Received: by 2002:a05:6a10:a0d1:0:0:0:0 with SMTP id j17csp1473058pxa; Thu, 13 Aug 2020 09:11:34 -0700 (PDT) X-Google-Smtp-Source: ABdhPJz5cYTbTF0Sp/IN+bZxoWLlyVCd4PKq8cjmnTawpNjztxL4z2Y72hJdQa/xxGND7U7d9Mfa X-Received: by 2002:a17:906:4a07:: with SMTP id w7mr5288094eju.269.1597335094112; Thu, 13 Aug 2020 09:11:34 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1597335094; cv=none; d=google.com; s=arc-20160816; b=jktytcRkjfd+J7xp2upuwIkXOhehVE4xh8AW0W9Ogj5APaUgiXY3cc+2Q1Dua7RXBe etG+4GTcLkW+BF/VZm9HeELid90xNJM/qp0JCg1/20GlzSpd5FWYbH447bEzzUvCVjqP iPoTosKR10/p9ZA3GJaMCZ67nd1tGZNQ7OGuZpLqj4Ynw83fqxf+ya8hF4C0ePN6rmhW 5Sg5Kgwu2U6K7RfbizXXAnF44dST4VNY97+XiDdDtcH9YUCv3UNe8rkq+OnTO9XqD7eX we+zGiKnmLtsoeQTMuLduj5yDGLHyfBmzwdBW08CwbHyrHCRI30CRoUGYFXALOlJwKCi v65w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-language :content-transfer-encoding:in-reply-to:mime-version:user-agent:date :message-id:from:references:cc:to:subject; bh=cdMErYOG2bauY2puqf/KJm3m5vhoE8Ry7i88k5Gwr0M=; b=nrs0Byzrei5tGw3rvg1DQtx2aia0aiR9XHfTDljjCUt22K8NmZhnHq5lzZ29H6sMvd TU0FuNBgHSRK4kBdNZhKUV9+pgVKFjvOHTSLgRBoHu7wrIlLkECZ+Yqhrx71Z8GgcB05 /itnLK6uEqHtmOnaYdMmGmE8pPJIQkADuNLKq5DDayxtAzKA3IJoFz8oczVGt9dYhl3u F72mA5nQfpBihQRKC1AOYztUFkgD6fQlvnGeXI5NgUpQsQXP4hBdqOmE88ml7JslCIh8 MBP1tQ//CBWzvs4snGah5071h+78fb0O0eGe7FFqzENPq5VXo8XuUbOKlJ+8M3m5//fP Nsbg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=sony.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id q16si3618440edv.34.2020.08.13.09.11.09; Thu, 13 Aug 2020 09:11:34 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=sony.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726678AbgHMQKa convert rfc822-to-8bit (ORCPT + 99 others); Thu, 13 Aug 2020 12:10:30 -0400 Received: from seldsegrel01.sonyericsson.com ([37.139.156.29]:15302 "EHLO SELDSEGREL01.sonyericsson.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726252AbgHMQK3 (ORCPT ); Thu, 13 Aug 2020 12:10:29 -0400 Subject: Re: [PATCH v2 2/2] selinux: add basic filtering for audit trace events To: Stephen Smalley , Casey Schaufler , =?UTF-8?Q?Thi=c3=a9baud_Weksteen?= , Paul Moore CC: Nick Kralevich , Eric Paris , Steven Rostedt , Ingo Molnar , Mauro Carvalho Chehab , "David S. Miller" , Rob Herring , Arnd Bergmann , , References: <20200813144914.737306-1-tweek@google.com> <20200813144914.737306-2-tweek@google.com> <02c193e4-008a-5c3d-75e8-9be7bbcb941c@schaufler-ca.com> From: peter enderborg Message-ID: <8386aa4a-0687-769b-235d-9e8bf34ecf90@sony.com> Date: Thu, 13 Aug 2020 18:10:25 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8BIT Content-Language: en-GB X-SEG-SpamProfiler-Analysis: v=2.3 cv=frmim2wf c=1 sm=1 tr=0 a=kIrCkORFHx6JeP9rmF/Kww==:117 a=IkcTkHD0fZMA:10 a=y4yBn9ojGxQA:10 a=z6gsHLkEAAAA:8 a=-He6eWZHxituxyHJLsQA:9 a=QEXdDO2ut3YA:10 a=d-OLMTCWyvARjPbQ-enb:22 X-SEG-SpamProfiler-Score: 0 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 8/13/20 5:49 PM, Stephen Smalley wrote: > On 8/13/20 11:35 AM, peter enderborg wrote: > >> On 8/13/20 5:05 PM, Casey Schaufler wrote: >>> On 8/13/2020 7:48 AM, Thiébaud Weksteen wrote: >>>> From: Peter Enderborg >>>> >>>> This patch adds further attributes to the event. These attributes are >>>> helpful to understand the context of the message and can be used >>>> to filter the events. >>>> >>>> There are three common items. Source context, target context and tclass. >>>> There are also items from the outcome of operation performed. >>>> >>>> An event is similar to: >>>>             <...>-1309  [002] ....  6346.691689: selinux_audited: >>>>         requested=0x4000000 denied=0x4000000 audited=0x4000000 >>>>         result=-13 ssid=315 tsid=61 >>> It may not be my place to ask, but *please please please* don't >>> externalize secids. I understand that it's easier to type "42" >>> than "system_r:cupsd_t:s0-s0:c0.c1023", and that it's easier for >>> your tools to parse and store the number. Once you start training >>> people that system_r:cupsd_t:s0-s0:c0.c1023 is secid 42 you'll >>> never be able to change it. The secid will start showing up in >>> scripts. Bad  Things  Will  Happen. >> Ok, it seems to mostly against having this performance options. >> Yes, it is a kernel internal data. So is most of the kernel tracing. >> I see it is a primary tool for kernel debugging but than can also be >> used for user-space debugging tools.  Hiding data for debuggers >> does not make any sense too me. > > To be clear, userspace tools can't use fixed secid values because secids are dynamically assigned by SELinux and thus secid 42 need not correspond to the same security context across different boots even with the same kernel and policy.  I wouldn't include them in the event unless it is common practice to include fields that can only be interpreted if you can debug the running kernel.  It would be akin to including kernel pointers in the event (albeit without the KASLR ramifications). > Yes of course. Trace debugging is about running kernel. Would i make more sense if the was a debugfs entry with the sid's? This filter are a reminisce  of the same filter used not only to catch denials. Doing a string compare for all syscalls keep the cpu busy.  I will do an update without it.