On Thu, Dec 14, 2023 at 6:33 AM Yafang Shao <laoar.shao@xxxxxxxxx> wrote: > > On Thu, Dec 14, 2023 at 10:11 PM Dave Tucker <dave@xxxxxxxxxxxxx> wrote: > > > > > > > > > On 14 Dec 2023, at 13:21, Yafang Shao <laoar.shao@xxxxxxxxx> wrote: > > > > > > On Thu, Dec 14, 2023 at 9:13 PM Yafang Shao <laoar.shao@xxxxxxxxx> wrote: > > >> > > >> On Thu, Dec 14, 2023 at 8:07 PM Dave Tucker <dave@xxxxxxxxxxxxx> wrote: > > >>> > > >>> Current output from auditd is as follows: > > >>> > > >>> time->Wed Dec 13 21:39:24 2023 > > >>> type=BPF msg=audit(1702503564.519:11241): prog-id=439 op=LOAD > > >>> > > >>> This only tells you that a BPF program was loaded, but without > > >>> any context. If we include the pid, uid and comm we get output as > > >>> follows: > > >>> > > >>> time->Wed Dec 13 21:59:59 2023 > > >>> type=BPF msg=audit(1702504799.156:99528): pid=27279 uid=0 > > >>> comm="new_name" prog-id=50092 op=UNLOAD > > >> > > >> Is it possible to integrate these common details like pid, uid, and > > >> comm into the audit_log_format() function for automatic inclusion? Or > > >> would it be more appropriate to create a new helper function like > > >> audit_log_format_common() dedicated specifically to incorporating > > >> these common details? What are your thoughts on this? > > > > There's audit_log_task_info from audit.h which adds everything. My > > concern was that it is very verbose and doesn’t appear to be widely > > used. I don’t think it warrants a helper function just yet since > > we’re only doing audit logging in this one function. > > > > That said, I’m working on a patch series to add audit logging to > > bpf_link attach and detach events. I’ll gladly turn that into a > > helper then since it would be used in more than one place. > > > > > BTW, bpf prog can be unloaded in irq context. Therefore we can't do it > > > for BPF_AUDIT_UNLOAD. > > > > I’ve been running this locally, and occasionally I see unload events > > where the comm is “kworker/0:0” - I assume that those are from within > > the irq context. > > > > type=BPF msg=audit(1702504511.397:202): pid=1 uid=0 > > comm="systemd" prog-id=75 op=LOAD > > > > type=BPF msg=audit(1702504541.516:213): pid=23152 uid=0 > > comm="kworker/0:0" prog-id=75 op=UNLOAD > > > > That looks ok to me, but it wouldn’t be too hard to skip adding this > > information in the irq context if you’d rather. > > I believe we need to skip them. Including random task information > could potentially lead to confusion. Yep. It's broken. We cannot access current_cred() from here. Current is a random task.
