Skip to content

Commit

Permalink
audit: trigger accompanying records when no rules present
Browse files Browse the repository at this point in the history 
When there are no audit rules registered, mandatory records (config,
etc.) are missing their accompanying records (syscall, proctitle, etc.).

This is due to audit context dummy set on syscall entry based on absence
of rules that signals that no other records are to be printed.  Clear the dummy
bit if any record is generated, open coding this in audit_log_start().

The proctitle context and dummy checks are pointless since the
proctitle record will not be printed if no syscall records are printed.

The fds array is reset to -1 after the first syscall to indicate it
isn't valid any more, but was never set to -1 when the context was
allocated to indicate it wasn't yet valid.

Check ctx->pwd in audit_log_name().

The audit_inode* functions can be called without going through
getname_flags() or getname_kernel() that sets audit_names and cwd, so
set the cwd in audit_alloc_name() if it has not already been done so due to
audit_names being valid and purge all other audit_getcwd() calls.

Revert the LSM dump_common_audit_data() LSM_AUDIT_DATA_* cases from the
ghak96 patch since they are no longer necessary due to cwd coverage in
audit_alloc_name().

Thanks to bauen1 <[email protected]> for reporting LSM situations in
which context->cwd is not valid, inadvertantly fixed by the ghak96 patch.

Please see upstream github issue
linux-audit/audit-kernel#120
This is also related to upstream github issue
linux-audit/audit-kernel#96

Signed-off-by: Richard Guy Briggs <[email protected]>
Signed-off-by: Paul Moore <[email protected]>
  • Loading branch information
@rgbriggs @pcmoore
rgbriggs authored and pcmoore committed Oct 28, 2020
1 parent cbb5262 commit 6d91547
Show file tree
Hide file tree
Showing 4 changed files with 10 additions and 33 deletions.
8 changes: 0 additions & 8 deletions include/linux/audit.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -292,7 +292,6 @@ extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1,
extern void __audit_syscall_exit(int ret_success, long ret_value);
extern struct filename *__audit_reusename(const __user char *uptr);
extern void __audit_getname(struct filename *name);
extern void __audit_getcwd(void);
extern void __audit_inode(struct filename *name, const struct dentry *dentry,
unsigned int flags);
extern void __audit_file(const struct file *);
Expand Down Expand Up @@ -351,11 +350,6 @@ static inline void audit_getname(struct filename *name)
if (unlikely(!audit_dummy_context()))
__audit_getname(name);
}
static inline void audit_getcwd(void)
{
if (unlikely(audit_context()))
__audit_getcwd();
}
static inline void audit_inode(struct filename *name,
const struct dentry *dentry,
unsigned int aflags) {
Expand Down Expand Up @@ -584,8 +578,6 @@ static inline struct filename *audit_reusename(const __user char *name)
}
static inline void audit_getname(struct filename *name)
{ }
static inline void audit_getcwd(void)
{ }
static inline void audit_inode(struct filename *name,
const struct dentry *dentry,
unsigned int aflags)
Expand Down
3 changes: 3 additions & 0 deletions kernel/audit.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1865,6 +1865,9 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
}

audit_get_stamp(ab->ctx, &t, &serial);
/* cancel dummy context to enable supporting records */
if (ctx)
ctx->dummy = 0;
audit_log_format(ab, "audit(%llu.%03lu:%u): ",
(unsigned long long)t.tv_sec, t.tv_nsec/1000000, serial);

Expand Down
27 changes: 7 additions & 20 deletions kernel/auditsc.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -929,6 +929,7 @@ static inline struct audit_context *audit_alloc_context(enum audit_state state)
context->prio = state == AUDIT_RECORD_CONTEXT ? ~0ULL : 0;
INIT_LIST_HEAD(&context->killed_trees);
INIT_LIST_HEAD(&context->names_list);
context->fds[0] = -1;
return context;
}

Expand Down Expand Up @@ -1367,7 +1368,10 @@ static void audit_log_name(struct audit_context *context, struct audit_names *n,
/* name was specified as a relative path and the
* directory component is the cwd
*/
audit_log_d_path(ab, " name=", &context->pwd);
if (context->pwd.dentry && context->pwd.mnt)
audit_log_d_path(ab, " name=", &context->pwd);
else
audit_log_format(ab, " name=(null)");
break;
default:
/* log the name's directory component */
Expand Down Expand Up @@ -1435,9 +1439,6 @@ static void audit_log_proctitle(void)
struct audit_context *context = audit_context();
struct audit_buffer *ab;

if (!context || context->dummy)
return;

ab = audit_log_start(context, GFP_KERNEL, AUDIT_PROCTITLE);
if (!ab)
return; /* audit_panic or being filtered */
Expand Down Expand Up @@ -1866,6 +1867,8 @@ static struct audit_names *audit_alloc_name(struct audit_context *context,
list_add_tail(&aname->list, &context->names_list);

context->name_count++;
if (!context->pwd.dentry)
get_fs_pwd(current->fs, &context->pwd);
return aname;
}

Expand Down Expand Up @@ -1894,20 +1897,6 @@ __audit_reusename(const __user char *uptr)
return NULL;
}

inline void _audit_getcwd(struct audit_context *context)
{
if (!context->pwd.dentry)
get_fs_pwd(current->fs, &context->pwd);
}

void __audit_getcwd(void)
{
struct audit_context *context = audit_context();

if (context->in_syscall)
_audit_getcwd(context);
}

/**
* __audit_getname - add a name to the list
* @name: name to add
Expand All @@ -1931,8 +1920,6 @@ void __audit_getname(struct filename *name)
n->name_len = AUDIT_NAME_FULL;
name->aname = n;
name->refcnt++;

_audit_getcwd(context);
}

static inline int audit_copy_fcaps(struct audit_names *name,
Expand Down
5 changes: 0 additions & 5 deletions security/lsm_audit.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -241,7 +241,6 @@ static void dump_common_audit_data(struct audit_buffer *ab,
audit_log_untrustedstring(ab, inode->i_sb->s_id);
audit_log_format(ab, " ino=%lu", inode->i_ino);
}
audit_getcwd();
break;
}
case LSM_AUDIT_DATA_FILE: {
Expand All @@ -255,7 +254,6 @@ static void dump_common_audit_data(struct audit_buffer *ab,
audit_log_untrustedstring(ab, inode->i_sb->s_id);
audit_log_format(ab, " ino=%lu", inode->i_ino);
}
audit_getcwd();
break;
}
case LSM_AUDIT_DATA_IOCTL_OP: {
Expand All @@ -271,7 +269,6 @@ static void dump_common_audit_data(struct audit_buffer *ab,
}

audit_log_format(ab, " ioctlcmd=0x%hx", a->u.op->cmd);
audit_getcwd();
break;
}
case LSM_AUDIT_DATA_DENTRY: {
Expand All @@ -286,7 +283,6 @@ static void dump_common_audit_data(struct audit_buffer *ab,
audit_log_untrustedstring(ab, inode->i_sb->s_id);
audit_log_format(ab, " ino=%lu", inode->i_ino);
}
audit_getcwd();
break;
}
case LSM_AUDIT_DATA_INODE: {
Expand All @@ -304,7 +300,6 @@ static void dump_common_audit_data(struct audit_buffer *ab,
audit_log_format(ab, " dev=");
audit_log_untrustedstring(ab, inode->i_sb->s_id);
audit_log_format(ab, " ino=%lu", inode->i_ino);
audit_getcwd();
break;
}
case LSM_AUDIT_DATA_TASK: {
Expand Down

0 comments on commit 6d91547

Please sign in to comment.