @context: task or local context for record
  * @op: contid string description
+ * @contid: container ID to report
  */
-int audit_log_contid(struct task_struct *tsk,
-                            struct audit_context *context, char *op)
+int audit_log_contid(struct audit_context *context,
+                             char *op, u64 contid)
 {
        struct audit_buffer *ab;
 
-       if (!audit_contid_set(tsk))
+       if (!audit_contid_valid(contid))
                return 0;

Standalone audit records have the timestamp and serial number generated on the fly and as such are unique, making them standalone. This new function audit_alloc_local() generates a local audit context that will be used only for a standalone record and its auxiliary record(s). The context is discarded immediately after the local associated records are produced.

Signed-off-by Richard Guy Briggs <[email protected]>

Acked-by Serge Hallyn <[email protected]>

---
 include/linux/audit.h |  8 ++++++++
 kernel/audit.h        |  1 +
 kernel/auditsc.c      | 33 ++++++++++++++++++++++++++++-----
 3 files changed, 37 insertions(+), 5 deletions(-)

include/linux/audit.h +8 -0

index 4f514ed..1f340ad 100644
@@ -234,7 +234,9 @@ struct audit_task_info {
 extern struct audit_task_info init_struct_audit;
 extern void __init audit_task_init(void);
 extern int  audit_alloc(struct task_struct *task);
+extern struct audit_context *audit_alloc_local(gfp_t gfpflags);
 extern void audit_free(struct task_struct *task);
+extern void audit_free_context(struct audit_context *context);
 extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1,
                                  unsigned long a2, unsigned long a3);
 extern void __audit_syscall_exit(int ret_success, long ret_value);

@@ -495,6 +497,12 @@ static inline int audit_alloc(struct task_struct *task)
 {
        return 0;
 }
+static inline struct audit_context *audit_alloc_local(gfp_t gfpflags)
+{
+       return NULL;
+}
+static inline void audit_free_context(struct audit_context *context)
+{ }
 static inline void audit_free(struct task_struct *task)
 { }
 static inline void audit_syscall_entry(int major, unsigned long a0,

kernel/audit.h +1 -0

index 1cf1c35..a6d00a5 100644
@@ -110,6 +110,7 @@ struct audit_proctitle {
 struct audit_context {
        int                 dummy;      /* must be the first element */
        int                 in_syscall; /* 1 if task is in a syscall */
+       bool                local;      /* local context needed */
        enum audit_state    state, current_state;
        unsigned int        serial;     /* serial number for record */
        int                 major;      /* syscall number */

kernel/auditsc.c +27 -4

index cdb24cf..7627f21 100644
@@ -913,11 +913,13 @@ static inline void audit_free_aux(struct audit_context *context)
        }
 }
 
-static inline struct audit_context *audit_alloc_context(enum audit_state state)
+static inline struct audit_context *audit_alloc_context(enum audit_state state,
+                                                       gfp_t gfpflags)
 {
        struct audit_context *context;
 
-       context = kzalloc(sizeof(*context), GFP_KERNEL);
+       /* We can be called in atomic context via audit_tg() */
+       context = kzalloc(sizeof(*context), gfpflags);
        if (!context)
                return NULL;
        context->state = state;

@@ -970,7 +972,8 @@ int audit_alloc(struct task_struct *tsk)
                return 0;
        }
 
-       if (!(context = audit_alloc_context(state))) {
+       context = audit_alloc_context(state, GFP_KERNEL);
+       if (!(context)) {
                tsk->audit = NULL;
                kmem_cache_free(audit_task_cache, info);
                kfree(key);

@@ -991,8 +994,27 @@ struct audit_task_info init_struct_audit = {
        .ctx = NULL,
 };
 
-static inline void audit_free_context(struct audit_context *context)
+struct audit_context *audit_alloc_local(gfp_t gfpflags)
 {
+       struct audit_context *context;
+
+       if (!audit_ever_enabled)
+               return NULL; /* Return if not auditing. */
+
+       context = audit_alloc_context(AUDIT_RECORD_CONTEXT, gfpflags);
+       if (!context)
+               return NULL;
+       context->serial = audit_serial();
+       context->ctime = current_kernel_time64();
+       context->local = true;
+       return context;
+}
+EXPORT_SYMBOL(audit_alloc_local);
+
+void audit_free_context(struct audit_context *context)
+{
+       if (!context)
+               return;
        audit_free_names(context);
        unroll_tree_refs(context, NULL, 0);
        free_tree_refs(context);

@@ -1002,6 +1024,7 @@ static inline void audit_free_context(struct audit_context *context)
        audit_proctitle_free(context);
        kfree(context);
 }
+EXPORT_SYMBOL(audit_free_context);
 
 static int audit_log_pid_context(struct audit_context *context, pid_t pid,
                                 kuid_t auid, kuid_t uid, unsigned int sessionid,

Add audit container identifier auxiliary record to tty logging rule event standalone records.

Signed-off-by Richard Guy Briggs <[email protected]>

Acked-by Serge Hallyn <[email protected]>

---
 drivers/tty/tty_audit.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

drivers/tty/tty_audit.c +2 -1

index 50f567b..3e21477 100644
@@ -66,8 +66,9 @@ static void tty_audit_log(const char *description, dev_t dev,
        uid_t uid = from_kuid(&init_user_ns, task_uid(tsk));
        uid_t loginuid = from_kuid(&init_user_ns, audit_get_loginuid(tsk));
        unsigned int sessionid = audit_get_sessionid(tsk);
+       struct audit_context *context = audit_alloc_local(GFP_KERNEL);
 
-       ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_TTY);
+       ab = audit_log_start(context, GFP_KERNEL, AUDIT_TTY);
        if (ab) {
                char name[sizeof(tsk->comm)];
 

Audit events could happen in a network namespace outside of a task context due to packets received from the net that trigger an auditing rule prior to being associated with a running task. The network namespace could in use by multiple containers by association to the tasks in that network namespace. We still want a way to attribute these events to any potential containers. Keep a list per network namespace to track these audit container identifiiers.

Add/increment the audit container identifier on:
- initial setting of the audit container identifier via /proc
- clone/fork call that inherits an audit container identifier
- unshare call that inherits an audit container identifier
- setns call that inherits an audit container identifier Delete/decrement the audit container identifier on:
- an inherited audit container identifier dropped when child set
- process exit
- unshare call that drops a net namespace
- setns call that drops a net namespace

See: https://github.com/linux-audit/audit-kernel/issues/92
See: https://github.com/linux-audit/audit-testsuite/issues/64
See: https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID

Signed-off-by Richard Guy Briggs <[email protected]>

---
 include/linux/audit.h | 17 ++++++++++
 kernel/audit.c        | 86 +++++++++++++++++++++++++++++++++++++++++++++++++++
 kernel/auditsc.c      |  8 ++++-
 kernel/nsproxy.c      |  4 +++
 4 files changed, 114 insertions(+), 1 deletion(-)

kernel/audit.c +11 -0

@@ -308,6 +312,86 @@ static struct sock *audit_get_sk(const struct net *net)
        return aunet->sk;
 }
 
+/**
+ * audit_get_netns_contid_list - Return the audit container ID list for the given network namespace
+ * @net: the destination network namespace
+ *
+ * Description:
+ * Returns the list pointer if valid, NULL otherwise.  The caller must ensure
+ * that a reference is held for the network namespace while the sock is in use.
+ */
+struct list_head *audit_get_netns_contid_list(const struct net *net)
+{
+       struct audit_net *aunet = net_generic(net, audit_net_id);

kernel/audit.c +60 -0

+void audit_netns_contid_add(struct net *net, u64 contid)
+{
+       spinlock_t *lock = audit_get_netns_contid_list_lock(net);
+       struct list_head *contid_list = audit_get_netns_contid_list(net);
+       struct audit_contid *cont;
+
+       if (!audit_contid_valid(contid))
+               return;
+       spin_lock(lock);
+       if (!list_empty(contid_list))
+               list_for_each_entry(cont, contid_list, list)
+                       if (cont->id == contid) {
+                               refcount_inc(&cont->refcount);
+                               goto out;
+                       }
+       cont = kmalloc(sizeof(struct audit_contid), GFP_KERNEL);
+       if (cont) {
+               INIT_LIST_HEAD(&cont->list);
+               cont->id = contid;
+               refcount_set(&cont->refcount, 1);
+               list_add(&cont->list, contid_list);
+       }
+out:
+       spin_unlock(lock);
+}
+
+void audit_netns_contid_del(struct net *net, u64 contid)
+{
+       spinlock_t *lock = audit_get_netns_contid_list_lock(net);
+       struct list_head *contid_list = audit_get_netns_contid_list(net);
+       struct audit_contid *cont = NULL;
+
+       if (!audit_contid_valid(contid))
+               return;
+       spin_lock(lock);
+       if (!list_empty(contid_list))
+               list_for_each_entry(cont, contid_list, list)
+                       if (cont->id == contid) {
+                               list_del(&cont->list);
+                               if (refcount_dec_and_test(&cont->refcount))
+                                       kfree(cont);
+                               break;
+                       }
+       spin_unlock(lock);
+}
+
+void audit_switch_task_namespaces(struct nsproxy *ns, struct task_struct *p)
+{
+       u64 contid = audit_get_contid(p);
+       struct nsproxy *new = p->nsproxy;
+
+       if (!audit_contid_valid(contid))
+               return;
+       audit_netns_contid_del(ns->net_ns, contid);
+       if (new)
+               audit_netns_contid_add(new->net_ns, contid);
+}
+
 void audit_panic(const char *message)
 {
        switch (audit_failure) {

@@ -1547,6 +1631,8 @@ static int __net_init audit_net_init(struct net *net)
                return -ENOMEM;
        }
        aunet->sk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
+       INIT_LIST_HEAD(&aunet->contid_list);
+       spin_lock_init(&aunet->contid_list_lock);
 
        return 0;
 }

kernel/auditsc.c +7 -1

index 610c6869..fdf3f68 100644
@@ -75,6 +75,7 @@
 #include <linux/uaccess.h>
 #include <linux/fsnotify_backend.h>
 #include <uapi/linux/limits.h>
+#include <net/net_namespace.h>
 
 #include "audit.h"
 

@@ -2165,6 +2166,7 @@ int audit_set_contid(struct task_struct *task, u64 contid)
        uid_t uid;
        struct tty_struct *tty;
        char comm[sizeof(current->comm)];
+       struct net *net = task->nsproxy->net_ns;
 
        task_lock(task);
        /* Can't set if audit disabled */

@@ -2186,8 +2188,12 @@ int audit_set_contid(struct task_struct *task, u64 contid)
        else if (!(thread_group_leader(task) && thread_group_empty(task)))
                rc = -EALREADY;
        read_unlock(&tasklist_lock);
-       if (!rc)
+       if (!rc) {
+               if (audit_contid_valid(oldcontid))
+                       audit_netns_contid_del(net, oldcontid);
                task->audit->contid = contid;
+               audit_netns_contid_add(net, contid);
+       }
        task_unlock(task);
 
        if (!audit_enabled)

kernel/nsproxy.c +4 -0

index f6c5d33..718b120 100644
@@ -27,6 +27,7 @@
 #include <linux/syscalls.h>
 #include <linux/cgroup.h>
 #include <linux/perf_event.h>
+#include <linux/audit.h>
 
 static struct kmem_cache *nsproxy_cachep;
 

@@ -140,6 +141,7 @@ int copy_namespaces(unsigned long flags, struct task_struct *tsk)
        struct nsproxy *old_ns = tsk->nsproxy;
        struct user_namespace *user_ns = task_cred_xxx(tsk, user_ns);
        struct nsproxy *new_ns;
+       u64 contid = audit_get_contid(tsk);
 
        if (likely(!(flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC |
                              CLONE_NEWPID | CLONE_NEWNET |

@@ -167,6 +169,7 @@ int copy_namespaces(unsigned long flags, struct task_struct *tsk)
                return  PTR_ERR(new_ns);
 
        tsk->nsproxy = new_ns;
+       audit_netns_contid_add(new_ns->net_ns, contid);
        return 0;
 }
 

@@ -224,6 +227,7 @@ void switch_task_namespaces(struct task_struct *p, struct nsproxy *new)
        ns = p->nsproxy;
        p->nsproxy = new;
        task_unlock(p);
+       audit_switch_task_namespaces(ns, p);
 
        if (ns && atomic_dec_and_test(&ns->count))
                free_nsproxy(ns);

Add audit container identifier auxiliary record(s) to NETFILTER_PKT event standalone records. Iterate through all potential audit container identifiers associated with a network namespace.

Signed-off-by Richard Guy Briggs <[email protected]>

---
 include/linux/audit.h    |  5 +++++
 kernel/audit.c           | 26 ++++++++++++++++++++++++++
 net/netfilter/xt_AUDIT.c | 12 ++++++++++--
 3 files changed, 41 insertions(+), 2 deletions(-)

include/linux/audit.h +5 -0

index 9a02095..8755f4d 100644
@@ -169,6 +169,8 @@ extern int audit_log_contid(struct audit_context *context,
 extern void audit_netns_contid_add(struct net *net, u64 contid);
 extern void audit_netns_contid_del(struct net *net, u64 contid);
 extern void audit_switch_task_namespaces(struct nsproxy *ns, struct task_struct *p);
+extern void audit_log_netns_contid_list(struct net *net,
+                                struct audit_context *context);
 
 extern int                 audit_update_lsm_rules(void);
 

@@ -228,6 +230,9 @@ static inline void audit_netns_contid_del(struct net *net, u64 contid)
 { }
 static inline void audit_switch_task_namespaces(struct nsproxy *ns, struct task_struct *p)
 { }
+static inline void audit_log_netns_contid_list(struct net *net,
+                                       struct audit_context *context)
+{ }
 
 #define audit_enabled AUDIT_OFF
 #endif /* CONFIG_AUDIT */

kernel/audit.c +12 -0

index c5fed3b..b23711c 100644
@@ -392,6 +392,32 @@ void audit_switch_task_namespaces(struct nsproxy *ns, struct task_struct *p)
                audit_netns_contid_add(new->net_ns, contid);
 }
 
+void audit_log_netns_contid_list(struct net *net, struct audit_context *context)
+{
+       spinlock_t *lock = audit_get_netns_contid_list_lock(net);
+       struct audit_buffer *ab;
+       struct audit_contid *cont;
+       bool first = true;
+
+       /* Generate AUDIT_CONTAINER record with container ID CSV list */
+       ab = audit_log_start(context, GFP_ATOMIC, AUDIT_CONTAINER);
+       if (!ab) {
+               audit_log_lost("out of memory in audit_log_netns_contid_list");
+               return;

kernel/audit.c +3 -0

+       audit_log_end(ab);
+}
+EXPORT_SYMBOL(audit_log_netns_contid_list);
 
 void audit_panic(const char *message)
 {
        switch (audit_failure) {

net/netfilter/xt_AUDIT.c +5 -2

index af883f1..44fac3f 100644
@@ -71,10 +71,13 @@ static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb)
 {
        struct audit_buffer *ab;
        int fam = -1;
+       struct audit_context *context;
+       struct net *net;
 
        if (audit_enabled == AUDIT_OFF)
-               goto errout;
-       ab = audit_log_start(NULL, GFP_ATOMIC, AUDIT_NETFILTER_PKT);
+               goto out;
+       context = audit_alloc_local(GFP_ATOMIC);
+       ab = audit_log_start(context, GFP_ATOMIC, AUDIT_NETFILTER_PKT);
        if (ab == NULL)
                goto errout;
 

@@ -104,7 +107,12 @@ static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb)
 
        audit_log_end(ab);

Quoted 26 lines · Richard Guy Briggs

Create a new audit record AUDIT_CONTAINER to document the audit container identifier of a process if it is present.

Called from audit_log_exit(), syscalls are covered.

A sample raw event:
type=SYSCALL msg=audit(1519924845.499:257): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=56374e1cef30 a2=241 a3=1b6 items=2 ppid=606 pid=635 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="tmpcontainerid" type=CWD msg=audit(1519924845.499:257): cwd="/root"
type=PATH msg=audit(1519924845.499:257): item=0 name="/tmp/" inode=13863 dev=00:27 mode=041777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tmp_t:s0 nametype= PARENT cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=PATH msg=audit(1519924845.499:257): item=1 name="/tmp/tmpcontainerid" inode=17729 dev=00:27 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 nametype=CREATE cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=PROCTITLE msg=audit(1519924845.499:257): proctitle=62617368002D6300736C65657020313B206563686F2074657374203E202F746D702F746D70636F6E7461696E65726964
type=CONTAINER msg=audit(1519924845.499:257): op=task contid=123458

See: https://github.com/linux-audit/audit-kernel/issues/90
See: https://github.com/linux-audit/audit-userspace/issues/51
See: https://github.com/linux-audit/audit-testsuite/issues/64
See: https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID

Signed-off-by Richard Guy Briggs <[email protected]>

Acked-by Serge Hallyn <[email protected]>

Acked-by Steve Grubb <[email protected]>

---
 include/linux/audit.h      |  7 +++++++
 include/uapi/linux/audit.h |  1 +
 kernel/audit.c             | 24 ++++++++++++++++++++++++
 kernel/auditsc.c           |  3 +++
 4 files changed, 35 insertions(+)

...

Quoted 24 lines

kernel/audit.c +20 -0

@@ -2045,6 +2045,30 @@ void audit_log_session_info(struct audit_buffer *ab)
        audit_log_format(ab, " auid=%u ses=%u", auid, sessionid);
 }
 
+/*
+ * audit_log_contid - report container info
+ * @tsk: task to be recorded
+ * @context: task or local context for record
+ * @op: contid string description
+ */
+int audit_log_contid(struct task_struct *tsk,
+                            struct audit_context *context, char *op)
+{
+       struct audit_buffer *ab;
+
+       if (!audit_contid_set(tsk))
+               return 0;
+       /* Generate AUDIT_CONTAINER record with container ID */
+       ab = audit_log_start(context, GFP_KERNEL, AUDIT_CONTAINER);
+       if (!ab)
+               return -ENOMEM;
+       audit_log_format(ab, "op=%s contid=%llu",
+                        op, audit_get_contid(tsk));
+       audit_log_end(ab);

kernel/audit.c void audit_log_session_info(struct audit_buffer *ab) · line 2070

Quoted 3 lines

kernel/audit.c +3 -0

+       return 0;
+}
+EXPORT_SYMBOL(audit_log_contid);

As discussed in the previous iteration of the patch, I prefer AUDIT_CONTAINER_ID here over AUDIT_CONTAINER. If you feel strongly about keeping it as-is with AUDIT_CONTAINER I suppose I could live with that, but it is isn't my first choice.

However, I do care about the "op" field in this record. It just doesn't make any sense; the way you are using it it is more of a context field than an operations field, and even then why is the context important from a logging and/or security perspective? Drop it please.

paul moore

Quoted 54 lines · Paul Moore

Quoted 26 lines · Richard Guy Briggs

Create a new audit record AUDIT_CONTAINER to document the audit container identifier of a process if it is present.

Called from audit_log_exit(), syscalls are covered.

A sample raw event:
type=SYSCALL msg=audit(1519924845.499:257): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=56374e1cef30 a2=241 a3=1b6 items=2 ppid=606 pid=635 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="tmpcontainerid" type=CWD msg=audit(1519924845.499:257): cwd="/root"
type=PATH msg=audit(1519924845.499:257): item=0 name="/tmp/" inode=13863 dev=00:27 mode=041777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tmp_t:s0 nametype= PARENT cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=PATH msg=audit(1519924845.499:257): item=1 name="/tmp/tmpcontainerid" inode=17729 dev=00:27 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 nametype=CREATE cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=PROCTITLE msg=audit(1519924845.499:257): proctitle=62617368002D6300736C65657020313B206563686F2074657374203E202F746D702F746D70636F6E7461696E65726964
type=CONTAINER msg=audit(1519924845.499:257): op=task contid=123458

See: https://github.com/linux-audit/audit-kernel/issues/90
See: https://github.com/linux-audit/audit-userspace/issues/51
See: https://github.com/linux-audit/audit-testsuite/issues/64
See: https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID

Signed-off-by Richard Guy Briggs <[email protected]>

Acked-by Serge Hallyn <[email protected]>

Acked-by Steve Grubb <[email protected]>

---
 include/linux/audit.h      |  7 +++++++
 include/uapi/linux/audit.h |  1 +
 kernel/audit.c             | 24 ++++++++++++++++++++++++
 kernel/auditsc.c           |  3 +++
 4 files changed, 35 insertions(+)

...

Quoted 24 lines

kernel/audit.c +20 -0

@@ -2045,6 +2045,30 @@ void audit_log_session_info(struct audit_buffer *ab)
        audit_log_format(ab, " auid=%u ses=%u", auid, sessionid);
 }
 
+/*
+ * audit_log_contid - report container info
+ * @tsk: task to be recorded
+ * @context: task or local context for record
+ * @op: contid string description
+ */
+int audit_log_contid(struct task_struct *tsk,
+                            struct audit_context *context, char *op)
+{
+       struct audit_buffer *ab;
+
+       if (!audit_contid_set(tsk))
+               return 0;
+       /* Generate AUDIT_CONTAINER record with container ID */
+       ab = audit_log_start(context, GFP_KERNEL, AUDIT_CONTAINER);
+       if (!ab)
+               return -ENOMEM;
+       audit_log_format(ab, "op=%s contid=%llu",
+                        op, audit_get_contid(tsk));
+       audit_log_end(ab);

Quoted 8 lines

kernel/audit.c void audit_log_session_info(struct audit_buffer *ab) · line 2070

Quoted 3 lines

kernel/audit.c +3 -0

+       return 0;
+}
+EXPORT_SYMBOL(audit_log_contid);

As discussed in the previous iteration of the patch, I prefer AUDIT_CONTAINER_ID here over AUDIT_CONTAINER. If you feel strongly about keeping it as-is with AUDIT_CONTAINER I suppose I could live with that, but it is isn't my first choice.

I don't have a strong opinion on this one, mildly preferring the shorter one only because it is shorter.

Quoted 5 lines

However, I do care about the "op" field in this record. It just doesn't make any sense; the way you are using it it is more of a context field than an operations field, and even then why is the context important from a logging and/or security perspective? Drop it please.

I'll rename it to whatever you like. I'd suggest "ref=". The reason I think it is important is there are multiple sources that aren't always obvious from the other records to which it is associated. In the case of ptrace and signals, there can be many target tasks listed (OBJ_PID) with no other way to distinguish the matching audit container identifier records all for one event. This is in addition to the default syscall container identifier record. I'm not currently happy with the text content to link the two, but that should be solvable (most obvious is taret PID). Throwing away this information seems shortsighted.

Quoted 64 lines · Richard Guy Briggs

Quoted 62 lines · Paul Moore

Quoted 26 lines · Richard Guy Briggs

Create a new audit record AUDIT_CONTAINER to document the audit container identifier of a process if it is present.

Called from audit_log_exit(), syscalls are covered.

A sample raw event:
type=SYSCALL msg=audit(1519924845.499:257): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=56374e1cef30 a2=241 a3=1b6 items=2 ppid=606 pid=635 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="tmpcontainerid" type=CWD msg=audit(1519924845.499:257): cwd="/root"
type=PATH msg=audit(1519924845.499:257): item=0 name="/tmp/" inode=13863 dev=00:27 mode=041777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tmp_t:s0 nametype= PARENT cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=PATH msg=audit(1519924845.499:257): item=1 name="/tmp/tmpcontainerid" inode=17729 dev=00:27 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 nametype=CREATE cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=PROCTITLE msg=audit(1519924845.499:257): proctitle=62617368002D6300736C65657020313B206563686F2074657374203E202F746D702F746D70636F6E7461696E65726964
type=CONTAINER msg=audit(1519924845.499:257): op=task contid=123458

See: https://github.com/linux-audit/audit-kernel/issues/90
See: https://github.com/linux-audit/audit-userspace/issues/51
See: https://github.com/linux-audit/audit-testsuite/issues/64
See: https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID

Signed-off-by Richard Guy Briggs <[email protected]>

Acked-by Serge Hallyn <[email protected]>

Acked-by Steve Grubb <[email protected]>

---
 include/linux/audit.h      |  7 +++++++
 include/uapi/linux/audit.h |  1 +
 kernel/audit.c             | 24 ++++++++++++++++++++++++
 kernel/auditsc.c           |  3 +++
 4 files changed, 35 insertions(+)

...

Quoted 17 lines

kernel/audit.c +13 -0

@@ -2045,6 +2045,30 @@ void audit_log_session_info(struct audit_buffer *ab)
        audit_log_format(ab, " auid=%u ses=%u", auid, sessionid);
 }
 
+/*
+ * audit_log_contid - report container info
+ * @tsk: task to be recorded
+ * @context: task or local context for record
+ * @op: contid string description
+ */
+int audit_log_contid(struct task_struct *tsk,
+                            struct audit_context *context, char *op)
+{
+       struct audit_buffer *ab;
+
+       if (!audit_contid_set(tsk))
+               return 0;

kernel/audit.c void audit_log_session_info(struct audit_buffer *ab) · line 2070

Quoted 10 lines

kernel/audit.c +10 -0

+       /* Generate AUDIT_CONTAINER record with container ID */
+       ab = audit_log_start(context, GFP_KERNEL, AUDIT_CONTAINER);
+       if (!ab)
+               return -ENOMEM;
+       audit_log_format(ab, "op=%s contid=%llu",
+                        op, audit_get_contid(tsk));
+       audit_log_end(ab);
+       return 0;
+}
+EXPORT_SYMBOL(audit_log_contid);

As discussed in the previous iteration of the patch, I prefer AUDIT_CONTAINER_ID here over AUDIT_CONTAINER. If you feel strongly about keeping it as-is with AUDIT_CONTAINER I suppose I could live with that, but it is isn't my first choice.

Quoted 2 lines

I don't have a strong opinion on this one, mildly preferring the shorter one only because it is shorter.

We already have multiple AUDIT_CONTAINER* record types, so it seems as though we should use "AUDIT_CONTAINER" as a prefix of sorts, rather than a type itself.

Quoted 6 lines

Quoted 5 lines

However, I do care about the "op" field in this record. It just doesn't make any sense; the way you are using it it is more of a context field than an operations field, and even then why is the context important from a logging and/or security perspective? Drop it please.

Quoted 9 lines

I'll rename it to whatever you like. I'd suggest "ref=". The reason I think it is important is there are multiple sources that aren't always obvious from the other records to which it is associated. In the case of ptrace and signals, there can be many target tasks listed (OBJ_PID) with no other way to distinguish the matching audit container identifier records all for one event. This is in addition to the default syscall container identifier record. I'm not currently happy with the text content to link the two, but that should be solvable (most obvious is taret PID). Throwing away this information seems shortsighted.

It would be helpful if you could generate real audit events demonstrating the problems you are describing, as well as a more standard syscall event, so we can discuss some possible solutions.

paul moore

Quoted 86 lines · Paul Moore

Quoted 83 lines · Richard Guy Briggs

Quoted 71 lines · Paul Moore

Quoted 40 lines · Richard Guy Briggs

Create a new audit record AUDIT_CONTAINER to document the audit container identifier of a process if it is present.

Called from audit_log_exit(), syscalls are covered.

A sample raw event:
type=SYSCALL msg=audit(1519924845.499:257): arch=c000003e
syscall=257 success=yes exit=3 a0=ffffff9c a1=56374e1cef30
a2=241 a3=1b6 items=2 ppid=606 pid=635 auid=0 uid=0 gid=0
euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3
comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
key="tmpcontainerid" type=CWD msg=audit(1519924845.499:257):
cwd="/root" type=PATH msg=audit(1519924845.499:257): item=0
name="/tmp/" inode=13863 dev=00:27 mode=041777 ouid=0 ogid=0
rdev=00:00 obj=system_u:object_r:tmp_t:s0 nametype= PARENT
cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0
cap_fver=0 type=PATH msg=audit(1519924845.499:257): item=1
name="/tmp/tmpcontainerid" inode=17729 dev=00:27 mode=0100644
ouid=0 ogid=0 rdev=00:00
obj=unconfined_u:object_r:user_tmp_t:s0 nametype=CREATE
cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0
cap_fver=0 type=PROCTITLE msg=audit(1519924845.499:257):
proctitle=62617368002D6300736C65657020313B206563686F2074657374203E202F746D702F746D70636F6E7461696E65726964 type=CONTAINER msg=audit(1519924845.499:257): op=task
contid=123458

See: https://github.com/linux-audit/audit-kernel/issues/90
See: https://github.com/linux-audit/audit-userspace/issues/51
See: https://github.com/linux-audit/audit-testsuite/issues/64
See:
https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID

Signed-off-by Richard Guy Briggs <[email protected]> Acked-by:

Serge Hallyn <[email protected]> Acked-by: Steve Grubb <[email protected]> ---

 include/linux/audit.h      |  7 +++++++
 include/uapi/linux/audit.h |  1 +
 kernel/audit.c             | 24 ++++++++++++++++++++++++
 kernel/auditsc.c           |  3 +++
 4 files changed, 35 insertions(+)  

...

Quoted 26 lines

kernel/audit.c +19 -0

@@ -2045,6 +2045,30 @@ void audit_log_session_info(struct
 audit_buffer *ab) audit_log_format(ab, " auid=%u ses=%u",
 auid, sessionid); }
 
+/*
+ * audit_log_contid - report container info
+ * @tsk: task to be recorded
+ * @context: task or local context for record
+ * @op: contid string description
+ */
+int audit_log_contid(struct task_struct *tsk,
+                            struct audit_context *context,
 char *op) +{
+       struct audit_buffer *ab;
+
+       if (!audit_contid_set(tsk))
+               return 0;
+       /* Generate AUDIT_CONTAINER record with container ID
 */
+       ab = audit_log_start(context, GFP_KERNEL,
 AUDIT_CONTAINER);
+       if (!ab)
+               return -ENOMEM;
+       audit_log_format(ab, "op=%s contid=%llu",
+                        op, audit_get_contid(tsk));
+       audit_log_end(ab);

Quoted 8 lines

kernel/audit.c void audit_log_session_info(struct audit_buffer *ab) · line 2070

Quoted 3 lines

kernel/audit.c +3 -0

+       return 0;
+}
+EXPORT_SYMBOL(audit_log_contid);  

As discussed in the previous iteration of the patch, I prefer AUDIT_CONTAINER_ID here over AUDIT_CONTAINER. If you feel strongly about keeping it as-is with AUDIT_CONTAINER I suppose I could live with that, but it is isn't my first choice.

I don't have a strong opinion on this one, mildly preferring the shorter one only because it is shorter.

Quoted 3 lines

We already have multiple AUDIT_CONTAINER* record types, so it seems as though we should use "AUDIT_CONTAINER" as a prefix of sorts, rather than a type itself.

I'm fine with that. I'd still like to hear Steve's input. He had stronger opinions than me.

Quoted 17 lines

Quoted 6 lines

Quoted 5 lines

However, I do care about the "op" field in this record. It just doesn't make any sense; the way you are using it it is more of a context field than an operations field, and even then why is the context important from a logging and/or security perspective? Drop it please.

Quoted 10 lines

I'll rename it to whatever you like. I'd suggest "ref=". The reason I think it is important is there are multiple sources that aren't always obvious from the other records to which it is associated. In the case of ptrace and signals, there can be many target tasks listed (OBJ_PID) with no other way to distinguish the matching audit container identifier records all for one event. This is in addition to the default syscall container identifier record. I'm not currently happy with the text content to link the two, but that should be solvable (most obvious is taret PID). Throwing away this information seems shortsighted.

Quoted 3 lines

It would be helpful if you could generate real audit events demonstrating the problems you are describing, as well as a more standard syscall event, so we can discuss some possible solutions.

If the auditted process is in a container and it ptraces or signals another process in a container, there will be two AUDIT_CONTAINER records for the same event that won't be identified as to which record belongs to which process or other record (SYSCALL vs 1+ OBJ_PID records). There could be many signals recorded, each with their own OBJ_PID record. The first is stored in the audit context and additional ones are stored in a chained struct that can accommodate 16 entries each.

(See audit_signal_info(), __audit_ptrace().)

(As a side note, on code inspection it appears that a signal target would get overwritten by a ptrace action if they were to happen in that order.)

Quoted 1 line

paul moore

- RGB

--
Richard Guy Briggs <[email protected]>
Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635

--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit

Quoted 3 lines · Paul Moore

Quoted 2 lines · Richard Guy Briggs

Quoted 1 line · Paul Moore

On Sun, Aug 5, 2018 at 4:32 AM Richard Guy Briggs <[email protected]> wrote:

Quoted 17 lines

Quoted 7 lines

Quoted 6 lines

However, I do care about the "op" field in this record. It just doesn't make any sense; the way you are using it it is more of a context field than an operations field, and even then why is the context important from a logging and/or security perspective? Drop it please.

Quoted 9 lines

I'll rename it to whatever you like. I'd suggest "ref=". The reason I think it is important is there are multiple sources that aren't always obvious from the other records to which it is associated. In the case of ptrace and signals, there can be many target tasks listed (OBJ_PID) with no other way to distinguish the matching audit container identifier records all for one event. This is in addition to the default syscall container identifier record. I'm not currently happy with the text content to link the two, but that should be solvable (most obvious is taret PID). Throwing away this information seems shortsighted.

Quoted 3 lines

It would be helpful if you could generate real audit events demonstrating the problems you are describing, as well as a more standard syscall event, so we can discuss some possible solutions.

If the auditted process is in a container and it ptraces or signals another process in a container, there will be two AUDIT_CONTAINER records for the same event that won't be identified as to which record belongs to which process or other record (SYSCALL vs 1+ OBJ_PID records). There could be many signals recorded, each with their own OBJ_PID record. The first is stored in the audit context and additional ones are stored in a chained struct that can accommodate 16 entries each.

(See audit_signal_info(), __audit_ptrace().)

(As a side note, on code inspection it appears that a signal target would get overwritten by a ptrace action if they were to happen in that order.)

Quoted 6 lines · On Wed, 24 Oct 2018 20:42:55 -0400 Richard Guy Briggs <[email protected]> wrote:

Quoted 5 lines · Paul Moore

Quoted 3 lines · Richard Guy Briggs

Quoted 2 lines · Paul Moore

On Sun, Aug 5, 2018 at 4:32 AM Richard Guy Briggs
<[email protected]> wrote:

Quoted 38 lines

Quoted 37 lines

Quoted 31 lines

Quoted 22 lines

Quoted 22 lines

kernel/audit.c +8 -0

+/*
+ * audit_log_contid - report container info
+ * @tsk: task to be recorded
+ * @context: task or local context for record
+ * @op: contid string description
+ */
+int audit_log_contid(struct task_struct *tsk,
+                            struct audit_context *context,

char *op) +{

kernel/audit.c +5 -0

+       struct audit_buffer *ab;
+
+       if (!audit_contid_set(tsk))
+               return 0;
+       /* Generate AUDIT_CONTAINER record with container ID

*/
+ ab = audit_log_start(context, GFP_KERNEL,
AUDIT_CONTAINER);

kernel/audit.c +5 -0

+       if (!ab)
+               return -ENOMEM;
+       audit_log_format(ab, "op=%s contid=%llu",
+                        op, audit_get_contid(tsk));
+       audit_log_end(ab);

Quoted 8 lines

kernel/audit.c void audit_log_session_info(struct audit_buffer *ab) · line 2070

Quoted 3 lines

kernel/audit.c +3 -0

+       return 0;
+}
+EXPORT_SYMBOL(audit_log_contid);

As discussed in the previous iteration of the patch, I prefer AUDIT_CONTAINER_ID here over AUDIT_CONTAINER. If you feel strongly about keeping it as-is with AUDIT_CONTAINER I suppose I could live with that, but it is isn't my first choice.

Quoted 2 lines

I don't have a strong opinion on this one, mildly preferring the shorter one only because it is shorter.

We already have multiple AUDIT_CONTAINER* record types, so it seems as though we should use "AUDIT_CONTAINER" as a prefix of sorts, rather than a type itself.