> On 14 Dec 2023, at 13:21, Yafang Shao <laoar.shao@xxxxxxxxx> wrote:
>
> On Thu, Dec 14, 2023 at 9:13 PM Yafang Shao <laoar.shao@xxxxxxxxx> wrote:
>>
>> On Thu, Dec 14, 2023 at 8:07 PM Dave Tucker <dave@xxxxxxxxxxxxx> wrote:
>>>
>>> Current output from auditd is as follows:
>>>
>>> time->Wed Dec 13 21:39:24 2023
>>> type=BPF msg=audit(1702503564.519:11241): prog-id=439 op=LOAD
>>>
>>> This only tells you that a BPF program was loaded, but without
>>> any context. If we include the pid, uid and comm we get output as
>>> follows:
>>>
>>> time->Wed Dec 13 21:59:59 2023
>>> type=BPF msg=audit(1702504799.156:99528): pid=27279 uid=0
>>> comm="new_name" prog-id=50092 op=UNLOAD
>>
>> Is it possible to integrate these common details like pid, uid, and
>> comm into the audit_log_format() function for automatic inclusion? Or
>> would it be more appropriate to create a new helper function like
>> audit_log_format_common() dedicated specifically to incorporating
>> these common details? What are your thoughts on this?
There's audit_log_task_info from audit.h which adds everything. My
concern was that it is very verbose and doesn’t appear to be widely
used. I don’t think it warrants a helper function just yet since
we’re only doing audit logging in this one function.
That said, I’m working on a patch series to add audit logging to
bpf_link attach and detach events. I’ll gladly turn that into a
helper then since it would be used in more than one place.
> BTW, bpf prog can be unloaded in irq context. Therefore we can't do it
> for BPF_AUDIT_UNLOAD.
I’ve been running this locally, and occasionally I see unload events
where the comm is “kworker/0:0” - I assume that those are from within
the irq context.
type=BPF msg=audit(1702504511.397:202): pid=1 uid=0
comm="systemd" prog-id=75 op=LOAD
type=BPF msg=audit(1702504541.516:213): pid=23152 uid=0
comm="kworker/0:0" prog-id=75 op=UNLOAD
That looks ok to me, but it wouldn’t be too hard to skip adding this
information in the irq context if you’d rather.
- Dave
