| Message ID | 20220310234632.16194-28-casey@schaufler-ca.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | LSM: Module stacking for AppArmor | expand |
On Thu, Mar 10, 2022 at 7:01 PM Casey Schaufler <casey@schaufler-ca.com> wrote: > > Create a new audit record AUDIT_MAC_OBJ_CONTEXTS. > An example of the MAC_OBJ_CONTEXTS (1421) record is: > > type=MAC_OBJ_CONTEXTS[1421] > msg=audit(1601152467.009:1050): > obj_selinux=unconfined_u:object_r:user_home_t:s0 > > When an audit event includes a AUDIT_MAC_OBJ_CONTEXTS record > the "obj=" field in other records in the event will be "obj=?". > An AUDIT_MAC_OBJ_CONTEXTS record is supplied when the system has > multiple security modules that may make access decisions based > on an object security context. > > Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> > --- > include/linux/audit.h | 5 +++ > include/uapi/linux/audit.h | 1 + > kernel/audit.c | 47 +++++++++++++++++++++++ > kernel/auditsc.c | 79 ++++++++++++-------------------------- > 4 files changed, 77 insertions(+), 55 deletions(-) ... > diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h > index af0aaccfaf57..d25d76b29e3c 100644 > --- a/include/uapi/linux/audit.h > +++ b/include/uapi/linux/audit.h > @@ -144,6 +144,7 @@ > #define AUDIT_MAC_CALIPSO_ADD 1418 /* NetLabel: add CALIPSO DOI entry */ > #define AUDIT_MAC_CALIPSO_DEL 1419 /* NetLabel: del CALIPSO DOI entry */ > #define AUDIT_MAC_TASK_CONTEXTS 1420 /* Multiple LSM task contexts */ > +#define AUDIT_MAC_OBJ_CONTEXTS 1421 /* Multiple LSM objext contexts */ > > #define AUDIT_FIRST_KERN_ANOM_MSG 1700 > #define AUDIT_LAST_KERN_ANOM_MSG 1799 > diff --git a/kernel/audit.c b/kernel/audit.c > index ad825af203cf..ac92e7fc5aa6 100644 > --- a/kernel/audit.c > +++ b/kernel/audit.c > @@ -2202,6 +2202,53 @@ static void audit_buffer_aux_end(struct audit_buffer *ab) > ab->skb = skb_peek(&ab->skb_list); > } > > +void audit_log_object_context(struct audit_buffer *ab, struct lsmblob *blob) > +{ > + int i; > + int error; > + struct lsmcontext context; > + > + if (!lsm_multiple_contexts()) { > + error = security_secid_to_secctx(blob, &context, LSMBLOB_FIRST); > + if (error) { > + if (error != -EINVAL) > + goto error_path; > + return; > + } > + audit_log_format(ab, " obj=%s", context.context); > + security_release_secctx(&context); > + } else { > + audit_log_format(ab, " obj=?"); > + error = audit_buffer_aux_new(ab, AUDIT_MAC_OBJ_CONTEXTS); > + if (error) > + goto error_path; > + > + for (i = 0; i < LSMBLOB_ENTRIES; i++) { > + if (blob->secid[i] == 0) > + continue; > + error = security_secid_to_secctx(blob, &context, i); > + if (error) { > + if (error != -EINVAL) > + audit_panic("error in audit_log_object_context"); > + audit_log_format(ab, "%sobj_%s=?", > + i ? " " : "", > + lsm_slot_to_name(i)); > + } else { > + audit_log_format(ab, "%sobj_%s=%s", > + i ? " " : "", > + lsm_slot_to_name(i), > + context.context); > + security_release_secctx(&context); > + } > + } > + > + audit_buffer_aux_end(ab); > + } > + return; > + > +error_path: > + audit_panic("error in audit_log_object_context"); > +} The comment from patch 26/29 regarding the audit_panic() placement also applies to audit_log_object_context(). > diff --git a/kernel/auditsc.c b/kernel/auditsc.c > index 7848e7351cf9..923e4e3a5697 100644 > --- a/kernel/auditsc.c > +++ b/kernel/auditsc.c > @@ -1114,36 +1114,25 @@ static inline void audit_free_context(struct audit_context *context) > kfree(context); > } > > -static int audit_log_pid_context(struct audit_context *context, pid_t pid, > - kuid_t auid, kuid_t uid, > - unsigned int sessionid, > - struct lsmblob *blob, char *comm) > +static void audit_log_pid_context(struct audit_context *context, pid_t pid, > + kuid_t auid, kuid_t uid, > + unsigned int sessionid, > + struct lsmblob *blob, char *comm) > { > struct audit_buffer *ab; > - struct lsmcontext lsmctx; > - int rc = 0; > > ab = audit_log_start(context, GFP_KERNEL, AUDIT_OBJ_PID); > if (!ab) > - return rc; > + return; > > audit_log_format(ab, "opid=%d oauid=%d ouid=%d oses=%d", pid, > from_kuid(&init_user_ns, auid), > from_kuid(&init_user_ns, uid), sessionid); > - if (lsmblob_is_set(blob)) { > - if (security_secid_to_secctx(blob, &lsmctx, LSMBLOB_FIRST)) { > - audit_log_format(ab, " obj=(none)"); > - rc = 1; > - } else { > - audit_log_format(ab, " obj=%s", lsmctx.context); > - security_release_secctx(&lsmctx); > - } > - } > + if (lsmblob_is_set(blob)) > + audit_log_object_context(ab, blob); > audit_log_format(ab, " ocomm="); > audit_log_untrustedstring(ab, comm); > audit_log_end(ab); > - > - return rc; > } > > static void audit_log_execve_info(struct audit_context *context, > @@ -1373,18 +1362,10 @@ static void show_special(struct audit_context *context, int *call_panic) > from_kgid(&init_user_ns, context->ipc.gid), > context->ipc.mode); > if (osid) { > - struct lsmcontext lsmcxt; > struct lsmblob blob; > > lsmblob_init(&blob, osid); > - if (security_secid_to_secctx(&blob, &lsmcxt, > - LSMBLOB_FIRST)) { > - audit_log_format(ab, " osid=%u", osid); > - *call_panic = 1; > - } else { > - audit_log_format(ab, " obj=%s", lsmcxt.context); > - security_release_secctx(&lsmcxt); > - } > + audit_log_object_context(ab, &blob); While we lose the "osid=X" in case of failure, the secid/SID is a private kernel value meaning it was always of questionable value. -- paul-moore.com
On 3/15/2022 4:47 PM, Paul Moore wrote: > On Thu, Mar 10, 2022 at 7:01 PM Casey Schaufler <casey@schaufler-ca.com> wrote: >> Create a new audit record AUDIT_MAC_OBJ_CONTEXTS. >> An example of the MAC_OBJ_CONTEXTS (1421) record is: >> >> type=MAC_OBJ_CONTEXTS[1421] >> msg=audit(1601152467.009:1050): >> obj_selinux=unconfined_u:object_r:user_home_t:s0 >> >> When an audit event includes a AUDIT_MAC_OBJ_CONTEXTS record >> the "obj=" field in other records in the event will be "obj=?". >> An AUDIT_MAC_OBJ_CONTEXTS record is supplied when the system has >> multiple security modules that may make access decisions based >> on an object security context. >> >> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> >> --- >> include/linux/audit.h | 5 +++ >> include/uapi/linux/audit.h | 1 + >> kernel/audit.c | 47 +++++++++++++++++++++++ >> kernel/auditsc.c | 79 ++++++++++++-------------------------- >> 4 files changed, 77 insertions(+), 55 deletions(-) > ... > >> diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h >> index af0aaccfaf57..d25d76b29e3c 100644 >> --- a/include/uapi/linux/audit.h >> +++ b/include/uapi/linux/audit.h >> @@ -144,6 +144,7 @@ >> #define AUDIT_MAC_CALIPSO_ADD 1418 /* NetLabel: add CALIPSO DOI entry */ >> #define AUDIT_MAC_CALIPSO_DEL 1419 /* NetLabel: del CALIPSO DOI entry */ >> #define AUDIT_MAC_TASK_CONTEXTS 1420 /* Multiple LSM task contexts */ >> +#define AUDIT_MAC_OBJ_CONTEXTS 1421 /* Multiple LSM objext contexts */ >> >> #define AUDIT_FIRST_KERN_ANOM_MSG 1700 >> #define AUDIT_LAST_KERN_ANOM_MSG 1799 >> diff --git a/kernel/audit.c b/kernel/audit.c >> index ad825af203cf..ac92e7fc5aa6 100644 >> --- a/kernel/audit.c >> +++ b/kernel/audit.c >> @@ -2202,6 +2202,53 @@ static void audit_buffer_aux_end(struct audit_buffer *ab) >> ab->skb = skb_peek(&ab->skb_list); >> } >> >> +void audit_log_object_context(struct audit_buffer *ab, struct lsmblob *blob) >> +{ >> + int i; >> + int error; >> + struct lsmcontext context; >> + >> + if (!lsm_multiple_contexts()) { >> + error = security_secid_to_secctx(blob, &context, LSMBLOB_FIRST); >> + if (error) { >> + if (error != -EINVAL) >> + goto error_path; >> + return; >> + } >> + audit_log_format(ab, " obj=%s", context.context); >> + security_release_secctx(&context); >> + } else { >> + audit_log_format(ab, " obj=?"); >> + error = audit_buffer_aux_new(ab, AUDIT_MAC_OBJ_CONTEXTS); >> + if (error) >> + goto error_path; >> + >> + for (i = 0; i < LSMBLOB_ENTRIES; i++) { >> + if (blob->secid[i] == 0) >> + continue; >> + error = security_secid_to_secctx(blob, &context, i); >> + if (error) { >> + if (error != -EINVAL) >> + audit_panic("error in audit_log_object_context"); >> + audit_log_format(ab, "%sobj_%s=?", >> + i ? " " : "", >> + lsm_slot_to_name(i)); >> + } else { >> + audit_log_format(ab, "%sobj_%s=%s", >> + i ? " " : "", >> + lsm_slot_to_name(i), >> + context.context); >> + security_release_secctx(&context); >> + } >> + } >> + >> + audit_buffer_aux_end(ab); >> + } >> + return; >> + >> +error_path: >> + audit_panic("error in audit_log_object_context"); >> +} > The comment from patch 26/29 regarding the audit_panic() placement > also applies to audit_log_object_context(). > >> diff --git a/kernel/auditsc.c b/kernel/auditsc.c >> index 7848e7351cf9..923e4e3a5697 100644 >> --- a/kernel/auditsc.c >> +++ b/kernel/auditsc.c >> @@ -1114,36 +1114,25 @@ static inline void audit_free_context(struct audit_context *context) >> kfree(context); >> } >> >> -static int audit_log_pid_context(struct audit_context *context, pid_t pid, >> - kuid_t auid, kuid_t uid, >> - unsigned int sessionid, >> - struct lsmblob *blob, char *comm) >> +static void audit_log_pid_context(struct audit_context *context, pid_t pid, >> + kuid_t auid, kuid_t uid, >> + unsigned int sessionid, >> + struct lsmblob *blob, char *comm) >> { >> struct audit_buffer *ab; >> - struct lsmcontext lsmctx; >> - int rc = 0; >> >> ab = audit_log_start(context, GFP_KERNEL, AUDIT_OBJ_PID); >> if (!ab) >> - return rc; >> + return; >> >> audit_log_format(ab, "opid=%d oauid=%d ouid=%d oses=%d", pid, >> from_kuid(&init_user_ns, auid), >> from_kuid(&init_user_ns, uid), sessionid); >> - if (lsmblob_is_set(blob)) { >> - if (security_secid_to_secctx(blob, &lsmctx, LSMBLOB_FIRST)) { >> - audit_log_format(ab, " obj=(none)"); >> - rc = 1; >> - } else { >> - audit_log_format(ab, " obj=%s", lsmctx.context); >> - security_release_secctx(&lsmctx); >> - } >> - } >> + if (lsmblob_is_set(blob)) >> + audit_log_object_context(ab, blob); >> audit_log_format(ab, " ocomm="); >> audit_log_untrustedstring(ab, comm); >> audit_log_end(ab); >> - >> - return rc; >> } >> >> static void audit_log_execve_info(struct audit_context *context, >> @@ -1373,18 +1362,10 @@ static void show_special(struct audit_context *context, int *call_panic) >> from_kgid(&init_user_ns, context->ipc.gid), >> context->ipc.mode); >> if (osid) { >> - struct lsmcontext lsmcxt; >> struct lsmblob blob; >> >> lsmblob_init(&blob, osid); >> - if (security_secid_to_secctx(&blob, &lsmcxt, >> - LSMBLOB_FIRST)) { >> - audit_log_format(ab, " osid=%u", osid); >> - *call_panic = 1; >> - } else { >> - audit_log_format(ab, " obj=%s", lsmcxt.context); >> - security_release_secctx(&lsmcxt); >> - } >> + audit_log_object_context(ab, &blob); > While we lose the "osid=X" in case of failure, the secid/SID is a > private kernel value meaning it was always of questionable value. I could come up with a change to audit_log_object_context() that would put out an osid= in the single security module case. I would prefer not to if that would be acceptable. > > > -- > paul-moore.com
On Tue, Mar 15, 2022 at 8:23 PM Casey Schaufler <casey@schaufler-ca.com> wrote: > On 3/15/2022 4:47 PM, Paul Moore wrote: > > On Thu, Mar 10, 2022 at 7:01 PM Casey Schaufler <casey@schaufler-ca.com> wrote: > >> Create a new audit record AUDIT_MAC_OBJ_CONTEXTS. > >> An example of the MAC_OBJ_CONTEXTS (1421) record is: > >> > >> type=MAC_OBJ_CONTEXTS[1421] > >> msg=audit(1601152467.009:1050): > >> obj_selinux=unconfined_u:object_r:user_home_t:s0 > >> > >> When an audit event includes a AUDIT_MAC_OBJ_CONTEXTS record > >> the "obj=" field in other records in the event will be "obj=?". > >> An AUDIT_MAC_OBJ_CONTEXTS record is supplied when the system has > >> multiple security modules that may make access decisions based > >> on an object security context. > >> > >> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> > >> --- > >> include/linux/audit.h | 5 +++ > >> include/uapi/linux/audit.h | 1 + > >> kernel/audit.c | 47 +++++++++++++++++++++++ > >> kernel/auditsc.c | 79 ++++++++++++-------------------------- > >> 4 files changed, 77 insertions(+), 55 deletions(-) ... > >> @@ -1373,18 +1362,10 @@ static void show_special(struct audit_context *context, int *call_panic) > >> from_kgid(&init_user_ns, context->ipc.gid), > >> context->ipc.mode); > >> if (osid) { > >> - struct lsmcontext lsmcxt; > >> struct lsmblob blob; > >> > >> lsmblob_init(&blob, osid); > >> - if (security_secid_to_secctx(&blob, &lsmcxt, > >> - LSMBLOB_FIRST)) { > >> - audit_log_format(ab, " osid=%u", osid); > >> - *call_panic = 1; > >> - } else { > >> - audit_log_format(ab, " obj=%s", lsmcxt.context); > >> - security_release_secctx(&lsmcxt); > >> - } > >> + audit_log_object_context(ab, &blob); > > While we lose the "osid=X" in case of failure, the secid/SID is a > > private kernel value meaning it was always of questionable value. > > I could come up with a change to audit_log_object_context() that > would put out an osid= in the single security module case. I would > prefer not to if that would be acceptable. What I think you have right now is fine. I thought others might point out the field differences so I was trying to say that the existing code really isn't very useful in case of error, there is no practical way for someone in userspace to do anything meaningful with an osid/secid/SID value as they are transient kernel-private values. My apologies for the confusion.
diff --git a/include/linux/audit.h b/include/linux/audit.h index 14849d5f84b4..1b05eb2dbe77 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -191,6 +191,8 @@ extern void audit_log_path_denied(int type, const char *operation); extern void audit_log_lost(const char *message); +extern void audit_log_object_context(struct audit_buffer *ab, + struct lsmblob *blob); extern int audit_log_task_context(struct audit_buffer *ab); extern void audit_log_task_info(struct audit_buffer *ab); @@ -251,6 +253,9 @@ static inline void audit_log_key(struct audit_buffer *ab, char *key) { } static inline void audit_log_path_denied(int type, const char *operation) { } +static inline void audit_log_object_context(struct audit_buffer *ab, + struct lsmblob *blob) +{ } static inline int audit_log_task_context(struct audit_buffer *ab) { return 0; diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h index af0aaccfaf57..d25d76b29e3c 100644 --- a/include/uapi/linux/audit.h +++ b/include/uapi/linux/audit.h @@ -144,6 +144,7 @@ #define AUDIT_MAC_CALIPSO_ADD 1418 /* NetLabel: add CALIPSO DOI entry */ #define AUDIT_MAC_CALIPSO_DEL 1419 /* NetLabel: del CALIPSO DOI entry */ #define AUDIT_MAC_TASK_CONTEXTS 1420 /* Multiple LSM task contexts */ +#define AUDIT_MAC_OBJ_CONTEXTS 1421 /* Multiple LSM objext contexts */ #define AUDIT_FIRST_KERN_ANOM_MSG 1700 #define AUDIT_LAST_KERN_ANOM_MSG 1799 diff --git a/kernel/audit.c b/kernel/audit.c index ad825af203cf..ac92e7fc5aa6 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -2202,6 +2202,53 @@ static void audit_buffer_aux_end(struct audit_buffer *ab) ab->skb = skb_peek(&ab->skb_list); } +void audit_log_object_context(struct audit_buffer *ab, struct lsmblob *blob) +{ + int i; + int error; + struct lsmcontext context; + + if (!lsm_multiple_contexts()) { + error = security_secid_to_secctx(blob, &context, LSMBLOB_FIRST); + if (error) { + if (error != -EINVAL) + goto error_path; + return; + } + audit_log_format(ab, " obj=%s", context.context); + security_release_secctx(&context); + } else { + audit_log_format(ab, " obj=?"); + error = audit_buffer_aux_new(ab, AUDIT_MAC_OBJ_CONTEXTS); + if (error) + goto error_path; + + for (i = 0; i < LSMBLOB_ENTRIES; i++) { + if (blob->secid[i] == 0) + continue; + error = security_secid_to_secctx(blob, &context, i); + if (error) { + if (error != -EINVAL) + audit_panic("error in audit_log_object_context"); + audit_log_format(ab, "%sobj_%s=?", + i ? " " : "", + lsm_slot_to_name(i)); + } else { + audit_log_format(ab, "%sobj_%s=%s", + i ? " " : "", + lsm_slot_to_name(i), + context.context); + security_release_secctx(&context); + } + } + + audit_buffer_aux_end(ab); + } + return; + +error_path: + audit_panic("error in audit_log_object_context"); +} int audit_log_task_context(struct audit_buffer *ab) { diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 7848e7351cf9..923e4e3a5697 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1114,36 +1114,25 @@ static inline void audit_free_context(struct audit_context *context) kfree(context); } -static int audit_log_pid_context(struct audit_context *context, pid_t pid, - kuid_t auid, kuid_t uid, - unsigned int sessionid, - struct lsmblob *blob, char *comm) +static void audit_log_pid_context(struct audit_context *context, pid_t pid, + kuid_t auid, kuid_t uid, + unsigned int sessionid, + struct lsmblob *blob, char *comm) { struct audit_buffer *ab; - struct lsmcontext lsmctx; - int rc = 0; ab = audit_log_start(context, GFP_KERNEL, AUDIT_OBJ_PID); if (!ab) - return rc; + return; audit_log_format(ab, "opid=%d oauid=%d ouid=%d oses=%d", pid, from_kuid(&init_user_ns, auid), from_kuid(&init_user_ns, uid), sessionid); - if (lsmblob_is_set(blob)) { - if (security_secid_to_secctx(blob, &lsmctx, LSMBLOB_FIRST)) { - audit_log_format(ab, " obj=(none)"); - rc = 1; - } else { - audit_log_format(ab, " obj=%s", lsmctx.context); - security_release_secctx(&lsmctx); - } - } + if (lsmblob_is_set(blob)) + audit_log_object_context(ab, blob); audit_log_format(ab, " ocomm="); audit_log_untrustedstring(ab, comm); audit_log_end(ab); - - return rc; } static void audit_log_execve_info(struct audit_context *context, @@ -1373,18 +1362,10 @@ static void show_special(struct audit_context *context, int *call_panic) from_kgid(&init_user_ns, context->ipc.gid), context->ipc.mode); if (osid) { - struct lsmcontext lsmcxt; struct lsmblob blob; lsmblob_init(&blob, osid); - if (security_secid_to_secctx(&blob, &lsmcxt, - LSMBLOB_FIRST)) { - audit_log_format(ab, " osid=%u", osid); - *call_panic = 1; - } else { - audit_log_format(ab, " obj=%s", lsmcxt.context); - security_release_secctx(&lsmcxt); - } + audit_log_object_context(ab, &blob); } if (context->ipc.has_perm) { audit_log_end(ab); @@ -1536,19 +1517,8 @@ static void audit_log_name(struct audit_context *context, struct audit_names *n, from_kgid(&init_user_ns, n->gid), MAJOR(n->rdev), MINOR(n->rdev)); - if (lsmblob_is_set(&n->lsmblob)) { - struct lsmcontext lsmctx; - - if (security_secid_to_secctx(&n->lsmblob, &lsmctx, - LSMBLOB_FIRST)) { - audit_log_format(ab, " osid=?"); - if (call_panic) - *call_panic = 2; - } else { - audit_log_format(ab, " obj=%s", lsmctx.context); - security_release_secctx(&lsmctx); - } - } + if (lsmblob_is_set(&n->lsmblob)) + audit_log_object_context(ab, &n->lsmblob); /* log the audit_names record type */ switch (n->type) { @@ -1753,21 +1723,20 @@ static void audit_log_exit(void) struct audit_aux_data_pids *axs = (void *)aux; for (i = 0; i < axs->pid_count; i++) - if (audit_log_pid_context(context, axs->target_pid[i], - axs->target_auid[i], - axs->target_uid[i], - axs->target_sessionid[i], - &axs->target_lsm[i], - axs->target_comm[i])) - call_panic = 1; - } - - if (context->target_pid && - audit_log_pid_context(context, context->target_pid, - context->target_auid, context->target_uid, - context->target_sessionid, - &context->target_lsm, context->target_comm)) - call_panic = 1; + audit_log_pid_context(context, axs->target_pid[i], + axs->target_auid[i], + axs->target_uid[i], + axs->target_sessionid[i], + &axs->target_lsm[i], + axs->target_comm[i]); + } + + if (context->target_pid) + audit_log_pid_context(context, context->target_pid, + context->target_auid, context->target_uid, + context->target_sessionid, + &context->target_lsm, + context->target_comm); if (context->pwd.dentry && context->pwd.mnt) { ab = audit_log_start(context, GFP_KERNEL, AUDIT_CWD);
Create a new audit record AUDIT_MAC_OBJ_CONTEXTS. An example of the MAC_OBJ_CONTEXTS (1421) record is: type=MAC_OBJ_CONTEXTS[1421] msg=audit(1601152467.009:1050): obj_selinux=unconfined_u:object_r:user_home_t:s0 When an audit event includes a AUDIT_MAC_OBJ_CONTEXTS record the "obj=" field in other records in the event will be "obj=?". An AUDIT_MAC_OBJ_CONTEXTS record is supplied when the system has multiple security modules that may make access decisions based on an object security context. Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> --- include/linux/audit.h | 5 +++ include/uapi/linux/audit.h | 1 + kernel/audit.c | 47 +++++++++++++++++++++++ kernel/auditsc.c | 79 ++++++++++++-------------------------- 4 files changed, 77 insertions(+), 55 deletions(-)