From patchwork Fri Mar 3 01:10:29 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Richard Guy Briggs X-Patchwork-Id: 9601889 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 51C4E6048B for ; Fri, 3 Mar 2017 01:20:38 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 44349285E2 for ; Fri, 3 Mar 2017 01:20:38 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 38C61285F3; Fri, 3 Mar 2017 01:20:38 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C239D285EA for ; Fri, 3 Mar 2017 01:20:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751446AbdCCBUg (ORCPT ); Thu, 2 Mar 2017 20:20:36 -0500 Received: from mx1.redhat.com ([209.132.183.28]:44828 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751153AbdCCBUf (ORCPT ); Thu, 2 Mar 2017 20:20:35 -0500 Received: from int-mx13.intmail.prod.int.phx2.redhat.com (int-mx13.intmail.prod.int.phx2.redhat.com [10.5.11.26]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 4481C19D38F; Fri, 3 Mar 2017 01:10:57 +0000 (UTC) Received: from madcap2.tricolour.ca (ovpn-112-2.rdu2.redhat.com [10.10.112.2]) by int-mx13.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id v231Ar7n004881; Thu, 2 Mar 2017 20:10:54 -0500 From: Richard Guy Briggs To: linux-security-module@vger.kernel.org, linux-audit@redhat.com Cc: Richard Guy Briggs , Andy Lutomirski , "Serge E. Hallyn" , Kees Cook , James Morris , Eric Paris , Paul Moore , Steve Grubb Subject: [PATCH] capabilities: do not audit log BPRM_FCAPS on set*id Date: Thu, 2 Mar 2017 20:10:29 -0500 Message-Id: <515427654218b7ce22441f635115e93cf74d6302.1488491988.git.rgb@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.26 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.29]); Fri, 03 Mar 2017 01:10:57 +0000 (UTC) Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP The audit subsystem is adding a BPRM_FCAPS record when auditing setuid application execution (SYSCALL execve). This is not expected as it was supposed to be limited to when the file system actually had capabilities in an extended attribute. It lists all capabilities making the event really ugly to parse what is happening. The PATH record correctly records the setuid bit and owner. Suppress the BPRM_FCAPS record on set*id. See: https://github.com/linux-audit/audit-kernel/issues/16 Signed-off-by: Richard Guy Briggs --- security/commoncap.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) diff --git a/security/commoncap.c b/security/commoncap.c index 14540bd..8f6bedf 100644 --- a/security/commoncap.c +++ b/security/commoncap.c @@ -594,16 +594,17 @@ skip: /* * Audit candidate if current->cap_effective is set * - * We do not bother to audit if 3 things are true: + * We do not bother to audit if 4 things are true: * 1) cap_effective has all caps * 2) we are root * 3) root is supposed to have all caps (SECURE_NOROOT) + * 4) we are running a set*id binary * Since this is just a normal root execing a process. * * Number 1 above might fail if you don't have a full bset, but I think * that is interesting information to audit. */ - if (!cap_issubset(new->cap_effective, new->cap_ambient)) { + if (!is_setid && !cap_issubset(new->cap_effective, new->cap_ambient)) { if (!cap_issubset(CAP_FULL_SET, new->cap_effective) || !uid_eq(new->euid, root_uid) || !uid_eq(new->uid, root_uid) || issecure(SECURE_NOROOT)) {