Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <20200806080358.3124505-1-tweek@google.com> <20200806080358.3124505-2-tweek@google.com>
 <89d23362-39b9-79e5-84f1-d7b89204ef38@gmail.com> <8627d780-0e19-6755-0de5-c686deb0f5de@sony.com>
 <971592b6-5d5f-05d8-d243-b521fe65577d@gmail.com> <07e2c48d-3918-6ceb-a6b2-4e2f18f9ea01@gmail.com>
In-Reply-To: <07e2c48d-3918-6ceb-a6b2-4e2f18f9ea01@gmail.com>
From:   Stephen Smalley <stephen.smalley.work@gmail.com>
Date:   Thu, 6 Aug 2020 09:49:47 -0400
Message-ID: <CAEjxPJ4no_GqMp8aw43zpwmwq42Wi_1dvP+ZBs1a-mnReDt5Og@mail.gmail.com>
Subject: Re: [PATCH 2/2] selinux: add attributes to avc tracepoint
To:     peter enderborg <peter.enderborg@sony.com>,
        =?UTF-8?Q?Thi=C3=A9baud_Weksteen?= <tweek@google.com>,
        Paul Moore <paul@paul-moore.com>
Cc:     Nick Kralevich <nnk@google.com>,
        Eric Paris <eparis@parisplace.org>,
        Steven Rostedt <rostedt@goodmis.org>,
        Ingo Molnar <mingo@redhat.com>,
        Mauro Carvalho Chehab <mchehab+huawei@kernel.org>,
        "David S. Miller" <davem@davemloft.net>,
        Rob Herring <robh@kernel.org>, Arnd Bergmann <arnd@arndb.de>,
        linux-kernel <linux-kernel@vger.kernel.org>,
        SElinux list <selinux@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Thu, Aug 6, 2020 at 9:45 AM Stephen Smalley
<stephen.smalley.work@gmail.com> wrote:
>
> On 8/6/20 8:32 AM, Stephen Smalley wrote:
>
> > On 8/6/20 8:24 AM, peter enderborg wrote:
> >
> >> On 8/6/20 2:11 PM, Stephen Smalley wrote:
> >>> On 8/6/20 4:03 AM, Thi=C3=A9baud Weksteen wrote:
> >>>
> >>>> From: Peter Enderborg <peter.enderborg@sony.com>
> >>>>
> >>>> Add further attributes to filter the trace events from AVC.
> >>> Please include sample usage and output in the description.
> >>>
> >>>
> >> Im not sure where you want it to be.
> >>
> >> In the commit message or in a Documentation/trace/events-avc.rst ?
> >
> > I was just asking for it in the commit message / patch description.  I
> > don't know what is typical for Documentation/trace.
>
> For example, I just took the patches for a spin, running the
> selinux-testsuite under perf like so:
>
> sudo perf record -e avc:selinux_audited -g make test
>
> and then ran:
>
> sudo perf report -g
>
> and a snippet of sample output included:
>
>       6.40%     6.40%  requested=3D0x800000 denied=3D0x800000
> audited=3D0x800000 result=3D-13 ssid=3D922 tsid=3D922
> scontext=3Dunconfined_u:unconfined_r:test_binder_mgr_t:s0-s0:c0.c1023
> tcontext=3Dunconfined_u:unconfined_r:test_binder_mgr_t:s0-s0:c0.c1023
> tclass=3Dcapability

So then the question becomes how do you use the above information,
e.g. is that sufficient to correlate it to an actual avc: denied
message, how do you decode the requested/denied/audited fields (or
should the code do that for you and just report the string name(s) of
the permission(s), do you need all three of those fields separately,
is it useful to log the ssid/tsid at all given that you have the
contexts and sids are dynamically assigned, etc.

>              |
>              ---0x495641000028933d
>                 __libc_start_main
>                 |
>                 |--4.60%--__GI___ioctl
>                 |          entry_SYSCALL_64
>                 |          do_syscall_64
>                 |          __x64_sys_ioctl
>                 |          ksys_ioctl
>                 |          binder_ioctl
>                 |          binder_set_nice
>                 |          can_nice
>                 |          capable
>                 |          security_capable
>                 |          cred_has_capability.isra.0
>                 |          slow_avc_audit
>                 |          common_lsm_audit
>                 |          avc_audit_post_callback
>                 |          avc_audit_post_callback