Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <cover.1621363275.git.rgb@redhat.com> <d23fbb89186754487850367224b060e26f9b7181.1621363275.git.rgb@redhat.com>
In-Reply-To: <d23fbb89186754487850367224b060e26f9b7181.1621363275.git.rgb@redhat.com>
From:   Paul Moore <paul@paul-moore.com>
Date:   Mon, 4 Oct 2021 12:08:03 -0400
Message-ID: <CAHC9VhQdzdpwUZEKxeV6VuMJpmGJHf-kXtYP8WMKLBhfLXL9xg@mail.gmail.com>
Subject: Re: [PATCH v4 3/3] audit: add OPENAT2 record to list how
To:     Richard Guy Briggs <rgb@redhat.com>
Cc:     Linux-Audit Mailing List <linux-audit@redhat.com>,
        LKML <linux-kernel@vger.kernel.org>,
        Eric Paris <eparis@parisplace.org>,
        Steve Grubb <sgrubb@redhat.com>,
        Alexander Viro <viro@zeniv.linux.org.uk>,
        Eric Paris <eparis@redhat.com>, linux-fsdevel@vger.kernel.org,
        Aleksa Sarai <cyphar@cyphar.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Wed, May 19, 2021 at 4:02 PM Richard Guy Briggs <rgb@redhat.com> wrote:
>
> Since the openat2(2) syscall uses a struct open_how pointer to communicat=
e
> its parameters they are not usefully recorded by the audit SYSCALL record=
's
> four existing arguments.
>
> Add a new audit record type OPENAT2 that reports the parameters in its
> third argument, struct open_how with fields oflag, mode and resolve.
>
> The new record in the context of an event would look like:
> time->Wed Mar 17 16:28:53 2021
> type=3DPROCTITLE msg=3Daudit(1616012933.531:184): proctitle=3D73797363616=
C6C735F66696C652F6F70656E617432002F746D702F61756469742D7465737473756974652D=
737641440066696C652D6F70656E617432
> type=3DPATH msg=3Daudit(1616012933.531:184): item=3D1 name=3D"file-openat=
2" inode=3D29 dev=3D00:1f mode=3D0100600 ouid=3D0 ogid=3D0 rdev=3D00:00 obj=
=3Dunconfined_u:object_r:user_tmp_t:s0 nametype=3DCREATE cap_fp=3D0 cap_fi=
=3D0 cap_fe=3D0 cap_fver=3D0 cap_frootid=3D0
> type=3DPATH msg=3Daudit(1616012933.531:184): item=3D0 name=3D"/root/rgb/g=
it/audit-testsuite/tests" inode=3D25 dev=3D00:1f mode=3D040700 ouid=3D0 ogi=
d=3D0 rdev=3D00:00 obj=3Dunconfined_u:object_r:user_tmp_t:s0 nametype=3DPAR=
ENT cap_fp=3D0 cap_fi=3D0 cap_fe=3D0 cap_fver=3D0 cap_frootid=3D0
> type=3DCWD msg=3Daudit(1616012933.531:184): cwd=3D"/root/rgb/git/audit-te=
stsuite/tests"
> type=3DOPENAT2 msg=3Daudit(1616012933.531:184): oflag=3D0100302 mode=3D06=
00 resolve=3D0xa
> type=3DSYSCALL msg=3Daudit(1616012933.531:184): arch=3Dc000003e syscall=
=3D437 success=3Dyes exit=3D4 a0=3D3 a1=3D7ffe315f1c53 a2=3D7ffe315f1550 a3=
=3D18 items=3D2 ppid=3D528 pid=3D540 auid=3D0 uid=3D0 gid=3D0 euid=3D0 suid=
=3D0 fsuid=3D0 egid=3D0 sgid=3D0 fsgid=3D0 tty=3DttyS0 ses=3D1 comm=3D"open=
at2" exe=3D"/root/rgb/git/audit-testsuite/tests/syscalls_file/openat2" subj=
=3Dunconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=3D"testsuite-1=
616012933-bjAUcEPO"
>
> Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
> Link: https://lore.kernel.org/r/d23fbb89186754487850367224b060e26f9b7181.=
1621363275.git.rgb@redhat.com
> ---
>  fs/open.c                  |  2 ++
>  include/linux/audit.h      | 10 ++++++++++
>  include/uapi/linux/audit.h |  1 +
>  kernel/audit.h             |  2 ++
>  kernel/auditsc.c           | 18 +++++++++++++++++-
>  5 files changed, 32 insertions(+), 1 deletion(-)

...

> diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
> index cd2d8279a5e4..67aea2370c6d 100644
> --- a/include/uapi/linux/audit.h
> +++ b/include/uapi/linux/audit.h
> @@ -118,6 +118,7 @@
>  #define AUDIT_TIME_ADJNTPVAL   1333    /* NTP value adjustment */
>  #define AUDIT_BPF              1334    /* BPF subsystem */
>  #define AUDIT_EVENT_LISTENER   1335    /* Task joined multicast read soc=
ket */
> +#define AUDIT_OPENAT2          1336    /* Record showing openat2 how arg=
s */

As a heads-up, I had to change the AUDIT_OPENAT2 value to 1337 as the
1336 value is already in use by AUDIT_URINGOP.  It wasn't caught
during my initial build test as the LSM/audit io_uring patches are in
selinux/next and not audit/next, it wasn't until the kernel-secnext
build was merging everything for its test run that the collision
occurred.  I'll be updating the audit/next tree with the new value
shortly.

--=20
paul moore
www.paul-moore.com