On Thu, Dec 14, 2023 at 10:11 PM Dave Tucker <dave@xxxxxxxxxxxxx> wrote: > > > > > On 14 Dec 2023, at 13:21, Yafang Shao <laoar.shao@xxxxxxxxx> wrote: > > > > On Thu, Dec 14, 2023 at 9:13 PM Yafang Shao <laoar.shao@xxxxxxxxx> wrote: > >> > >> On Thu, Dec 14, 2023 at 8:07 PM Dave Tucker <dave@xxxxxxxxxxxxx> wrote: > >>> > >>> Current output from auditd is as follows: > >>> > >>> time->Wed Dec 13 21:39:24 2023 > >>> type=BPF msg=audit(1702503564.519:11241): prog-id=439 op=LOAD > >>> > >>> This only tells you that a BPF program was loaded, but without > >>> any context. If we include the pid, uid and comm we get output as > >>> follows: > >>> > >>> time->Wed Dec 13 21:59:59 2023 > >>> type=BPF msg=audit(1702504799.156:99528): pid=27279 uid=0 > >>> comm="new_name" prog-id=50092 op=UNLOAD > >> > >> Is it possible to integrate these common details like pid, uid, and > >> comm into the audit_log_format() function for automatic inclusion? Or > >> would it be more appropriate to create a new helper function like > >> audit_log_format_common() dedicated specifically to incorporating > >> these common details? What are your thoughts on this? > > There's audit_log_task_info from audit.h which adds everything. My > concern was that it is very verbose and doesn’t appear to be widely > used. I don’t think it warrants a helper function just yet since > we’re only doing audit logging in this one function. > > That said, I’m working on a patch series to add audit logging to > bpf_link attach and detach events. I’ll gladly turn that into a > helper then since it would be used in more than one place. > > > BTW, bpf prog can be unloaded in irq context. Therefore we can't do it > > for BPF_AUDIT_UNLOAD. > > I’ve been running this locally, and occasionally I see unload events > where the comm is “kworker/0:0” - I assume that those are from within > the irq context. > > type=BPF msg=audit(1702504511.397:202): pid=1 uid=0 > comm="systemd" prog-id=75 op=LOAD > > type=BPF msg=audit(1702504541.516:213): pid=23152 uid=0 > comm="kworker/0:0" prog-id=75 op=UNLOAD > > That looks ok to me, but it wouldn’t be too hard to skip adding this > information in the irq context if you’d rather. I believe we need to skip them. Including random task information could potentially lead to confusion. -- Regards Yafang
