Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753808AbaJMM0K (ORCPT ); Mon, 13 Oct 2014 08:26:10 -0400 Received: from static.92.5.9.176.clients.your-server.de ([176.9.5.92]:39534 "EHLO mail.hallyn.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753272AbaJMM0I (ORCPT ); Mon, 13 Oct 2014 08:26:08 -0400 Date: Mon, 13 Oct 2014 14:26:06 +0200 From: "Serge E. Hallyn" To: Richard Guy Briggs Cc: linux-audit@redhat.com, linux-kernel@vger.kernel.org, containers@lists.linux-foundation.org, eparis@redhat.com, sgrubb@redhat.com, aviro@redhat.com, pmoore@redhat.com, arozansk@redhat.com, ebiederm@xmission.com, serge@hallyn.com Subject: Re: [PATCH V5 06/13] audit: log creation and deletion of namespace instances Message-ID: <20141013122606.GD24703@mail.hallyn.com> References: <55b0228c68d0e74480ce73f88e05d16455c4c843.1412543112.git.rgb@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <55b0228c68d0e74480ce73f88e05d16455c4c843.1412543112.git.rgb@redhat.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Quoting Richard Guy Briggs (rgb@redhat.com): > Log the creation and deletion of namespace instances in all 6 types of > namespaces. > > Twelve new audit message types have been introduced: > AUDIT_NS_INIT_MNT 1330 /* Record mount namespace instance creation */ > AUDIT_NS_INIT_UTS 1331 /* Record UTS namespace instance creation */ > AUDIT_NS_INIT_IPC 1332 /* Record IPC namespace instance creation */ > AUDIT_NS_INIT_USER 1333 /* Record USER namespace instance creation */ > AUDIT_NS_INIT_PID 1334 /* Record PID namespace instance creation */ > AUDIT_NS_INIT_NET 1335 /* Record NET namespace instance creation */ > AUDIT_NS_DEL_MNT 1336 /* Record mount namespace instance deletion */ > AUDIT_NS_DEL_UTS 1337 /* Record UTS namespace instance deletion */ > AUDIT_NS_DEL_IPC 1338 /* Record IPC namespace instance deletion */ > AUDIT_NS_DEL_USER 1339 /* Record USER namespace instance deletion */ > AUDIT_NS_DEL_PID 1340 /* Record PID namespace instance deletion */ > AUDIT_NS_DEL_NET 1341 /* Record NET namespace instance deletion */ > > As suggested by Eric Paris, there are 12 message types, one for each of > creation and deletion, one for each type of namespace so that text searches are > easier in conjunction with the AUDIT_NS_INFO message type, being able to search > for all records such as "netns=7 " and to avoid fields disappearing per message > type to make ausearch more efficient. > > A typical startup would look roughly like: > > type=AUDIT_NS_INIT_UTS msg=audit(1408577534.868:5): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=kernel old_utsns=0 utsns=2 res=1 > type=AUDIT_NS_INIT_USER msg=audit(1408577534.868:6): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=kernel old_userns=0 userns=3 res=1 > type=AUDIT_NS_INIT_PID msg=audit(1408577534.868:7): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=kernel old_pidns=0 pidns=4 res=1 > type=AUDIT_NS_INIT_MNT msg=audit(1408577534.868:8): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=kernel old_mntns=0 mntns=5 res=1 > type=AUDIT_NS_INIT_IPC msg=audit(1408577534.868:9): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=kernel old_ipcns=0 ipcns=1 res=1 > type=AUDIT_NS_INIT_NET msg=audit(1408577533.500:10): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=kernel old_netns=0 netns=7 res=1 > > And a CLONE action would result in: > type=type=AUDIT_NS_INIT_NET msg=audit(1408577535.306:81): pid=481 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 old_netns=7 netns=8 res=1 > type=type=AUDIT_NS_INIT_MNT msg=audit(1408577535.307:83): pid=481 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 old_mntns=5 mntns=9 res=1 > > While deleting a namespace would result in: > type=type=AUDIT_NS_DEL_MNT msg=audit(1408577552.221:85): pid=481 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 mntns=9 res=1 > > If non-zero, old_snum lists the namespace from which it was cloned. > > Signed-off-by: Richard Guy Briggs Acked-by: Serge Hallyn Two suggestions below though > --- > fs/namespace.c | 12 ++++++++++ > include/linux/audit.h | 8 +++++++ > include/uapi/linux/audit.h | 12 ++++++++++ > ipc/namespace.c | 10 +++++++++ > kernel/audit.c | 49 ++++++++++++++++++++++++++++++++++++++++++++ > kernel/pid_namespace.c | 10 +++++++++ > kernel/user_namespace.c | 11 +++++++++ > kernel/utsname.c | 11 +++++++++ > net/core/net_namespace.c | 12 ++++++++++ > 9 files changed, 135 insertions(+), 0 deletions(-) > > diff --git a/fs/namespace.c b/fs/namespace.c > index f433f21..cb05b3d 100644 > --- a/fs/namespace.c > +++ b/fs/namespace.c > @@ -24,6 +24,7 @@ > #include > #include > #include > +#include > #include "pnode.h" > #include "internal.h" > > @@ -2459,6 +2460,7 @@ dput_out: > > static void free_mnt_ns(struct mnt_namespace *ns) > { > + audit_log_ns_del(AUDIT_NS_DEL_MNT, ns->serial_num); > proc_free_inum(ns->proc_inum); > put_user_ns(ns->user_ns); > kfree(ns); > @@ -2519,6 +2521,7 @@ struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns, > new_ns = alloc_mnt_ns(user_ns); > if (IS_ERR(new_ns)) > return new_ns; > + audit_log_ns_init(AUDIT_NS_INIT_MNT, ns->serial_num, new_ns->serial_num); > > namespace_lock(); > /* First pass: copy the tree topology */ > @@ -2831,6 +2834,15 @@ static void __init init_mount_tree(void) > set_fs_root(current->fs, &root); > } > > +/* log the serial number of init mnt namespace after audit service starts */ > +static int __init mnt_ns_init_log(void) > +{ > + struct mnt_namespace *init_mnt_ns = init_task.nsproxy->mnt_ns; > + audit_log_ns_init(AUDIT_NS_INIT_MNT, 0, init_mnt_ns->serial_num); > + return 0; > +} > +late_initcall(mnt_ns_init_log); > + > void __init mnt_init(void) > { > unsigned u; > diff --git a/include/linux/audit.h b/include/linux/audit.h > index 7cdebdc..1474334 100644 > --- a/include/linux/audit.h > +++ b/include/linux/audit.h > @@ -481,6 +481,9 @@ extern void audit_log_ns_info(struct task_struct *tsk); > static inline void audit_log_ns_info(struct task_struct *tsk) > { } > #endif > +extern int audit_log_ns_init(int type, long long old_snum, > + long long snum); > +extern int audit_log_ns_del(int type, long long snum); > > extern int audit_update_lsm_rules(void); > > @@ -539,6 +542,11 @@ static inline void audit_log_task_info(struct audit_buffer *ab, > { } > static inline void audit_log_ns_info(struct task_struct *tsk) > { } > +static inline int audit_log_ns_init(int type, long long old_snum, > + long long snum) > +{ } > +static inline int audit_log_ns_del(int type, long long snum) > +{ } > #define audit_enabled 0 > #endif /* CONFIG_AUDIT */ > static inline void audit_log_string(struct audit_buffer *ab, const char *buf) > diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h > index 760357e..1acfea7 100644 > --- a/include/uapi/linux/audit.h > +++ b/include/uapi/linux/audit.h > @@ -111,6 +111,18 @@ > #define AUDIT_PROCTITLE 1327 /* Proctitle emit event */ > #define AUDIT_FEATURE_CHANGE 1328 /* audit log listing feature changes */ > #define AUDIT_NS_INFO 1329 /* Record process namespace IDs */ > +#define AUDIT_NS_INIT_MNT 1330 /* Record mount namespace instance creation */ > +#define AUDIT_NS_INIT_UTS 1331 /* Record UTS namespace instance creation */ > +#define AUDIT_NS_INIT_IPC 1332 /* Record IPC namespace instance creation */ > +#define AUDIT_NS_INIT_USER 1333 /* Record USER namespace instance creation */ > +#define AUDIT_NS_INIT_PID 1334 /* Record PID namespace instance creation */ > +#define AUDIT_NS_INIT_NET 1335 /* Record NET namespace instance creation */ > +#define AUDIT_NS_DEL_MNT 1336 /* Record mount namespace instance deletion */ > +#define AUDIT_NS_DEL_UTS 1337 /* Record UTS namespace instance deletion */ > +#define AUDIT_NS_DEL_IPC 1338 /* Record IPC namespace instance deletion */ > +#define AUDIT_NS_DEL_USER 1339 /* Record USER namespace instance deletion */ > +#define AUDIT_NS_DEL_PID 1340 /* Record PID namespace instance deletion */ > +#define AUDIT_NS_DEL_NET 1341 /* Record NET namespace instance deletion */ > > #define AUDIT_AVC 1400 /* SE Linux avc denial or grant */ > #define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */ > diff --git a/ipc/namespace.c b/ipc/namespace.c > index 36ce7ff..538c4b9 100644 > --- a/ipc/namespace.c > +++ b/ipc/namespace.c > @@ -13,6 +13,7 @@ > #include > #include > #include > +#include > > #include "util.h" > > @@ -42,6 +43,7 @@ static struct ipc_namespace *create_ipc_ns(struct user_namespace *user_ns, > atomic_inc(&nr_ipc_ns); > > ns->serial_num = ns_serial(); > + audit_log_ns_init(AUDIT_NS_INIT_IPC, old_ns->serial_num, ns->serial_num); > > sem_init_ns(ns); > msg_init_ns(ns); > @@ -121,6 +123,7 @@ static void free_ipc_ns(struct ipc_namespace *ns) > */ > ipcns_notify(IPCNS_REMOVED); > put_user_ns(ns->user_ns); > + audit_log_ns_del(AUDIT_NS_DEL_IPC, ns->serial_num); > proc_free_inum(ns->proc_inum); > kfree(ns); > } > @@ -207,3 +210,10 @@ const struct proc_ns_operations ipcns_operations = { > .inum = ipcns_inum, > .snum = ipcns_snum, > }; > + > +static int __init ipc_namespaces_init(void) > +{ > + return audit_log_ns_init(AUDIT_NS_INIT_IPC, 0, init_ipc_ns.serial_num); > +} > + > +late_initcall(ipc_namespaces_init); > diff --git a/kernel/audit.c b/kernel/audit.c > index 8ff7f28..a17a09f 100644 > --- a/kernel/audit.c > +++ b/kernel/audit.c > @@ -1960,6 +1960,55 @@ out: > kfree(name); > } > > +#ifdef CONFIG_NAMESPACES > +static char* ns_name[] = { > + "mnt", > + "uts", > + "ipc", > + "user", > + "pid", > + "net", Comment here that the order corresponds to the AUDIT_NS_INIT_MNT.. #defines order, and maybe even move this next to those. > +}; > + > +/** > + * audit_log_ns_init - report a namespace instance creation > + * @type: type of audit namespace instance created message > + * @old_snum: the serial number of the cloned namespace instance > + * @snum: the serial number of the new namespace instance > + */ > +int audit_log_ns_init(int type, long long old_snum, long long snum) > +{ > + struct audit_buffer *ab; > + char* audit_ns_name = ns_name[type - AUDIT_NS_INIT_MNT]; > + > + if (type < AUDIT_NS_INIT_MNT || type > AUDIT_NS_INIT_NET) probably worth defining an AUDIT_NS_INIT_FIRST and AUDIT_NS_INIT_LAST in audit.h which can be updated at the source defines. > + return 0; > + audit_log_common_recv_msg(&ab, type); > + audit_log_format(ab, " old_%sns=%llx %sns=%llx res=1", > + audit_ns_name, old_snum, audit_ns_name, snum); > + audit_log_end(ab); > + return 0; > +} > + > +/** > + * audit_log_ns_del - report a namespace instance deleted > + * @type: type of audit namespace instance deleted message > + * @snum: the serial number of the namespace instance > + */ > +int audit_log_ns_del(int type, long long snum) > +{ > + struct audit_buffer *ab; > + char* audit_ns_name = ns_name[type - AUDIT_NS_DEL_MNT]; > + > + if (type < AUDIT_NS_DEL_MNT || type > AUDIT_NS_DEL_NET) > + return 0; > + audit_log_common_recv_msg(&ab, type); > + audit_log_format(ab, " %ssn=%llx res=1", audit_ns_name, snum); > + audit_log_end(ab); > + return 0; > +} > +#endif /* CONFIG_NAMESPACES */ > + > /** > * audit_log_end - end one audit record > * @ab: the audit_buffer > diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c > index 059b330..7da351a 100644 > --- a/kernel/pid_namespace.c > +++ b/kernel/pid_namespace.c > @@ -18,6 +18,7 @@ > #include > #include > #include > +#include > > struct pid_cache { > int nr_ids; > @@ -110,6 +111,8 @@ static struct pid_namespace *create_pid_namespace(struct user_namespace *user_ns > goto out_free_map; > > ns->serial_num = ns_serial(); > + audit_log_ns_init(AUDIT_NS_INIT_PID, parent_pid_ns->serial_num, > + ns->serial_num); > > kref_init(&ns->kref); > ns->level = level; > @@ -144,6 +147,7 @@ static void destroy_pid_namespace(struct pid_namespace *ns) > { > int i; > > + audit_log_ns_del(AUDIT_NS_DEL_PID, ns->serial_num); > proc_free_inum(ns->proc_inum); > for (i = 0; i < PIDMAP_ENTRIES; i++) > kfree(ns->pidmap[i].page); > @@ -397,3 +401,9 @@ static __init int pid_namespaces_init(void) > } > > __initcall(pid_namespaces_init); > + > +static __init int pid_namespaces_late_init(void) > +{ > + return audit_log_ns_init(AUDIT_NS_INIT_PID, 0, init_pid_ns.serial_num); > +} > +late_initcall(pid_namespaces_late_init); > diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c > index 3f04df5..24497a0 100644 > --- a/kernel/user_namespace.c > +++ b/kernel/user_namespace.c > @@ -22,6 +22,7 @@ > #include > #include > #include > +#include > > static struct kmem_cache *user_ns_cachep __read_mostly; > > @@ -93,6 +94,8 @@ int create_user_ns(struct cred *new) > } > > ns->serial_num = ns_serial(); > + audit_log_ns_init(AUDIT_NS_INIT_USER, parent_ns->serial_num, > + ns->serial_num); > > atomic_set(&ns->count, 1); > /* Leave the new->user_ns reference with the new user namespace. */ > @@ -138,6 +141,7 @@ void free_user_ns(struct user_namespace *ns) > #ifdef CONFIG_PERSISTENT_KEYRINGS > key_put(ns->persistent_keyring_register); > #endif > + audit_log_ns_del(AUDIT_NS_DEL_USER, ns->serial_num); > proc_free_inum(ns->proc_inum); > kmem_cache_free(user_ns_cachep, ns); > ns = parent; > @@ -918,3 +922,10 @@ static __init int user_namespaces_init(void) > return 0; > } > subsys_initcall(user_namespaces_init); > + > +static __init int user_namespaces_late_init(void) > +{ > + return audit_log_ns_init(AUDIT_NS_INIT_USER, 0, > + init_user_ns.serial_num); > +} > +late_initcall(user_namespaces_late_init); > diff --git a/kernel/utsname.c b/kernel/utsname.c > index ffeac1b..05ecc2d 100644 > --- a/kernel/utsname.c > +++ b/kernel/utsname.c > @@ -16,6 +16,7 @@ > #include > #include > #include > +#include > > static struct uts_namespace *create_uts_ns(void) > { > @@ -49,6 +50,7 @@ static struct uts_namespace *clone_uts_ns(struct user_namespace *user_ns, > } > > ns->serial_num = ns_serial(); > + audit_log_ns_init(AUDIT_NS_INIT_UTS, old_ns->serial_num, ns->serial_num); > > down_read(&uts_sem); > memcpy(&ns->name, &old_ns->name, sizeof(ns->name)); > @@ -86,6 +88,7 @@ void free_uts_ns(struct kref *kref) > > ns = container_of(kref, struct uts_namespace, kref); > put_user_ns(ns->user_ns); > + audit_log_ns_del(AUDIT_NS_DEL_UTS, ns->serial_num); > proc_free_inum(ns->proc_inum); > kfree(ns); > } > @@ -148,3 +151,11 @@ const struct proc_ns_operations utsns_operations = { > .inum = utsns_inum, > .snum = utsns_snum, > }; > + > +static int __init uts_namespaces_init(void) > +{ > + return audit_log_ns_init(AUDIT_NS_INIT_UTS, 0, > + init_uts_ns.serial_num); > +} > + > +late_initcall(uts_namespaces_init); > diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c > index c402eea..295ecc3 100644 > --- a/net/core/net_namespace.c > +++ b/net/core/net_namespace.c > @@ -17,6 +17,7 @@ > #include > #include > #include > +#include > > /* > * Our network namespace constructor/destructor lists > @@ -253,6 +254,8 @@ struct net *copy_net_ns(unsigned long flags, > mutex_lock(&net_mutex); > rv = setup_net(net, user_ns); > if (rv == 0) { > + audit_log_ns_init(AUDIT_NS_INIT_NET, old_net->serial_num, > + net->serial_num); > rtnl_lock(); > list_add_tail_rcu(&net->list, &net_namespace_list); > rtnl_unlock(); > @@ -395,6 +398,7 @@ static __net_init int net_ns_net_init(struct net *net) > > static __net_exit void net_ns_net_exit(struct net *net) > { > + audit_log_ns_del(AUDIT_NS_DEL_NET, net->serial_num); > proc_free_inum(net->proc_inum); > } > > @@ -441,6 +445,14 @@ static int __init net_ns_init(void) > > pure_initcall(net_ns_init); > > +/* log the serial number of init_net namespace after audit service starts */ > +static int __init net_ns_init_log(void) > +{ > + audit_log_ns_init(AUDIT_NS_INIT_NET, 0, init_net.serial_num); > + return 0; > +} > +late_initcall(net_ns_init_log); > + > #ifdef CONFIG_NET_NS > static int __register_pernet_operations(struct list_head *list, > struct pernet_operations *ops) > -- > 1.7.1 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/