Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <20210509183319.20298-1-michael.weiss@aisec.fraunhofer.de>
In-Reply-To: <20210509183319.20298-1-michael.weiss@aisec.fraunhofer.de>
From:   Paul Moore <paul@paul-moore.com>
Date:   Mon, 10 May 2021 18:48:16 -0400
Message-ID: <CAHC9VhRkh3uySjZ1qg07Fgky+R3jSmfJ80BLCFOK+LCPvZVrOA@mail.gmail.com>
Subject: Re: [PATCH] audit: allow logging of user events in non-initial namespace.
To:     =?UTF-8?Q?Michael_Wei=C3=9F?= <michael.weiss@aisec.fraunhofer.de>
Cc:     Richard Guy Briggs <rgb@redhat.com>,
        Eric Paris <eparis@redhat.com>, linux-audit@redhat.com,
        linux-kernel@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Sun, May 9, 2021 at 2:33 PM Michael Wei=C3=9F
<michael.weiss@aisec.fraunhofer.de> wrote:
>
> Audit subsystem was disabled in total for user namespaces other than
> the initial namespace.
>
> If audit is enabled by kernel command line or audtid in initial namespace=
,
> it is now possible to allow at least logging of userspace applications
> inside of non-initial namespaces if CAP_AUDIT_WRITE in the corresponding
> namespace is held.
>
> This allows logging of, e.g., PAM or opensshd inside user namespaced
> system containers.
>
> Signed-off-by: Michael Wei=C3=9F <michael.weiss@aisec.fraunhofer.de>
> ---
>  kernel/audit.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)

I think this needs to wait on the audit container ID patchset to land.

> diff --git a/kernel/audit.c b/kernel/audit.c
> index 121d37e700a6..b5cc0669c3d7 100644
> --- a/kernel/audit.c
> +++ b/kernel/audit.c
> @@ -1012,7 +1012,13 @@ static int audit_netlink_ok(struct sk_buff *skb, u=
16 msg_type)
>          * userspace will reject all logins.  This should be removed when=
 we
>          * support non init namespaces!!
>          */
> -       if (current_user_ns() !=3D &init_user_ns)
> +       /*
> +        * If audit is enabled by kernel command line or audtid in the in=
itial
> +        * namespace allow at least logging of userspace applications ins=
ide of
> +        * non-initial namespaces according to CAP_AUDIT_WRITE is held in=
 the
> +        * corresponding namespace.
> +        */
> +       if ((current_user_ns() !=3D &init_user_ns) && !audit_enabled)
>                 return -ECONNREFUSED;
>
>         switch (msg_type) {
> @@ -1043,7 +1049,7 @@ static int audit_netlink_ok(struct sk_buff *skb, u1=
6 msg_type)
>         case AUDIT_USER:
>         case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
>         case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
> -               if (!netlink_capable(skb, CAP_AUDIT_WRITE))
> +               if (!netlink_ns_capable(skb, current_user_ns(), CAP_AUDIT=
_WRITE))
>                         err =3D -EPERM;
>                 break;
>         default:  /* bad msg */
> --
> 2.20.1

--=20
paul moore
www.paul-moore.com