Received: by 10.223.164.221 with SMTP id h29csp1245736wrb; Wed, 11 Oct 2017 18:37:45 -0700 (PDT) X-Google-Smtp-Source: AOwi7QAWNBjYFhN7qPCpgPkn/kcQyhRgcY8zaeAesxg5aNYtUoQGLfNXNCfpisAY9mVdK8r4yNcr X-Received: by 10.159.216.146 with SMTP id s18mr715611plp.451.1507772265666; Wed, 11 Oct 2017 18:37:45 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1507772265; cv=none; d=google.com; s=arc-20160816; b=EbyFIrWtBKd+/8kYmEgtnbcvTtlpYJkJ4bl3cBKcY6mJLRnOt9JhkNXOypR2FeHHSI 5JcpR/O9+JhFPpt96/KN3c7HL4T/Kz5yDghuZGO7xQDq8d1yeIXCGaqcALV0nOswAV2M IZG1j19gPTr+1MhAIOitkop33690FQjXbWuLz2gDVAkeqrBK9SaI3REfdGNdSmXaP1AD byTKDyaBvfEpt+IyjCExRhd6158b8NzdNailSlFNap0XlNYxVUqK9QezVhumS1lQNRpB Wl6/oCTrAySok1pJcnviXMd4gtYYU+wvti+ZDdmAy4QoHRUc74eOUuIEsDW4lHn/T84Y LR9Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:user-agent:in-reply-to :content-disposition:mime-version:references:message-id:subject:cc :to:from:date:dmarc-filter:arc-authentication-results; bh=+qknq2Ci27nyTSrh9Dm3fbJyirgI1Ctt7OdFqicO5ZI=; b=gFOXq9kD1a+IROzW0oWax9nt80F3a8HLnN69JddO4ivT4aKik63AgHq1HsyPdgL0wr 3ZbLwjWgYJlxhAE4g/I16J+Yua6knTjiLR+/26cIYRtpxZH6h8An5QxWw79PR1duQdN0 2YRHPoIgb65kE9f+5+jH6yDa1B6rqMXVBWBVj8iWLAvcurhlb60PIqbyoaCViCdNLNBs mihStu7C88udFpL8vf+XzmKdIdctYnd2DATlffXBWrXEKmsAKCJTcX6Cm0gFC2Qh1rCt wIw/YQDs5WzI9ghGQ5SYiT9WCXjbE6TdHjv0j3YvQCOOe3na1hAbC0hc4ZvYIkcJS+O/ dUvA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=redhat.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id l30si709811plg.259.2017.10.11.18.37.21; Wed, 11 Oct 2017 18:37:45 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752815AbdJLBgv (ORCPT + 99 others); Wed, 11 Oct 2017 21:36:51 -0400 Received: from mx1.redhat.com ([209.132.183.28]:34754 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751757AbdJLBgs (ORCPT ); Wed, 11 Oct 2017 21:36:48 -0400 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 0876680C19; Thu, 12 Oct 2017 01:36:48 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 0876680C19 Authentication-Results: ext-mx02.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx02.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=rgb@redhat.com Received: from madcap2.tricolour.ca (ovpn-112-68.rdu2.redhat.com [10.10.112.68]) by smtp.corp.redhat.com (Postfix) with ESMTPS id E640878375; Thu, 12 Oct 2017 01:36:40 +0000 (UTC) Date: Wed, 11 Oct 2017 21:36:22 -0400 From: Richard Guy Briggs To: Paul Moore Cc: linux-kernel@vger.kernel.org, linux-audit@redhat.com, Steven Rostedt Subject: Re: [PATCH ALT4 V3 1/2] audit: show fstype:pathname for entries with anonymous parents Message-ID: <20171012013622.l2gosm3e4sjm52rp@madcap2.tricolour.ca> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: NeoMutt/20170914 (1.9.0) X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.26]); Thu, 12 Oct 2017 01:36:48 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 2017-09-20 16:52, Paul Moore wrote: > On Wed, Aug 23, 2017 at 7:03 AM, Richard Guy Briggs wrote: > > Tracefs or debugfs were causing hundreds to thousands of null PATH > > records to be associated with the init_module and finit_module SYSCALL > > records on a few modules when the following rule was in place for > > startup: > > -a always,exit -F arch=x86_64 -S init_module -F key=mod-load > > > > This happens because the parent inode is not found in the task's > > audit_names list and hence treats it as anonymous. This gives us no > > information other than a numerical device number that may no longer be > > visible upon log inspeciton, and an inode number. > > > > Fill in the filesystem type, filesystem magic number and full pathname > > from the filesystem mount point on previously null PATH records from > > entries that have an anonymous parent from the child dentry using > > dentry_path_raw(). > > > > Make the dentry argument of __audit_inode_child() non-const so that we > > can take a reference to it in the case of an anonymous parent with > > dget() and dget_parent() to be able to later print a partial path from > > the host filesystem rather than null. > > > > Since all we are given is an inode of the parent and the dentry of the > > child, finding the path from the mount point to the root of the > > filesystem is more challenging that would involve searching all > > vfsmounts from "/" until a matching dentry is found for that > > filesystem's root dentry. Even if one is found, there may be more than > > one mount point. At this point the gain seems marginal since > > knowing the filesystem type and path are a significant help in tracking > > down the source of the PATH records and being to address them. > > > > Sample output: > > type=PROCTITLE msg=audit(1488317694.446:143): proctitle=2F7362696E2F6D6F6470726F6265002D71002D2D006E66737634 > > type=PATH msg=audit(1488317694.446:143): item=797 name=tracefs(74726163):/events/nfs4/nfs4_setclientid/format inode=15969 dev=00:09 mode=0100444 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tracefs_t:s0 nametype=CREATE > > type=PATH msg=audit(1488317694.446:143): item=796 name=tracefs(74726163):/events/nfs4/nfs4_setclientid inode=15964 dev=00:09 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tracefs_t:s0 nametype=PARENT > > ... > > type=PATH msg=audit(1488317694.446:143): item=1 name=tracefs(74726163):/events/nfs4 inode=15571 dev=00:09 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tracefs_t:s0 nametype=CREATE > > type=PATH msg=audit(1488317694.446:143): item=0 name=tracefs(74726163):/events inode=119 dev=00:09 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tracefs_t:s0 nametype=PARENT > > type=UNKNOWN[1330] msg=audit(1488317694.446:143): name="nfsv4" > > type=SYSCALL msg=audit(1488317694.446:143): arch=c000003e syscall=313 success=yes exit=0 a0=1 a1=55d5a35ce106 a2=0 a3=1 items=798 ppid=6 pid=528 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="modprobe" exe="/usr/bin/kmod" subj=system_u:system_r:insmod_t:s0 key="mod-load" > > > > See: https://github.com/linux-audit/audit-kernel/issues/8 > > Test case: https://github.com/linux-audit/audit-testsuite/issues/42 > > > > Signed-off-by: Richard Guy Briggs > > > > --- > > v3: > > fix audit_buffer leak and dname error allocation leak audit_log_name > > only put audit_name->dentry if it is being replaced > > > > v2: > > minor cosmetic changes and support fs filter patch > > --- > > include/linux/audit.h | 8 ++++---- > > kernel/audit.c | 19 +++++++++++++++++++ > > kernel/audit.h | 1 + > > kernel/auditsc.c | 8 +++++++- > > 4 files changed, 31 insertions(+), 5 deletions(-) > > ... > > > diff --git a/kernel/audit.c b/kernel/audit.c > > index 59e60e0..d6e6e4e 100644 > > --- a/kernel/audit.c > > +++ b/kernel/audit.c > > @@ -72,6 +72,7 @@ > > #include > > #include > > #include > > +#include > > > > #include "audit.h" > > > > @@ -2047,6 +2048,10 @@ void audit_copy_inode(struct audit_names *name, const struct dentry *dentry, > > name->gid = inode->i_gid; > > name->rdev = inode->i_rdev; > > security_inode_getsecid(inode, &name->osid); > > + if (name->dentry) { > > + dput(name->dentry); > > + name->dentry = NULL; > > + } > > audit_copy_fcaps(name, dentry); > > } > > > > @@ -2088,6 +2093,20 @@ void audit_log_name(struct audit_context *context, struct audit_names *n, > > audit_log_n_untrustedstring(ab, n->name->name, > > n->name_len); > > } > > + } else if (n->dentry) { > > + char *fullpath; > > + const char *fullpathp = NULL; > > + > > + fullpath = kmalloc(PATH_MAX, GFP_KERNEL); > > + if (fullpath) > > + fullpathp = dentry_path_raw(n->dentry, fullpath, PATH_MAX); > > + if (IS_ERR(fullpathp)) { > > + fullpathp = NULL; > > + kfree(fullpath); > > + } > > + audit_log_format(ab, " name=%s(0x%lx):%s", > > + n->dentry->d_sb->s_type->name ?: "?", > > + n->dentry->d_sb->s_magic, fullpathp ?: "?"); > > } else > > audit_log_format(ab, " name=(null)"); > > While looking this over one more time before merging I realized that > you are missing the curly braces in the "if (fullpath)" if-statement > above. This is an easy fix, and appears to be the Right Thing, so I'm > just going to fix up the patch while merging; take a look at the > result in the audit/next tree and if you have any objections let me > know so I can back it out. > > I'm also only merging this patch right now, patch 2/2 needs to wait > until the corresponding userspace is ready so we can test/verify it. The tests have been brought up to date. The first test patch (syscall_module_path) tests kernel patch 1/2 that adds names for the NULL paths. The second test patch (syscall_module_path_filter) tests kernel patch 2/2 and the correpsonding userspace patch to set the filesystem PATH filters. See https://github.com/linux-audit/audit-testsuite/pull/42 > paul moore - RGB -- Richard Guy Briggs Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635 From 1579161650400860548@xxx Thu Sep 21 14:58:27 +0000 2017 X-GM-THRID: 1576519731154696149 X-Gmail-Labels: Inbox,Category Forums