On 2019-10-10 20:38, Paul Moore wrote:
> On Wed, Sep 18, 2019 at 9:24 PM Richard Guy Briggs <rgb@xxxxxxxxxx> wrote:
> > Since we are tracking the life of each audit container indentifier, we
> > can match the creation event with the destruction event. Log the
> > destruction of the audit container identifier when the last process in
> > that container exits.
> >
> > Signed-off-by: Richard Guy Briggs <rgb@xxxxxxxxxx>
> > ---
> > kernel/audit.c | 32 ++++++++++++++++++++++++++++++++
> > kernel/audit.h | 2 ++
> > kernel/auditsc.c | 2 ++
> > 3 files changed, 36 insertions(+)
> >
> > diff --git a/kernel/audit.c b/kernel/audit.c
> > index ea0899130cc1..53d13d638c63 100644
> > --- a/kernel/audit.c
> > +++ b/kernel/audit.c
> > @@ -2503,6 +2503,38 @@ int audit_set_contid(struct task_struct *task, u64 contid)
> > return rc;
> > }
> >
> > +void audit_log_container_drop(void)
> > +{
> > + struct audit_buffer *ab;
> > + uid_t uid;
> > + struct tty_struct *tty;
> > + char comm[sizeof(current->comm)];
> > +
> > + if (!current->audit || !current->audit->cont ||
> > + refcount_read(¤t->audit->cont->refcount) > 1)
> > + return;
> > + ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONTAINER_OP);
> > + if (!ab)
> > + return;
> > +
> > + uid = from_kuid(&init_user_ns, task_uid(current));
> > + tty = audit_get_tty();
> > + audit_log_format(ab,
> > + "op=drop opid=%d contid=%llu old-contid=%llu pid=%d uid=%u auid=%u tty=%s ses=%u",
> > + task_tgid_nr(current), audit_get_contid(current),
> > + audit_get_contid(current), task_tgid_nr(current), uid,
> > + from_kuid(&init_user_ns, audit_get_loginuid(current)),
> > + tty ? tty_name(tty) : "(none)",
> > + audit_get_sessionid(current));
> > + audit_put_tty(tty);
> > + audit_log_task_context(ab);
> > + audit_log_format(ab, " comm=");
> > + audit_log_untrustedstring(ab, get_task_comm(comm, current));
> > + audit_log_d_path_exe(ab, current->mm);
> > + audit_log_format(ab, " res=1");
> > + audit_log_end(ab);
> > +}
>
> Why can't we just do this in audit_cont_put()? Is it because we call
> audit_cont_put() in the new audit_free() function? What if we were to
> do it in __audit_free()/audit_free_syscall()?
The intent was to put this before the EOE record of a syscall so we
could fill out all the fields similarly to op=set, but this could stand
alone dropping or nulling a bunch of fields.
It would also never get printed if we left it before the EOE and had the
audit signal info record keep a reference to it.
Hmmm...
> paul moore
- RGB
--
Richard Guy Briggs <rgb@xxxxxxxxxx>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635
