From: Steve Grubb <sgrubb@redhat.com> To: Richard Guy Briggs <rgb@redhat.com> Cc: linux-kernel@vger.kernel.org, linux-audit@redhat.com, Eric Paris <eparis@redhat.com>, Paul Moore <pmoore@redhat.com>, Rusty Russell <rusty@rustcorp.com.au> Subject: Re: [RFC] [PATCH] audit: log module name on init_module Date: Mon, 30 Jan 2017 11:54:03 +0100 [thread overview] Message-ID: <20170130115403.2c5c90f0@ivy-bridge> (raw) In-Reply-To: <2daec184298ee74022846c40791cbb13d39fd564.1485459246.git.rgb@redhat.com> On Thu, 26 Jan 2017 14:50:07 -0500 Richard Guy Briggs <rgb@redhat.com> wrote: > This adds a new auxiliary record MODULE_INIT to the SYSCALL event. Thanks, this is definitely needed. Can you provide an example event generated by this? -Steve > We get finit_module for free since it made most sense to hook this in > to load_module(). > > https://github.com/linux-audit/audit-kernel/issues/7 > https://github.com/linux-audit/audit-kernel/wiki/RFE-Module-load-record-format > > Signed-off-by: Richard Guy Briggs <rgb@redhat.com> > --- > include/linux/audit.h | 12 ++++++++++++ > include/uapi/linux/audit.h | 1 + > kernel/audit.h | 3 +++ > kernel/auditsc.c | 20 ++++++++++++++++++++ > kernel/module.c | 5 ++++- > 5 files changed, 40 insertions(+), 1 deletions(-) > > diff --git a/include/linux/audit.h b/include/linux/audit.h > index 476bc12..6222042 100644 > --- a/include/linux/audit.h > +++ b/include/linux/audit.h > @@ -358,6 +358,7 @@ extern int __audit_log_bprm_fcaps(struct > linux_binprm *bprm, const struct cred *old); > extern void __audit_log_capset(const struct cred *new, const struct > cred *old); extern void __audit_mmap_fd(int fd, int flags); > +extern void __audit_module_init(char *name); > > static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp) > { > @@ -434,6 +435,12 @@ static inline void audit_mmap_fd(int fd, int > flags) __audit_mmap_fd(fd, flags); > } > > +static inline void audit_module_init(char *name) > +{ > + if (!audit_dummy_context()) > + __audit_module_init(name); > +} > + > extern int audit_n_rules; > extern int audit_signals; > #else /* CONFIG_AUDITSYSCALL */ > @@ -539,6 +546,11 @@ static inline void audit_log_capset(const struct > cred *new, { } > static inline void audit_mmap_fd(int fd, int flags) > { } > + > +static inline void audit_module_init(char *name) > +{ > +} > + > static inline void audit_ptrace(struct task_struct *t) > { } > #define audit_n_rules 0 > diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h > index 843540c..513c930 100644 > --- a/include/uapi/linux/audit.h > +++ b/include/uapi/linux/audit.h > @@ -110,6 +110,7 @@ > #define AUDIT_SECCOMP 1326 /* Secure Computing > event */ #define AUDIT_PROCTITLE 1327 /* > Proctitle emit event */ #define AUDIT_FEATURE_CHANGE > 1328 /* audit log listing feature changes */ +#define > AUDIT_MODULE_INIT 1329 /* Module init event */ > #define AUDIT_AVC 1400 /* SE Linux avc denial > or grant */ #define AUDIT_SELINUX_ERR 1401 /* Internal > SE Linux Errors */ diff --git a/kernel/audit.h b/kernel/audit.h > index de6cbb7..cf86486 100644 > --- a/kernel/audit.h > +++ b/kernel/audit.h > @@ -198,6 +198,9 @@ struct audit_context { > struct { > int argc; > } execve; > + struct { > + char *name; > + } module; > }; > int fds[2]; > struct audit_proctitle proctitle; > diff --git a/kernel/auditsc.c b/kernel/auditsc.c > index b86cc04..93967b8 100644 > --- a/kernel/auditsc.c > +++ b/kernel/auditsc.c > @@ -1168,6 +1168,14 @@ static void audit_log_execve_info(struct > audit_context *context, kfree(buf); > } > > +static void audit_log_kern_module(struct audit_context *context, > + struct audit_buffer **ab) > +{ > + audit_log_format(*ab, " name="); > + audit_log_untrustedstring(*ab, context->module.name); > + kfree(context->module.name); > +} > + > static void show_special(struct audit_context *context, int > *call_panic) { > struct audit_buffer *ab; > @@ -1264,6 +1272,9 @@ static void show_special(struct audit_context > *context, int *call_panic) case AUDIT_EXECVE: { > audit_log_execve_info(context, &ab); > break; } > + case AUDIT_MODULE_INIT: > + audit_log_kern_module(context, &ab); > + break; > } > audit_log_end(ab); > } > @@ -2356,6 +2367,15 @@ void __audit_mmap_fd(int fd, int flags) > context->type = AUDIT_MMAP; > } > > +void __audit_module_init(char *name) > +{ > + struct audit_context *context = current->audit_context; > + > + context->module.name = kmalloc(strlen(name) + 1, GFP_KERNEL); > + strcpy(context->module.name, name); > + context->type = AUDIT_MODULE_INIT; > +} > + > static void audit_log_task(struct audit_buffer *ab) > { > kuid_t auid, uid; > diff --git a/kernel/module.c b/kernel/module.c > index 8f051a1..214ba85 100644 > --- a/kernel/module.c > +++ b/kernel/module.c > @@ -59,6 +59,7 @@ > #include <linux/jump_label.h> > #include <linux/pfn.h> > #include <linux/bsearch.h> > +#include <linux/audit.h> > #include <uapi/linux/module.h> > #include "module-internal.h" > > @@ -3441,6 +3442,8 @@ static int load_module(struct load_info *info, > const char __user *uargs, goto free_copy; > } > > + audit_module_init(mod->name); > + > /* Reserve our place in the list. */ > err = add_unformed_module(mod); > if (err) > @@ -3525,7 +3528,7 @@ static int load_module(struct load_info *info, > const char __user *uargs, mod->name, after_dashes); > } > > - /* Link in to syfs. */ > + /* Link in to sysfs. */ > err = mod_sysfs_setup(mod, info, mod->kp, mod->num_kp); > if (err < 0) > goto bug_cleanup;
WARNING: multiple messages have this Message-ID (diff)
From: Steve Grubb <sgrubb@redhat.com> To: Richard Guy Briggs <rgb@redhat.com> Cc: Rusty Russell <rusty@rustcorp.com.au>, linux-audit@redhat.com, linux-kernel@vger.kernel.org Subject: Re: [RFC] [PATCH] audit: log module name on init_module Date: Mon, 30 Jan 2017 11:54:03 +0100 [thread overview] Message-ID: <20170130115403.2c5c90f0@ivy-bridge> (raw) In-Reply-To: <2daec184298ee74022846c40791cbb13d39fd564.1485459246.git.rgb@redhat.com> On Thu, 26 Jan 2017 14:50:07 -0500 Richard Guy Briggs <rgb@redhat.com> wrote: > This adds a new auxiliary record MODULE_INIT to the SYSCALL event. Thanks, this is definitely needed. Can you provide an example event generated by this? -Steve > We get finit_module for free since it made most sense to hook this in > to load_module(). > > https://github.com/linux-audit/audit-kernel/issues/7 > https://github.com/linux-audit/audit-kernel/wiki/RFE-Module-load-record-format > > Signed-off-by: Richard Guy Briggs <rgb@redhat.com> > --- > include/linux/audit.h | 12 ++++++++++++ > include/uapi/linux/audit.h | 1 + > kernel/audit.h | 3 +++ > kernel/auditsc.c | 20 ++++++++++++++++++++ > kernel/module.c | 5 ++++- > 5 files changed, 40 insertions(+), 1 deletions(-) > > diff --git a/include/linux/audit.h b/include/linux/audit.h > index 476bc12..6222042 100644 > --- a/include/linux/audit.h > +++ b/include/linux/audit.h > @@ -358,6 +358,7 @@ extern int __audit_log_bprm_fcaps(struct > linux_binprm *bprm, const struct cred *old); > extern void __audit_log_capset(const struct cred *new, const struct > cred *old); extern void __audit_mmap_fd(int fd, int flags); > +extern void __audit_module_init(char *name); > > static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp) > { > @@ -434,6 +435,12 @@ static inline void audit_mmap_fd(int fd, int > flags) __audit_mmap_fd(fd, flags); > } > > +static inline void audit_module_init(char *name) > +{ > + if (!audit_dummy_context()) > + __audit_module_init(name); > +} > + > extern int audit_n_rules; > extern int audit_signals; > #else /* CONFIG_AUDITSYSCALL */ > @@ -539,6 +546,11 @@ static inline void audit_log_capset(const struct > cred *new, { } > static inline void audit_mmap_fd(int fd, int flags) > { } > + > +static inline void audit_module_init(char *name) > +{ > +} > + > static inline void audit_ptrace(struct task_struct *t) > { } > #define audit_n_rules 0 > diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h > index 843540c..513c930 100644 > --- a/include/uapi/linux/audit.h > +++ b/include/uapi/linux/audit.h > @@ -110,6 +110,7 @@ > #define AUDIT_SECCOMP 1326 /* Secure Computing > event */ #define AUDIT_PROCTITLE 1327 /* > Proctitle emit event */ #define AUDIT_FEATURE_CHANGE > 1328 /* audit log listing feature changes */ +#define > AUDIT_MODULE_INIT 1329 /* Module init event */ > #define AUDIT_AVC 1400 /* SE Linux avc denial > or grant */ #define AUDIT_SELINUX_ERR 1401 /* Internal > SE Linux Errors */ diff --git a/kernel/audit.h b/kernel/audit.h > index de6cbb7..cf86486 100644 > --- a/kernel/audit.h > +++ b/kernel/audit.h > @@ -198,6 +198,9 @@ struct audit_context { > struct { > int argc; > } execve; > + struct { > + char *name; > + } module; > }; > int fds[2]; > struct audit_proctitle proctitle; > diff --git a/kernel/auditsc.c b/kernel/auditsc.c > index b86cc04..93967b8 100644 > --- a/kernel/auditsc.c > +++ b/kernel/auditsc.c > @@ -1168,6 +1168,14 @@ static void audit_log_execve_info(struct > audit_context *context, kfree(buf); > } > > +static void audit_log_kern_module(struct audit_context *context, > + struct audit_buffer **ab) > +{ > + audit_log_format(*ab, " name="); > + audit_log_untrustedstring(*ab, context->module.name); > + kfree(context->module.name); > +} > + > static void show_special(struct audit_context *context, int > *call_panic) { > struct audit_buffer *ab; > @@ -1264,6 +1272,9 @@ static void show_special(struct audit_context > *context, int *call_panic) case AUDIT_EXECVE: { > audit_log_execve_info(context, &ab); > break; } > + case AUDIT_MODULE_INIT: > + audit_log_kern_module(context, &ab); > + break; > } > audit_log_end(ab); > } > @@ -2356,6 +2367,15 @@ void __audit_mmap_fd(int fd, int flags) > context->type = AUDIT_MMAP; > } > > +void __audit_module_init(char *name) > +{ > + struct audit_context *context = current->audit_context; > + > + context->module.name = kmalloc(strlen(name) + 1, GFP_KERNEL); > + strcpy(context->module.name, name); > + context->type = AUDIT_MODULE_INIT; > +} > + > static void audit_log_task(struct audit_buffer *ab) > { > kuid_t auid, uid; > diff --git a/kernel/module.c b/kernel/module.c > index 8f051a1..214ba85 100644 > --- a/kernel/module.c > +++ b/kernel/module.c > @@ -59,6 +59,7 @@ > #include <linux/jump_label.h> > #include <linux/pfn.h> > #include <linux/bsearch.h> > +#include <linux/audit.h> > #include <uapi/linux/module.h> > #include "module-internal.h" > > @@ -3441,6 +3442,8 @@ static int load_module(struct load_info *info, > const char __user *uargs, goto free_copy; > } > > + audit_module_init(mod->name); > + > /* Reserve our place in the list. */ > err = add_unformed_module(mod); > if (err) > @@ -3525,7 +3528,7 @@ static int load_module(struct load_info *info, > const char __user *uargs, mod->name, after_dashes); > } > > - /* Link in to syfs. */ > + /* Link in to sysfs. */ > err = mod_sysfs_setup(mod, info, mod->kp, mod->num_kp); > if (err < 0) > goto bug_cleanup;
next prev parent reply other threads:[~2017-01-30 10:54 UTC|newest] Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-01-26 19:50 [RFC] [PATCH] audit: log module name on init_module Richard Guy Briggs 2017-01-26 19:50 ` Richard Guy Briggs 2017-01-26 20:14 ` Richard Guy Briggs 2017-01-27 0:04 ` Rusty Russell 2017-01-27 0:04 ` Rusty Russell 2017-01-28 18:48 ` Richard Guy Briggs 2017-01-28 18:48 ` Richard Guy Briggs 2017-01-30 10:54 ` Steve Grubb [this message] 2017-01-30 10:54 ` Steve Grubb 2017-01-30 11:43 ` Richard Guy Briggs 2017-01-30 11:43 ` Richard Guy Briggs 2017-01-26 21:21 Richard Guy Briggs 2017-01-26 21:21 ` Richard Guy Briggs 2017-01-31 11:59 ` Paul Moore 2017-01-31 11:59 ` Paul Moore 2017-01-31 12:36 ` Richard Guy Briggs 2017-01-31 12:36 ` Richard Guy Briggs 2017-01-31 16:07 ` Paul Moore 2017-01-31 20:02 ` Richard Guy Briggs 2017-01-31 20:02 ` Richard Guy Briggs 2017-02-04 0:18 ` Paul Moore 2017-02-04 0:18 ` Paul Moore 2017-02-04 13:27 ` Steve Grubb 2017-02-04 17:20 ` Richard Guy Briggs 2017-02-04 17:19 ` Richard Guy Briggs 2017-02-01 8:30 ` Steve Grubb
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20170130115403.2c5c90f0@ivy-bridge \ --to=sgrubb@redhat.com \ --cc=eparis@redhat.com \ --cc=linux-audit@redhat.com \ --cc=linux-kernel@vger.kernel.org \ --cc=pmoore@redhat.com \ --cc=rgb@redhat.com \ --cc=rusty@rustcorp.com.au \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.