On 5/21/21 10:49 PM, Paul Moore wrote:
> WARNING - This is a work in progress and should not be merged
> anywhere important. It is almost surely not complete, and while it
> probably compiles it likely hasn't been booted and will do terrible
> things. You have been warned.
>
> This patch adds basic auditing to io_uring operations, regardless of
> their context. This is accomplished by allocating audit_context
> structures for the io-wq worker and io_uring SQPOLL kernel threads
> as well as explicitly auditing the io_uring operations in
> io_issue_sqe(). The io_uring operations are audited using a new
> AUDIT_URINGOP record, an example is shown below:
>
> % <TODO - insert AUDIT_URINGOP record example>
>
> Thanks to Richard Guy Briggs for review and feedback.
>
> Signed-off-by: Paul Moore <paul@xxxxxxxxxxxxxx>
> ---
[...]
> diff --git a/fs/io_uring.c b/fs/io_uring.c
> index e481ac8a757a..e9941d1ad8fd 100644
> --- a/fs/io_uring.c
> +++ b/fs/io_uring.c
> @@ -78,6 +78,7 @@
> #include <linux/task_work.h>
> #include <linux/pagemap.h>
> #include <linux/io_uring.h>
> +#include <linux/audit.h>
>
> #define CREATE_TRACE_POINTS
> #include <trace/events/io_uring.h>
> @@ -6105,6 +6106,9 @@ static int io_issue_sqe(struct io_kiocb *req, unsigned int issue_flags)
> if (req->work.creds && req->work.creds != current_cred())
> creds = override_creds(req->work.creds);
>
> + if (req->opcode < IORING_OP_LAST)
always true at this point
> + audit_uring_entry(req->opcode);
So, it adds two if's with memory loads (i.e. current->audit_context)
per request in one of the hottest functions here... No way, nack
Maybe, if it's dynamically compiled into like kprobes if it's
_really_ used.
> +
> switch (req->opcode) {
> case IORING_OP_NOP:
> ret = io_nop(req, issue_flags);
> @@ -6211,6 +6215,9 @@ static int io_issue_sqe(struct io_kiocb *req, unsigned int issue_flags)
> break;
> }
>
> + if (req->opcode < IORING_OP_LAST)
> + audit_uring_exit(!ret, ret);
> +
> if (creds)
> revert_creds(creds);
--
Pavel Begunkov
