On Mar 7, 2025 Casey Schaufler <casey@xxxxxxxxxxxxxxxx> wrote:
>
> Create a new audit record AUDIT_MAC_OBJ_CONTEXTS.
> An example of the MAC_OBJ_CONTEXTS (1424) record is:
>
> type=MAC_OBJ_CONTEXTS[1424]
> msg=audit(1601152467.009:1050):
> obj_selinux=unconfined_u:object_r:user_home_t:s0
>
> When an audit event includes a AUDIT_MAC_OBJ_CONTEXTS record
> the "obj=" field in other records in the event will be "obj=?".
> An AUDIT_MAC_OBJ_CONTEXTS record is supplied when the system has
> multiple security modules that may make access decisions based
> on an object security context.
>
> Signed-off-by: Casey Schaufler <casey@xxxxxxxxxxxxxxxx>
> ---
> include/linux/audit.h | 7 ++++-
> include/linux/lsm_hooks.h | 3 +++
> include/linux/security.h | 1 +
> include/uapi/linux/audit.h | 1 +
> kernel/audit.c | 53 +++++++++++++++++++++++++++++++++++++-
> kernel/auditsc.c | 45 ++++++++------------------------
> security/security.c | 3 +++
> security/selinux/hooks.c | 1 +
> security/smack/smack_lsm.c | 1 +
> 9 files changed, 79 insertions(+), 36 deletions(-)
>
> diff --git a/include/linux/audit.h b/include/linux/audit.h
> index ee3e2ce70c45..0b17acf459f2 100644
> --- a/include/linux/audit.h
> +++ b/include/linux/audit.h
> @@ -186,8 +186,10 @@ extern void audit_log_path_denied(int type,
> const char *operation);
> extern void audit_log_lost(const char *message);
>
> +extern int audit_log_object_context(struct audit_buffer *ab,
> + struct lsm_prop *prop);
Less is more, "audit_log_obj_ctx()" to match "audit_log_subj_ctx()".
> extern int audit_log_subject_context(struct audit_buffer *ab,
> - struct lsm_prop *blob);
> + struct lsm_prop *prop);
Do that back in patch 5/6 please.
> diff --git a/kernel/audit.c b/kernel/audit.c
> index f0c1f0c0b250..054776f29327 100644
> --- a/kernel/audit.c
> +++ b/kernel/audit.c
> @@ -1116,7 +1116,6 @@ static int is_audit_feature_set(int i)
> return af.features & AUDIT_FEATURE_TO_MASK(i);
> }
>
> -
> static int audit_get_feature(struct sk_buff *skb)
> {
> u32 seq;
> @@ -2302,6 +2301,58 @@ int audit_log_task_context(struct audit_buffer *ab)
> }
> EXPORT_SYMBOL(audit_log_task_context);
>
> +int audit_log_object_context(struct audit_buffer *ab, struct lsm_prop *prop)
> +{
> + int i;
> + int rc;
> + int error = 0;
> + char *space = "";
> + struct lsm_context context;
> +
> + if (lsm_objctx_cnt < 2) {
> + error = security_lsmprop_to_secctx(prop, &context,
> + LSM_ID_UNDEF);
> + if (error < 0) {
> + if (error != -EINVAL)
> + goto error_path;
> + return error;
> + }
> + audit_log_format(ab, " obj=%s", context.context);
> + security_release_secctx(&context);
> + return 0;
> + }
> + audit_log_format(ab, " obj=?");
> + error = audit_buffer_aux_new(ab, AUDIT_MAC_OBJ_CONTEXTS);
> + if (error)
> + goto error_path;
> +
> + for (i = 0; i < lsm_active_cnt; i++) {
> + if (!lsm_idlist[i]->objctx)
> + continue;
> + rc = security_lsmprop_to_secctx(prop, &context,
> + lsm_idlist[i]->id);
> + if (rc < 0) {
> + audit_log_format(ab, "%sobj_%s=?", space,
> + lsm_idlist[i]->name);
> + if (rc != -EINVAL)
> + audit_panic("error in audit_log_object_context");
> + error = rc;
> + } else {
> + audit_log_format(ab, "%sobj_%s=%s", space,
> + lsm_idlist[i]->name, context.context);
> + security_release_secctx(&context);
> + }
> + space = " ";
> + }
> +
> + audit_buffer_aux_end(ab);
> + return error;
> +
> +error_path:
> + audit_panic("error in audit_log_object_context");
> + return error;
> +}
Let's follow the same code pattern as suggested for the subject.
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index d98ce7097a2d..82470862ea81 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -1780,15 +1756,16 @@ static void audit_log_exit(void)
> axs->target_sessionid[i],
> &axs->target_ref[i],
> axs->target_comm[i]))
> - call_panic = 1;
> + call_panic = 1;
> }
>
> if (context->target_pid &&
> audit_log_pid_context(context, context->target_pid,
> context->target_auid, context->target_uid,
> context->target_sessionid,
> - &context->target_ref, context->target_comm))
> - call_panic = 1;
> + &context->target_ref,
> + context->target_comm))
> + call_panic = 1;
Thank you for both of the indent fixes above.
--
paul-moore.com
