[PATCH 0/3] Better integrate seccomp logging and auditing

[PATCH 0/3] Better integrate seccomp logging and auditing

[Tyler Hicks]

Seccomp received improved logging controls in v4.14. Applications can opt into
logging of "handled" actions (SECCOMP_RET_TRAP, SECCOMP_RET_TRACE,
SECCOMP_RET_ERRNO) using the SECCOMP_FILTER_FLAG_LOG bit when loading filters.
They can also debug filter matching with the new SECCOMP_RET_LOG action.
Administrators can prevent specific actions from being logged using the
kernel.seccomp.actions_logged sysctl.

However, one corner case intentionally wasn't addressed in those v4.14 changes.
When a process is being inspected by the audit subsystem, seccomp's decision
making for logging ignores the new controls and unconditionally logs every
action taken except for SECCOMP_RET_ALLOW. This isn't particularly useful since
many existing applications don't intend to log handled actions due to them
occurring very frequently. This amount of logging fills the audit logs without
providing many benefits now that application authors have fine grained controls
at their disposal.

This patch set aligns the seccomp logging behavior for both audited and
unaudited processes. It also emits an audit record, if auditing is enabled,
when the kernel.seccomp.actions_logged sysctl is written to so that there's a
paper trail when entire actions are quieted.

Tyler

[PATCH 0/3] Better integrate seccomp logging and auditing

[Tyler Hicks]

Seccomp received improved logging controls in v4.14. Applications can opt into
logging of "handled" actions (SECCOMP_RET_TRAP, SECCOMP_RET_TRACE,
SECCOMP_RET_ERRNO) using the SECCOMP_FILTER_FLAG_LOG bit when loading filters.
They can also debug filter matching with the new SECCOMP_RET_LOG action.
Administrators can prevent specific actions from being logged using the
kernel.seccomp.actions_logged sysctl.

However, one corner case intentionally wasn't addressed in those v4.14 changes.
When a process is being inspected by the audit subsystem, seccomp's decision
making for logging ignores the new controls and unconditionally logs every
action taken except for SECCOMP_RET_ALLOW. This isn't particularly useful since
many existing applications don't intend to log handled actions due to them
occurring very frequently. This amount of logging fills the audit logs without
providing many benefits now that application authors have fine grained controls
at their disposal.

This patch set aligns the seccomp logging behavior for both audited and
unaudited processes. It also emits an audit record, if auditing is enabled,
when the kernel.seccomp.actions_logged sysctl is written to so that there's a
paper trail when entire actions are quieted.

Tyler

--
To unsubscribe from this list: send the line "unsubscribe linux-doc" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH 0/3] Better integrate seccomp logging and auditing

[Tyler Hicks]

Seccomp received improved logging controls in v4.14. Applications can opt into
logging of "handled" actions (SECCOMP_RET_TRAP, SECCOMP_RET_TRACE,
SECCOMP_RET_ERRNO) using the SECCOMP_FILTER_FLAG_LOG bit when loading filters.
They can also debug filter matching with the new SECCOMP_RET_LOG action.
Administrators can prevent specific actions from being logged using the
kernel.seccomp.actions_logged sysctl.

However, one corner case intentionally wasn't addressed in those v4.14 changes.
When a process is being inspected by the audit subsystem, seccomp's decision
making for logging ignores the new controls and unconditionally logs every
action taken except for SECCOMP_RET_ALLOW. This isn't particularly useful since
many existing applications don't intend to log handled actions due to them
occurring very frequently. This amount of logging fills the audit logs without
providing many benefits now that application authors have fine grained controls
at their disposal.

This patch set aligns the seccomp logging behavior for both audited and
unaudited processes. It also emits an audit record, if auditing is enabled,
when the kernel.seccomp.actions_logged sysctl is written to so that there's a
paper trail when entire actions are quieted.

Tyler

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH 1/3] seccomp: Separate read and write code for actions_logged sysctl

[Tyler Hicks]

Break the read and write paths of the kernel.seccomp.actions_logged
sysctl into separate functions to maintain readability. An upcoming
change will need to audit writes, but not reads, of this sysctl which
would introduce too many conditional code paths on whether or not the
'write' parameter evaluates to true.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
---
 kernel/seccomp.c | 60 +++++++++++++++++++++++++++++++++++---------------------
 1 file changed, 38 insertions(+), 22 deletions(-)

diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index dc77548..f4afe67 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -1199,48 +1199,64 @@ static bool seccomp_actions_logged_from_names(u32 *actions_logged, char *names)
 	return true;
 }
 
-static int seccomp_actions_logged_handler(struct ctl_table *ro_table, int write,
-					  void __user *buffer, size_t *lenp,
-					  loff_t *ppos)
+static int read_actions_logged(struct ctl_table *ro_table, void __user *buffer,
+			       size_t *lenp, loff_t *ppos)
 {
 	char names[sizeof(seccomp_actions_avail)];
 	struct ctl_table table;
+
+	memset(names, 0, sizeof(names));
+
+	if (!seccomp_names_from_actions_logged(names, sizeof(names),
+					       seccomp_actions_logged))
+		return -EINVAL;
+
+	table = *ro_table;
+	table.data = names;
+	table.maxlen = sizeof(names);
+	return proc_dostring(&table, 0, buffer, lenp, ppos);
+}
+
+static int write_actions_logged(struct ctl_table *ro_table, void __user *buffer,
+				size_t *lenp, loff_t *ppos)
+{
+	char names[sizeof(seccomp_actions_avail)];
+	struct ctl_table table;
+	u32 actions_logged;
 	int ret;
 
-	if (write && !capable(CAP_SYS_ADMIN))
+	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
 	memset(names, 0, sizeof(names));
 
-	if (!write) {
-		if (!seccomp_names_from_actions_logged(names, sizeof(names),
-						       seccomp_actions_logged))
-			return -EINVAL;
-	}
-
 	table = *ro_table;
 	table.data = names;
 	table.maxlen = sizeof(names);
-	ret = proc_dostring(&table, write, buffer, lenp, ppos);
+	ret = proc_dostring(&table, 1, buffer, lenp, ppos);
 	if (ret)
 		return ret;
 
-	if (write) {
-		u32 actions_logged;
-
-		if (!seccomp_actions_logged_from_names(&actions_logged,
-						       table.data))
-			return -EINVAL;
-
-		if (actions_logged & SECCOMP_LOG_ALLOW)
-			return -EINVAL;
+	if (!seccomp_actions_logged_from_names(&actions_logged, table.data))
+		return -EINVAL;
 
-		seccomp_actions_logged = actions_logged;
-	}
+	if (actions_logged & SECCOMP_LOG_ALLOW)
+		return -EINVAL;
 
+	seccomp_actions_logged = actions_logged;
 	return 0;
 }
 
+static int seccomp_actions_logged_handler(struct ctl_table *ro_table, int write,
+					  void __user *buffer, size_t *lenp,
+					  loff_t *ppos)
+{
+	if (write)
+		return write_actions_logged(ro_table, buffer, lenp, ppos);
+	else
+		return read_actions_logged(ro_table, buffer, lenp, ppos);
+}
+
 static struct ctl_path seccomp_sysctl_path[] = {
 	{ .procname = "kernel", },
 	{ .procname = "seccomp", },
-- 
2.7.4

[PATCH 1/3] seccomp: Separate read and write code for actions_logged sysctl

[Tyler Hicks]

Break the read and write paths of the kernel.seccomp.actions_logged
sysctl into separate functions to maintain readability. An upcoming
change will need to audit writes, but not reads, of this sysctl which
would introduce too many conditional code paths on whether or not the
'write' parameter evaluates to true.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
---
 kernel/seccomp.c | 60 +++++++++++++++++++++++++++++++++++---------------------
 1 file changed, 38 insertions(+), 22 deletions(-)

diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index dc77548..f4afe67 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -1199,48 +1199,64 @@ static bool seccomp_actions_logged_from_names(u32 *actions_logged, char *names)
 	return true;
 }
 
-static int seccomp_actions_logged_handler(struct ctl_table *ro_table, int write,
-					  void __user *buffer, size_t *lenp,
-					  loff_t *ppos)
+static int read_actions_logged(struct ctl_table *ro_table, void __user *buffer,
+			       size_t *lenp, loff_t *ppos)
 {
 	char names[sizeof(seccomp_actions_avail)];
 	struct ctl_table table;
+
+	memset(names, 0, sizeof(names));
+
+	if (!seccomp_names_from_actions_logged(names, sizeof(names),
+					       seccomp_actions_logged))
+		return -EINVAL;
+
+	table = *ro_table;
+	table.data = names;
+	table.maxlen = sizeof(names);
+	return proc_dostring(&table, 0, buffer, lenp, ppos);
+}
+
+static int write_actions_logged(struct ctl_table *ro_table, void __user *buffer,
+				size_t *lenp, loff_t *ppos)
+{
+	char names[sizeof(seccomp_actions_avail)];
+	struct ctl_table table;
+	u32 actions_logged;
 	int ret;
 
-	if (write && !capable(CAP_SYS_ADMIN))
+	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
 	memset(names, 0, sizeof(names));
 
-	if (!write) {
-		if (!seccomp_names_from_actions_logged(names, sizeof(names),
-						       seccomp_actions_logged))
-			return -EINVAL;
-	}
-
 	table = *ro_table;
 	table.data = names;
 	table.maxlen = sizeof(names);
-	ret = proc_dostring(&table, write, buffer, lenp, ppos);
+	ret = proc_dostring(&table, 1, buffer, lenp, ppos);
 	if (ret)
 		return ret;
 
-	if (write) {
-		u32 actions_logged;
-
-		if (!seccomp_actions_logged_from_names(&actions_logged,
-						       table.data))
-			return -EINVAL;
-
-		if (actions_logged & SECCOMP_LOG_ALLOW)
-			return -EINVAL;
+	if (!seccomp_actions_logged_from_names(&actions_logged, table.data))
+		return -EINVAL;
 
-		seccomp_actions_logged = actions_logged;
-	}
+	if (actions_logged & SECCOMP_LOG_ALLOW)
+		return -EINVAL;
 
+	seccomp_actions_logged = actions_logged;
 	return 0;
 }
 
+static int seccomp_actions_logged_handler(struct ctl_table *ro_table, int write,
+					  void __user *buffer, size_t *lenp,
+					  loff_t *ppos)
+{
+	if (write)
+		return write_actions_logged(ro_table, buffer, lenp, ppos);
+	else
+		return read_actions_logged(ro_table, buffer, lenp, ppos);
+}
+
 static struct ctl_path seccomp_sysctl_path[] = {
 	{ .procname = "kernel", },
 	{ .procname = "seccomp", },
-- 
2.7.4

--
To unsubscribe from this list: send the line "unsubscribe linux-doc" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH 1/3] seccomp: Separate read and write code for actions_logged sysctl

[Tyler Hicks]

Break the read and write paths of the kernel.seccomp.actions_logged
sysctl into separate functions to maintain readability. An upcoming
change will need to audit writes, but not reads, of this sysctl which
would introduce too many conditional code paths on whether or not the
'write' parameter evaluates to true.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
---
 kernel/seccomp.c | 60 +++++++++++++++++++++++++++++++++++---------------------
 1 file changed, 38 insertions(+), 22 deletions(-)

diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index dc77548..f4afe67 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -1199,48 +1199,64 @@ static bool seccomp_actions_logged_from_names(u32 *actions_logged, char *names)
 	return true;
 }
 
-static int seccomp_actions_logged_handler(struct ctl_table *ro_table, int write,
-					  void __user *buffer, size_t *lenp,
-					  loff_t *ppos)
+static int read_actions_logged(struct ctl_table *ro_table, void __user *buffer,
+			       size_t *lenp, loff_t *ppos)
 {
 	char names[sizeof(seccomp_actions_avail)];
 	struct ctl_table table;
+
+	memset(names, 0, sizeof(names));
+
+	if (!seccomp_names_from_actions_logged(names, sizeof(names),
+					       seccomp_actions_logged))
+		return -EINVAL;
+
+	table = *ro_table;
+	table.data = names;
+	table.maxlen = sizeof(names);
+	return proc_dostring(&table, 0, buffer, lenp, ppos);
+}
+
+static int write_actions_logged(struct ctl_table *ro_table, void __user *buffer,
+				size_t *lenp, loff_t *ppos)
+{
+	char names[sizeof(seccomp_actions_avail)];
+	struct ctl_table table;
+	u32 actions_logged;
 	int ret;
 
-	if (write && !capable(CAP_SYS_ADMIN))
+	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
 	memset(names, 0, sizeof(names));
 
-	if (!write) {
-		if (!seccomp_names_from_actions_logged(names, sizeof(names),
-						       seccomp_actions_logged))
-			return -EINVAL;
-	}
-
 	table = *ro_table;
 	table.data = names;
 	table.maxlen = sizeof(names);
-	ret = proc_dostring(&table, write, buffer, lenp, ppos);
+	ret = proc_dostring(&table, 1, buffer, lenp, ppos);
 	if (ret)
 		return ret;
 
-	if (write) {
-		u32 actions_logged;
-
-		if (!seccomp_actions_logged_from_names(&actions_logged,
-						       table.data))
-			return -EINVAL;
-
-		if (actions_logged & SECCOMP_LOG_ALLOW)
-			return -EINVAL;
+	if (!seccomp_actions_logged_from_names(&actions_logged, table.data))
+		return -EINVAL;
 
-		seccomp_actions_logged = actions_logged;
-	}
+	if (actions_logged & SECCOMP_LOG_ALLOW)
+		return -EINVAL;
 
+	seccomp_actions_logged = actions_logged;
 	return 0;
 }
 
+static int seccomp_actions_logged_handler(struct ctl_table *ro_table, int write,
+					  void __user *buffer, size_t *lenp,
+					  loff_t *ppos)
+{
+	if (write)
+		return write_actions_logged(ro_table, buffer, lenp, ppos);
+	else
+		return read_actions_logged(ro_table, buffer, lenp, ppos);
+}
+
 static struct ctl_path seccomp_sysctl_path[] = {
 	{ .procname = "kernel", },
 	{ .procname = "seccomp", },
-- 
2.7.4

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH 2/3] seccomp: Audit attempts to modify the actions_logged sysctl

[Tyler Hicks]

The decision to log a seccomp action will always be subject to the
value of the kernel.seccomp.actions_logged sysctl, even for processes
that are being inspected via the audit subsystem, in an upcoming patch.
Therefore, we need to emit an audit record on attempts at writing to the
actions_logged sysctl when auditing is enabled.

This patch updates the write handler for the actions_logged sysctl to
emit an audit record on attempts to write to the sysctl. Successful
writes to the sysctl will result in a record that includes a normalized
list of logged actions in the "actions" field and a "res" field equal to
0. Unsuccessful writes to the sysctl will result in a record that
doesn't include the "actions" field and has a "res" field equal to 1.

Not all unsuccessful writes to the sysctl are audited. For example, an
audit record will not be emitted if an unprivileged process attempts to
open the sysctl file for reading since that access control check is not
part of the sysctl's write handler.

Below are some example audit records when writing various strings to the
actions_logged sysctl.

Writing "not-a-real-action" emits:

 type=CONFIG_CHANGE msg=audit(1524600971.363:119): pid=1651 uid=0
 auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
 op=seccomp-logging res=1

Writing "kill_process kill_thread errno trace log" emits:

 type=CONFIG_CHANGE msg=audit(1524601023.982:131): pid=1658 uid=0
 auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
 op=seccomp-logging actions="kill_process kill_thread errno trace log"
 res=0

Writing the string "log log errno trace kill_process kill_thread", which
is unordered and contains the log action twice, results in the same
value as the previous example for the actions field:

 type=CONFIG_CHANGE msg=audit(1524601204.365:152): pid=1704 uid=0
 auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
 op=seccomp-logging actions="kill_process kill_thread errno trace log"
 res=0

No audit records are generated when reading the actions_logged sysctl.

Suggested-by: Steve Grubb <sgrubb@redhat.com>
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
---
 include/linux/audit.h |  3 +++
 kernel/auditsc.c      | 37 +++++++++++++++++++++++++++++++++++++
 kernel/seccomp.c      | 43 ++++++++++++++++++++++++++++++++++---------
 3 files changed, 74 insertions(+), 9 deletions(-)

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 75d5b03..b311d7d 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -233,6 +233,7 @@ extern void __audit_inode_child(struct inode *parent,
 				const struct dentry *dentry,
 				const unsigned char type);
 extern void __audit_seccomp(unsigned long syscall, long signr, int code);
+extern void audit_seccomp_actions_logged(const char *names, int res);
 extern void __audit_ptrace(struct task_struct *t);
 
 static inline bool audit_dummy_context(void)
@@ -502,6 +503,8 @@ static inline void __audit_seccomp(unsigned long syscall, long signr, int code)
 { }
 static inline void audit_seccomp(unsigned long syscall, long signr, int code)
 { }
+static inline void audit_seccomp_actions_logged(const char *names, int res)
+{ }
 static inline int auditsc_get_stamp(struct audit_context *ctx,
 			      struct timespec64 *t, unsigned int *serial)
 {
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 4e0a4ac..3496238 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -2478,6 +2478,43 @@ void __audit_seccomp(unsigned long syscall, long signr, int code)
 	audit_log_end(ab);
 }
 
+void audit_seccomp_actions_logged(const char *names, int res)
+{
+	struct tty_struct *tty;
+	const struct cred *cred;
+	struct audit_buffer *ab;
+	char comm[sizeof(current->comm)];
+
+	if (!audit_enabled)
+		return;
+
+	ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
+	if (unlikely(!ab))
+		return;
+
+	cred = current_cred();
+	tty = audit_get_tty(current);
+	audit_log_format(ab, "pid=%d uid=%u auid=%u tty=%s ses=%u",
+			 task_tgid_nr(current),
+			 from_kuid(&init_user_ns, cred->uid),
+			 from_kuid(&init_user_ns,
+			 audit_get_loginuid(current)),
+			 tty ? tty_name(tty) : "(none)",
+			 audit_get_sessionid(current));
+	audit_put_tty(tty);
+	audit_log_task_context(ab);
+	audit_log_format(ab, " comm=");
+	audit_log_untrustedstring(ab, get_task_comm(comm, current));
+	audit_log_d_path_exe(ab, current->mm);
+	audit_log_format(ab, " op=seccomp-logging");
+
+	if (names)
+		audit_log_format(ab, " actions=\"%s\"", names);
+
+	audit_log_format(ab, " res=%d", res);
+	audit_log_end(ab);
+}
+
 struct list_head *audit_killed_trees(void)
 {
 	struct audit_context *ctx = current->audit_context;
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index f4afe67..e28ddcc 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -1218,11 +1218,10 @@ static int read_actions_logged(struct ctl_table *ro_table, void __user *buffer,
 }
 
 static int write_actions_logged(struct ctl_table *ro_table, void __user *buffer,
-				size_t *lenp, loff_t *ppos)
+				size_t *lenp, loff_t *ppos, u32 *actions_logged)
 {
 	char names[sizeof(seccomp_actions_avail)];
 	struct ctl_table table;
-	u32 actions_logged;
 	int ret;
 
 	if (!capable(CAP_SYS_ADMIN))
@@ -1237,24 +1236,50 @@ static int write_actions_logged(struct ctl_table *ro_table, void __user *buffer,
 	if (ret)
 		return ret;
 
-	if (!seccomp_actions_logged_from_names(&actions_logged, table.data))
+	if (!seccomp_actions_logged_from_names(actions_logged, table.data))
 		return -EINVAL;
 
-	if (actions_logged & SECCOMP_LOG_ALLOW)
+	if (*actions_logged & SECCOMP_LOG_ALLOW)
 		return -EINVAL;
 
-	seccomp_actions_logged = actions_logged;
+	seccomp_actions_logged = *actions_logged;
 	return 0;
 }
 
+static void audit_actions_logged(u32 actions_logged, int ret)
+{
+	char names[sizeof(seccomp_actions_avail)];
+
+	if (!audit_enabled)
+		return;
+
+	if (ret)
+		return audit_seccomp_actions_logged(NULL, 1);
+
+	memset(names, 0, sizeof(names));
+	if (!seccomp_names_from_actions_logged(names, sizeof(names),
+					       actions_logged))
+		return audit_seccomp_actions_logged(NULL, 0);
+
+	return audit_seccomp_actions_logged(names, 0);
+}
+
 static int seccomp_actions_logged_handler(struct ctl_table *ro_table, int write,
 					  void __user *buffer, size_t *lenp,
 					  loff_t *ppos)
 {
-	if (write)
-		return write_actions_logged(ro_table, buffer, lenp, ppos);
-	else
-		return read_actions_logged(ro_table, buffer, lenp, ppos);
+	int ret;
+
+	if (write) {
+		u32 actions_logged = 0;
+
+		ret = write_actions_logged(ro_table, buffer, lenp, ppos,
+					   &actions_logged);
+		audit_actions_logged(actions_logged, ret);
+	} else
+		ret = read_actions_logged(ro_table, buffer, lenp, ppos);
+
+	return ret;
 }
 
 static struct ctl_path seccomp_sysctl_path[] = {
-- 
2.7.4

[PATCH 2/3] seccomp: Audit attempts to modify the actions_logged sysctl

[Tyler Hicks]

The decision to log a seccomp action will always be subject to the
value of the kernel.seccomp.actions_logged sysctl, even for processes
that are being inspected via the audit subsystem, in an upcoming patch.
Therefore, we need to emit an audit record on attempts at writing to the
actions_logged sysctl when auditing is enabled.

This patch updates the write handler for the actions_logged sysctl to
emit an audit record on attempts to write to the sysctl. Successful
writes to the sysctl will result in a record that includes a normalized
list of logged actions in the "actions" field and a "res" field equal to
0. Unsuccessful writes to the sysctl will result in a record that
doesn't include the "actions" field and has a "res" field equal to 1.

Not all unsuccessful writes to the sysctl are audited. For example, an
audit record will not be emitted if an unprivileged process attempts to
open the sysctl file for reading since that access control check is not
part of the sysctl's write handler.

Below are some example audit records when writing various strings to the
actions_logged sysctl.

Writing "not-a-real-action" emits:

 type=CONFIG_CHANGE msg=audit(1524600971.363:119): pid=1651 uid=0
 auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
 op=seccomp-logging res=1

Writing "kill_process kill_thread errno trace log" emits:

 type=CONFIG_CHANGE msg=audit(1524601023.982:131): pid=1658 uid=0
 auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
 op=seccomp-logging actions="kill_process kill_thread errno trace log"
 res=0

Writing the string "log log errno trace kill_process kill_thread", which
is unordered and contains the log action twice, results in the same
value as the previous example for the actions field:

 type=CONFIG_CHANGE msg=audit(1524601204.365:152): pid=1704 uid=0
 auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
 op=seccomp-logging actions="kill_process kill_thread errno trace log"
 res=0

No audit records are generated when reading the actions_logged sysctl.

Suggested-by: Steve Grubb <sgrubb@redhat.com>
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
---
 include/linux/audit.h |  3 +++
 kernel/auditsc.c      | 37 +++++++++++++++++++++++++++++++++++++
 kernel/seccomp.c      | 43 ++++++++++++++++++++++++++++++++++---------
 3 files changed, 74 insertions(+), 9 deletions(-)

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 75d5b03..b311d7d 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -233,6 +233,7 @@ extern void __audit_inode_child(struct inode *parent,
 				const struct dentry *dentry,
 				const unsigned char type);
 extern void __audit_seccomp(unsigned long syscall, long signr, int code);
+extern void audit_seccomp_actions_logged(const char *names, int res);
 extern void __audit_ptrace(struct task_struct *t);
 
 static inline bool audit_dummy_context(void)
@@ -502,6 +503,8 @@ static inline void __audit_seccomp(unsigned long syscall, long signr, int code)
 { }
 static inline void audit_seccomp(unsigned long syscall, long signr, int code)
 { }
+static inline void audit_seccomp_actions_logged(const char *names, int res)
+{ }
 static inline int auditsc_get_stamp(struct audit_context *ctx,
 			      struct timespec64 *t, unsigned int *serial)
 {
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 4e0a4ac..3496238 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -2478,6 +2478,43 @@ void __audit_seccomp(unsigned long syscall, long signr, int code)
 	audit_log_end(ab);
 }
 
+void audit_seccomp_actions_logged(const char *names, int res)
+{
+	struct tty_struct *tty;
+	const struct cred *cred;
+	struct audit_buffer *ab;
+	char comm[sizeof(current->comm)];
+
+	if (!audit_enabled)
+		return;
+
+	ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
+	if (unlikely(!ab))
+		return;
+
+	cred = current_cred();
+	tty = audit_get_tty(current);
+	audit_log_format(ab, "pid=%d uid=%u auid=%u tty=%s ses=%u",
+			 task_tgid_nr(current),
+			 from_kuid(&init_user_ns, cred->uid),
+			 from_kuid(&init_user_ns,
+			 audit_get_loginuid(current)),
+			 tty ? tty_name(tty) : "(none)",
+			 audit_get_sessionid(current));
+	audit_put_tty(tty);
+	audit_log_task_context(ab);
+	audit_log_format(ab, " comm=");
+	audit_log_untrustedstring(ab, get_task_comm(comm, current));
+	audit_log_d_path_exe(ab, current->mm);
+	audit_log_format(ab, " op=seccomp-logging");
+
+	if (names)
+		audit_log_format(ab, " actions=\"%s\"", names);
+
+	audit_log_format(ab, " res=%d", res);
+	audit_log_end(ab);
+}
+
 struct list_head *audit_killed_trees(void)
 {
 	struct audit_context *ctx = current->audit_context;
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index f4afe67..e28ddcc 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -1218,11 +1218,10 @@ static int read_actions_logged(struct ctl_table *ro_table, void __user *buffer,
 }
 
 static int write_actions_logged(struct ctl_table *ro_table, void __user *buffer,
-				size_t *lenp, loff_t *ppos)
+				size_t *lenp, loff_t *ppos, u32 *actions_logged)
 {
 	char names[sizeof(seccomp_actions_avail)];
 	struct ctl_table table;
-	u32 actions_logged;
 	int ret;
 
 	if (!capable(CAP_SYS_ADMIN))
@@ -1237,24 +1236,50 @@ static int write_actions_logged(struct ctl_table *ro_table, void __user *buffer,
 	if (ret)
 		return ret;
 
-	if (!seccomp_actions_logged_from_names(&actions_logged, table.data))
+	if (!seccomp_actions_logged_from_names(actions_logged, table.data))
 		return -EINVAL;
 
-	if (actions_logged & SECCOMP_LOG_ALLOW)
+	if (*actions_logged & SECCOMP_LOG_ALLOW)
 		return -EINVAL;
 
-	seccomp_actions_logged = actions_logged;
+	seccomp_actions_logged = *actions_logged;
 	return 0;
 }
 
+static void audit_actions_logged(u32 actions_logged, int ret)
+{
+	char names[sizeof(seccomp_actions_avail)];
+
+	if (!audit_enabled)
+		return;
+
+	if (ret)
+		return audit_seccomp_actions_logged(NULL, 1);
+
+	memset(names, 0, sizeof(names));
+	if (!seccomp_names_from_actions_logged(names, sizeof(names),
+					       actions_logged))
+		return audit_seccomp_actions_logged(NULL, 0);
+
+	return audit_seccomp_actions_logged(names, 0);
+}
+
 static int seccomp_actions_logged_handler(struct ctl_table *ro_table, int write,
 					  void __user *buffer, size_t *lenp,
 					  loff_t *ppos)
 {
-	if (write)
-		return write_actions_logged(ro_table, buffer, lenp, ppos);
-	else
-		return read_actions_logged(ro_table, buffer, lenp, ppos);
+	int ret;
+
+	if (write) {
+		u32 actions_logged = 0;
+
+		ret = write_actions_logged(ro_table, buffer, lenp, ppos,
+					   &actions_logged);
+		audit_actions_logged(actions_logged, ret);
+	} else
+		ret = read_actions_logged(ro_table, buffer, lenp, ppos);
+
+	return ret;
 }
 
 static struct ctl_path seccomp_sysctl_path[] = {
-- 
2.7.4

--
To unsubscribe from this list: send the line "unsubscribe linux-doc" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH 2/3] seccomp: Audit attempts to modify the actions_logged sysctl

[Tyler Hicks]

The decision to log a seccomp action will always be subject to the
value of the kernel.seccomp.actions_logged sysctl, even for processes
that are being inspected via the audit subsystem, in an upcoming patch.
Therefore, we need to emit an audit record on attempts at writing to the
actions_logged sysctl when auditing is enabled.

This patch updates the write handler for the actions_logged sysctl to
emit an audit record on attempts to write to the sysctl. Successful
writes to the sysctl will result in a record that includes a normalized
list of logged actions in the "actions" field and a "res" field equal to
0. Unsuccessful writes to the sysctl will result in a record that
doesn't include the "actions" field and has a "res" field equal to 1.

Not all unsuccessful writes to the sysctl are audited. For example, an
audit record will not be emitted if an unprivileged process attempts to
open the sysctl file for reading since that access control check is not
part of the sysctl's write handler.

Below are some example audit records when writing various strings to the
actions_logged sysctl.

Writing "not-a-real-action" emits:

 type=CONFIG_CHANGE msg=audit(1524600971.363:119): pid=1651 uid=0
 auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
 op=seccomp-logging res=1

Writing "kill_process kill_thread errno trace log" emits:

 type=CONFIG_CHANGE msg=audit(1524601023.982:131): pid=1658 uid=0
 auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
 op=seccomp-logging actions="kill_process kill_thread errno trace log"
 res=0

Writing the string "log log errno trace kill_process kill_thread", which
is unordered and contains the log action twice, results in the same
value as the previous example for the actions field:

 type=CONFIG_CHANGE msg=audit(1524601204.365:152): pid=1704 uid=0
 auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
 op=seccomp-logging actions="kill_process kill_thread errno trace log"
 res=0

No audit records are generated when reading the actions_logged sysctl.

Suggested-by: Steve Grubb <sgrubb@redhat.com>
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
---
 include/linux/audit.h |  3 +++
 kernel/auditsc.c      | 37 +++++++++++++++++++++++++++++++++++++
 kernel/seccomp.c      | 43 ++++++++++++++++++++++++++++++++++---------
 3 files changed, 74 insertions(+), 9 deletions(-)

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 75d5b03..b311d7d 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -233,6 +233,7 @@ extern void __audit_inode_child(struct inode *parent,
 				const struct dentry *dentry,
 				const unsigned char type);
 extern void __audit_seccomp(unsigned long syscall, long signr, int code);
+extern void audit_seccomp_actions_logged(const char *names, int res);
 extern void __audit_ptrace(struct task_struct *t);
 
 static inline bool audit_dummy_context(void)
@@ -502,6 +503,8 @@ static inline void __audit_seccomp(unsigned long syscall, long signr, int code)
 { }
 static inline void audit_seccomp(unsigned long syscall, long signr, int code)
 { }
+static inline void audit_seccomp_actions_logged(const char *names, int res)
+{ }
 static inline int auditsc_get_stamp(struct audit_context *ctx,
 			      struct timespec64 *t, unsigned int *serial)
 {
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 4e0a4ac..3496238 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -2478,6 +2478,43 @@ void __audit_seccomp(unsigned long syscall, long signr, int code)
 	audit_log_end(ab);
 }
 
+void audit_seccomp_actions_logged(const char *names, int res)
+{
+	struct tty_struct *tty;
+	const struct cred *cred;
+	struct audit_buffer *ab;
+	char comm[sizeof(current->comm)];
+
+	if (!audit_enabled)
+		return;
+
+	ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
+	if (unlikely(!ab))
+		return;
+
+	cred = current_cred();
+	tty = audit_get_tty(current);
+	audit_log_format(ab, "pid=%d uid=%u auid=%u tty=%s ses=%u",
+			 task_tgid_nr(current),
+			 from_kuid(&init_user_ns, cred->uid),
+			 from_kuid(&init_user_ns,
+			 audit_get_loginuid(current)),
+			 tty ? tty_name(tty) : "(none)",
+			 audit_get_sessionid(current));
+	audit_put_tty(tty);
+	audit_log_task_context(ab);
+	audit_log_format(ab, " comm=");
+	audit_log_untrustedstring(ab, get_task_comm(comm, current));
+	audit_log_d_path_exe(ab, current->mm);
+	audit_log_format(ab, " op=seccomp-logging");
+
+	if (names)
+		audit_log_format(ab, " actions=\"%s\"", names);
+
+	audit_log_format(ab, " res=%d", res);
+	audit_log_end(ab);
+}
+
 struct list_head *audit_killed_trees(void)
 {
 	struct audit_context *ctx = current->audit_context;
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index f4afe67..e28ddcc 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -1218,11 +1218,10 @@ static int read_actions_logged(struct ctl_table *ro_table, void __user *buffer,
 }
 
 static int write_actions_logged(struct ctl_table *ro_table, void __user *buffer,
-				size_t *lenp, loff_t *ppos)
+				size_t *lenp, loff_t *ppos, u32 *actions_logged)
 {
 	char names[sizeof(seccomp_actions_avail)];
 	struct ctl_table table;
-	u32 actions_logged;
 	int ret;
 
 	if (!capable(CAP_SYS_ADMIN))
@@ -1237,24 +1236,50 @@ static int write_actions_logged(struct ctl_table *ro_table, void __user *buffer,
 	if (ret)
 		return ret;
 
-	if (!seccomp_actions_logged_from_names(&actions_logged, table.data))
+	if (!seccomp_actions_logged_from_names(actions_logged, table.data))
 		return -EINVAL;
 
-	if (actions_logged & SECCOMP_LOG_ALLOW)
+	if (*actions_logged & SECCOMP_LOG_ALLOW)
 		return -EINVAL;
 
-	seccomp_actions_logged = actions_logged;
+	seccomp_actions_logged = *actions_logged;
 	return 0;
 }
 
+static void audit_actions_logged(u32 actions_logged, int ret)
+{
+	char names[sizeof(seccomp_actions_avail)];
+
+	if (!audit_enabled)
+		return;
+
+	if (ret)
+		return audit_seccomp_actions_logged(NULL, 1);
+
+	memset(names, 0, sizeof(names));
+	if (!seccomp_names_from_actions_logged(names, sizeof(names),
+					       actions_logged))
+		return audit_seccomp_actions_logged(NULL, 0);
+
+	return audit_seccomp_actions_logged(names, 0);
+}
+
 static int seccomp_actions_logged_handler(struct ctl_table *ro_table, int write,
 					  void __user *buffer, size_t *lenp,
 					  loff_t *ppos)
 {
-	if (write)
-		return write_actions_logged(ro_table, buffer, lenp, ppos);
-	else
-		return read_actions_logged(ro_table, buffer, lenp, ppos);
+	int ret;
+
+	if (write) {
+		u32 actions_logged = 0;
+
+		ret = write_actions_logged(ro_table, buffer, lenp, ppos,
+					   &actions_logged);
+		audit_actions_logged(actions_logged, ret);
+	} else
+		ret = read_actions_logged(ro_table, buffer, lenp, ppos);
+
+	return ret;
 }
 
 static struct ctl_path seccomp_sysctl_path[] = {
-- 
2.7.4

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH 3/3] seccomp: Don't special case audited processes when logging

[Tyler Hicks]

Seccomp logging for "handled" actions such as RET_TRAP, RET_TRACE, or
RET_ERRNO can be very noisy for processes that are being audited. This
patch modifies the seccomp logging behavior to treat processes that are
being inspected via the audit subsystem the same as processes that
aren't under inspection. Handled actions will no longer be logged just
because the process is being inspected. Since v4.14, applications have
the ability to request logging of handled actions by using the
SECCOMP_FILTER_FLAG_LOG flag when loading seccomp filters.

With this patch, the logic for deciding if an action will be logged is:

  if action == RET_ALLOW:
    do not log
  else if action not in actions_logged:
    do not log
  else if action == RET_KILL:
    log
  else if action == RET_LOG:
    log
  else if filter-requests-logging:
    log
  else:
    do not log

Reported-by: Steve Grubb <sgrubb@redhat.com>
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
---
 Documentation/userspace-api/seccomp_filter.rst |  7 -------
 include/linux/audit.h                          | 10 +---------
 kernel/auditsc.c                               |  2 +-
 kernel/seccomp.c                               | 15 +++++----------
 4 files changed, 7 insertions(+), 27 deletions(-)

diff --git a/Documentation/userspace-api/seccomp_filter.rst b/Documentation/userspace-api/seccomp_filter.rst
index 099c412..82a468b 100644
--- a/Documentation/userspace-api/seccomp_filter.rst
+++ b/Documentation/userspace-api/seccomp_filter.rst
@@ -207,13 +207,6 @@ directory. Here's a description of each file in that directory:
 	to the file do not need to be in ordered form but reads from the file
 	will be ordered in the same way as the actions_avail sysctl.
 
-	It is important to note that the value of ``actions_logged`` does not
-	prevent certain actions from being logged when the audit subsystem is
-	configured to audit a task. If the action is not found in
-	``actions_logged`` list, the final decision on whether to audit the
-	action for that task is ultimately left up to the audit subsystem to
-	decide for all seccomp return values other than ``SECCOMP_RET_ALLOW``.
-
 	The ``allow`` string is not accepted in the ``actions_logged`` sysctl
 	as it is not possible to log ``SECCOMP_RET_ALLOW`` actions. Attempting
 	to write ``allow`` to the sysctl will result in an EINVAL being
diff --git a/include/linux/audit.h b/include/linux/audit.h
index b311d7d..1964fbd 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -232,7 +232,7 @@ extern void __audit_file(const struct file *);
 extern void __audit_inode_child(struct inode *parent,
 				const struct dentry *dentry,
 				const unsigned char type);
-extern void __audit_seccomp(unsigned long syscall, long signr, int code);
+extern void audit_seccomp(unsigned long syscall, long signr, int code);
 extern void audit_seccomp_actions_logged(const char *names, int res);
 extern void __audit_ptrace(struct task_struct *t);
 
@@ -303,12 +303,6 @@ static inline void audit_inode_child(struct inode *parent,
 }
 void audit_core_dumps(long signr);
 
-static inline void audit_seccomp(unsigned long syscall, long signr, int code)
-{
-	if (audit_enabled && unlikely(!audit_dummy_context()))
-		__audit_seccomp(syscall, signr, code);
-}
-
 static inline void audit_ptrace(struct task_struct *t)
 {
 	if (unlikely(!audit_dummy_context()))
@@ -499,8 +493,6 @@ static inline void audit_inode_child(struct inode *parent,
 { }
 static inline void audit_core_dumps(long signr)
 { }
-static inline void __audit_seccomp(unsigned long syscall, long signr, int code)
-{ }
 static inline void audit_seccomp(unsigned long syscall, long signr, int code)
 { }
 static inline void audit_seccomp_actions_logged(const char *names, int res)
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 3496238..1e64b91 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -2464,7 +2464,7 @@ void audit_core_dumps(long signr)
 	audit_log_end(ab);
 }
 
-void __audit_seccomp(unsigned long syscall, long signr, int code)
+void audit_seccomp(unsigned long syscall, long signr, int code)
 {
 	struct audit_buffer *ab;
 
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index e28ddcc..947cc0f 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -584,18 +584,13 @@ static inline void seccomp_log(unsigned long syscall, long signr, u32 action,
 	}
 
 	/*
-	 * Force an audit message to be emitted when the action is RET_KILL_*,
-	 * RET_LOG, or the FILTER_FLAG_LOG bit was set and the action is
-	 * allowed to be logged by the admin.
+	 * Emit an audit message when the action is RET_KILL_*, RET_LOG, or the
+	 * FILTER_FLAG_LOG bit was set. The admin has the ability to silence
+	 * any action from being logged by removing the action name from the
+	 * seccomp_actions_logged sysctl.
 	 */
 	if (log)
-		return __audit_seccomp(syscall, signr, action);
-
-	/*
-	 * Let the audit subsystem decide if the action should be audited based
-	 * on whether the current task itself is being audited.
-	 */
-	return audit_seccomp(syscall, signr, action);
+		audit_seccomp(syscall, signr, action);
 }
 
 /*
-- 
2.7.4

[PATCH 3/3] seccomp: Don't special case audited processes when logging

[Tyler Hicks]

Seccomp logging for "handled" actions such as RET_TRAP, RET_TRACE, or
RET_ERRNO can be very noisy for processes that are being audited. This
patch modifies the seccomp logging behavior to treat processes that are
being inspected via the audit subsystem the same as processes that
aren't under inspection. Handled actions will no longer be logged just
because the process is being inspected. Since v4.14, applications have
the ability to request logging of handled actions by using the
SECCOMP_FILTER_FLAG_LOG flag when loading seccomp filters.

With this patch, the logic for deciding if an action will be logged is:

  if action == RET_ALLOW:
    do not log
  else if action not in actions_logged:
    do not log
  else if action == RET_KILL:
    log
  else if action == RET_LOG:
    log
  else if filter-requests-logging:
    log
  else:
    do not log

Reported-by: Steve Grubb <sgrubb@redhat.com>
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
---
 Documentation/userspace-api/seccomp_filter.rst |  7 -------
 include/linux/audit.h                          | 10 +---------
 kernel/auditsc.c                               |  2 +-
 kernel/seccomp.c                               | 15 +++++----------
 4 files changed, 7 insertions(+), 27 deletions(-)

diff --git a/Documentation/userspace-api/seccomp_filter.rst b/Documentation/userspace-api/seccomp_filter.rst
index 099c412..82a468b 100644
--- a/Documentation/userspace-api/seccomp_filter.rst
+++ b/Documentation/userspace-api/seccomp_filter.rst
@@ -207,13 +207,6 @@ directory. Here's a description of each file in that directory:
 	to the file do not need to be in ordered form but reads from the file
 	will be ordered in the same way as the actions_avail sysctl.
 
-	It is important to note that the value of ``actions_logged`` does not
-	prevent certain actions from being logged when the audit subsystem is
-	configured to audit a task. If the action is not found in
-	``actions_logged`` list, the final decision on whether to audit the
-	action for that task is ultimately left up to the audit subsystem to
-	decide for all seccomp return values other than ``SECCOMP_RET_ALLOW``.
-
 	The ``allow`` string is not accepted in the ``actions_logged`` sysctl
 	as it is not possible to log ``SECCOMP_RET_ALLOW`` actions. Attempting
 	to write ``allow`` to the sysctl will result in an EINVAL being
diff --git a/include/linux/audit.h b/include/linux/audit.h
index b311d7d..1964fbd 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -232,7 +232,7 @@ extern void __audit_file(const struct file *);
 extern void __audit_inode_child(struct inode *parent,
 				const struct dentry *dentry,
 				const unsigned char type);
-extern void __audit_seccomp(unsigned long syscall, long signr, int code);
+extern void audit_seccomp(unsigned long syscall, long signr, int code);
 extern void audit_seccomp_actions_logged(const char *names, int res);
 extern void __audit_ptrace(struct task_struct *t);
 
@@ -303,12 +303,6 @@ static inline void audit_inode_child(struct inode *parent,
 }
 void audit_core_dumps(long signr);
 
-static inline void audit_seccomp(unsigned long syscall, long signr, int code)
-{
-	if (audit_enabled && unlikely(!audit_dummy_context()))
-		__audit_seccomp(syscall, signr, code);
-}
-
 static inline void audit_ptrace(struct task_struct *t)
 {
 	if (unlikely(!audit_dummy_context()))
@@ -499,8 +493,6 @@ static inline void audit_inode_child(struct inode *parent,
 { }
 static inline void audit_core_dumps(long signr)
 { }
-static inline void __audit_seccomp(unsigned long syscall, long signr, int code)
-{ }
 static inline void audit_seccomp(unsigned long syscall, long signr, int code)
 { }
 static inline void audit_seccomp_actions_logged(const char *names, int res)
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 3496238..1e64b91 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -2464,7 +2464,7 @@ void audit_core_dumps(long signr)
 	audit_log_end(ab);
 }
 
-void __audit_seccomp(unsigned long syscall, long signr, int code)
+void audit_seccomp(unsigned long syscall, long signr, int code)
 {
 	struct audit_buffer *ab;
 
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index e28ddcc..947cc0f 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -584,18 +584,13 @@ static inline void seccomp_log(unsigned long syscall, long signr, u32 action,
 	}
 
 	/*
-	 * Force an audit message to be emitted when the action is RET_KILL_*,
-	 * RET_LOG, or the FILTER_FLAG_LOG bit was set and the action is
-	 * allowed to be logged by the admin.
+	 * Emit an audit message when the action is RET_KILL_*, RET_LOG, or the
+	 * FILTER_FLAG_LOG bit was set. The admin has the ability to silence
+	 * any action from being logged by removing the action name from the
+	 * seccomp_actions_logged sysctl.
 	 */
 	if (log)
-		return __audit_seccomp(syscall, signr, action);
-
-	/*
-	 * Let the audit subsystem decide if the action should be audited based
-	 * on whether the current task itself is being audited.
-	 */
-	return audit_seccomp(syscall, signr, action);
+		audit_seccomp(syscall, signr, action);
 }
 
 /*
-- 
2.7.4

--
To unsubscribe from this list: send the line "unsubscribe linux-doc" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH 3/3] seccomp: Don't special case audited processes when logging

[Tyler Hicks]

Seccomp logging for "handled" actions such as RET_TRAP, RET_TRACE, or
RET_ERRNO can be very noisy for processes that are being audited. This
patch modifies the seccomp logging behavior to treat processes that are
being inspected via the audit subsystem the same as processes that
aren't under inspection. Handled actions will no longer be logged just
because the process is being inspected. Since v4.14, applications have
the ability to request logging of handled actions by using the
SECCOMP_FILTER_FLAG_LOG flag when loading seccomp filters.

With this patch, the logic for deciding if an action will be logged is:

  if action == RET_ALLOW:
    do not log
  else if action not in actions_logged:
    do not log
  else if action == RET_KILL:
    log
  else if action == RET_LOG:
    log
  else if filter-requests-logging:
    log
  else:
    do not log

Reported-by: Steve Grubb <sgrubb@redhat.com>
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
---
 Documentation/userspace-api/seccomp_filter.rst |  7 -------
 include/linux/audit.h                          | 10 +---------
 kernel/auditsc.c                               |  2 +-
 kernel/seccomp.c                               | 15 +++++----------
 4 files changed, 7 insertions(+), 27 deletions(-)

diff --git a/Documentation/userspace-api/seccomp_filter.rst b/Documentation/userspace-api/seccomp_filter.rst
index 099c412..82a468b 100644
--- a/Documentation/userspace-api/seccomp_filter.rst
+++ b/Documentation/userspace-api/seccomp_filter.rst
@@ -207,13 +207,6 @@ directory. Here's a description of each file in that directory:
 	to the file do not need to be in ordered form but reads from the file
 	will be ordered in the same way as the actions_avail sysctl.
 
-	It is important to note that the value of ``actions_logged`` does not
-	prevent certain actions from being logged when the audit subsystem is
-	configured to audit a task. If the action is not found in
-	``actions_logged`` list, the final decision on whether to audit the
-	action for that task is ultimately left up to the audit subsystem to
-	decide for all seccomp return values other than ``SECCOMP_RET_ALLOW``.
-
 	The ``allow`` string is not accepted in the ``actions_logged`` sysctl
 	as it is not possible to log ``SECCOMP_RET_ALLOW`` actions. Attempting
 	to write ``allow`` to the sysctl will result in an EINVAL being
diff --git a/include/linux/audit.h b/include/linux/audit.h
index b311d7d..1964fbd 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -232,7 +232,7 @@ extern void __audit_file(const struct file *);
 extern void __audit_inode_child(struct inode *parent,
 				const struct dentry *dentry,
 				const unsigned char type);
-extern void __audit_seccomp(unsigned long syscall, long signr, int code);
+extern void audit_seccomp(unsigned long syscall, long signr, int code);
 extern void audit_seccomp_actions_logged(const char *names, int res);
 extern void __audit_ptrace(struct task_struct *t);
 
@@ -303,12 +303,6 @@ static inline void audit_inode_child(struct inode *parent,
 }
 void audit_core_dumps(long signr);
 
-static inline void audit_seccomp(unsigned long syscall, long signr, int code)
-{
-	if (audit_enabled && unlikely(!audit_dummy_context()))
-		__audit_seccomp(syscall, signr, code);
-}
-
 static inline void audit_ptrace(struct task_struct *t)
 {
 	if (unlikely(!audit_dummy_context()))
@@ -499,8 +493,6 @@ static inline void audit_inode_child(struct inode *parent,
 { }
 static inline void audit_core_dumps(long signr)
 { }
-static inline void __audit_seccomp(unsigned long syscall, long signr, int code)
-{ }
 static inline void audit_seccomp(unsigned long syscall, long signr, int code)
 { }
 static inline void audit_seccomp_actions_logged(const char *names, int res)
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 3496238..1e64b91 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -2464,7 +2464,7 @@ void audit_core_dumps(long signr)
 	audit_log_end(ab);
 }
 
-void __audit_seccomp(unsigned long syscall, long signr, int code)
+void audit_seccomp(unsigned long syscall, long signr, int code)
 {
 	struct audit_buffer *ab;
 
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index e28ddcc..947cc0f 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -584,18 +584,13 @@ static inline void seccomp_log(unsigned long syscall, long signr, u32 action,
 	}
 
 	/*
-	 * Force an audit message to be emitted when the action is RET_KILL_*,
-	 * RET_LOG, or the FILTER_FLAG_LOG bit was set and the action is
-	 * allowed to be logged by the admin.
+	 * Emit an audit message when the action is RET_KILL_*, RET_LOG, or the
+	 * FILTER_FLAG_LOG bit was set. The admin has the ability to silence
+	 * any action from being logged by removing the action name from the
+	 * seccomp_actions_logged sysctl.
 	 */
 	if (log)
-		return __audit_seccomp(syscall, signr, action);
-
-	/*
-	 * Let the audit subsystem decide if the action should be audited based
-	 * on whether the current task itself is being audited.
-	 */
-	return audit_seccomp(syscall, signr, action);
+		audit_seccomp(syscall, signr, action);
 }
 
 /*
-- 
2.7.4

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH 2/3] seccomp: Audit attempts to modify the actions_logged sysctl

[Paul Moore]

On Fri, Apr 27, 2018 at 3:16 PM, Tyler Hicks <tyhicks@canonical.com> wrote:
> The decision to log a seccomp action will always be subject to the
> value of the kernel.seccomp.actions_logged sysctl, even for processes
> that are being inspected via the audit subsystem, in an upcoming patch.
> Therefore, we need to emit an audit record on attempts at writing to the
> actions_logged sysctl when auditing is enabled.
>
> This patch updates the write handler for the actions_logged sysctl to
> emit an audit record on attempts to write to the sysctl. Successful
> writes to the sysctl will result in a record that includes a normalized
> list of logged actions in the "actions" field and a "res" field equal to
> 0. Unsuccessful writes to the sysctl will result in a record that
> doesn't include the "actions" field and has a "res" field equal to 1.
>
> Not all unsuccessful writes to the sysctl are audited. For example, an
> audit record will not be emitted if an unprivileged process attempts to
> open the sysctl file for reading since that access control check is not
> part of the sysctl's write handler.
>
> Below are some example audit records when writing various strings to the
> actions_logged sysctl.
>
> Writing "not-a-real-action" emits:
>
>  type=CONFIG_CHANGE msg=audit(1524600971.363:119): pid=1651 uid=0
>  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
>  op=seccomp-logging res=1
>
> Writing "kill_process kill_thread errno trace log" emits:
>
>  type=CONFIG_CHANGE msg=audit(1524601023.982:131): pid=1658 uid=0
>  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
>  op=seccomp-logging actions="kill_process kill_thread errno trace log"
>  res=0

I've got some additional comments regarding the fields in the code
below, but it would be good to hear Steve comment on the "actions"
field since his userspace tools are extremely picky about what they
will accept.  It looks like you are treating the actions as an
untrusted string, which is good, so I suspect you are okay, but still
...

> Writing the string "log log errno trace kill_process kill_thread", which
> is unordered and contains the log action twice, results in the same
> value as the previous example for the actions field:
>
>  type=CONFIG_CHANGE msg=audit(1524601204.365:152): pid=1704 uid=0
>  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
>  op=seccomp-logging actions="kill_process kill_thread errno trace log"
>  res=0
>
> No audit records are generated when reading the actions_logged sysctl.
>
> Suggested-by: Steve Grubb <sgrubb@redhat.com>
> Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
> ---
>  include/linux/audit.h |  3 +++
>  kernel/auditsc.c      | 37 +++++++++++++++++++++++++++++++++++++
>  kernel/seccomp.c      | 43 ++++++++++++++++++++++++++++++++++---------
>  3 files changed, 74 insertions(+), 9 deletions(-)

...

> diff --git a/include/linux/audit.h b/include/linux/audit.h
> index 75d5b03..b311d7d 100644
> --- a/include/linux/audit.h
> +++ b/include/linux/audit.h
> @@ -233,6 +233,7 @@ extern void __audit_inode_child(struct inode *parent,
>                                 const struct dentry *dentry,
>                                 const unsigned char type);
>  extern void __audit_seccomp(unsigned long syscall, long signr, int code);
> +extern void audit_seccomp_actions_logged(const char *names, int res);
>  extern void __audit_ptrace(struct task_struct *t);
>
>  static inline bool audit_dummy_context(void)
> @@ -502,6 +503,8 @@ static inline void __audit_seccomp(unsigned long syscall, long signr, int code)
>  { }
>  static inline void audit_seccomp(unsigned long syscall, long signr, int code)
>  { }
> +static inline void audit_seccomp_actions_logged(const char *names, int res)
> +{ }
>  static inline int auditsc_get_stamp(struct audit_context *ctx,
>                               struct timespec64 *t, unsigned int *serial)
>  {
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index 4e0a4ac..3496238 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -2478,6 +2478,43 @@ void __audit_seccomp(unsigned long syscall, long signr, int code)
>         audit_log_end(ab);
>  }
>
> +void audit_seccomp_actions_logged(const char *names, int res)
> +{
> +       struct tty_struct *tty;
> +       const struct cred *cred;
> +       struct audit_buffer *ab;
> +       char comm[sizeof(current->comm)];
> +
> +       if (!audit_enabled)
> +               return;
> +
> +       ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
> +       if (unlikely(!ab))
> +               return;

Instead of NULL, let's pass current->audit_context to
audit_log_start().  Yes, most of the AUDIT_CONFIG_CHANGE users pass
NULL but all of that is going to need to change because of 1) the
audit container ID work and 2) it makes sense to connect records that
are related.  Let's do it right the first time here :)

> +       cred = current_cred();
> +       tty = audit_get_tty(current);
> +       audit_log_format(ab, "pid=%d uid=%u auid=%u tty=%s ses=%u",
> +                        task_tgid_nr(current),
> +                        from_kuid(&init_user_ns, cred->uid),
> +                        from_kuid(&init_user_ns,
> +                        audit_get_loginuid(current)),
> +                        tty ? tty_name(tty) : "(none)",
> +                        audit_get_sessionid(current));
> +       audit_put_tty(tty);
> +       audit_log_task_context(ab);
> +       audit_log_format(ab, " comm=");
> +       audit_log_untrustedstring(ab, get_task_comm(comm, current));
> +       audit_log_d_path_exe(ab, current->mm);
> +       audit_log_format(ab, " op=seccomp-logging");
> +       if (names)
> +               audit_log_format(ab, " actions=\"%s\"", names);
> +
> +       audit_log_format(ab, " res=%d", res);
> +       audit_log_end(ab);

One of the benefits of using current->audit_context is that we get a
lot of this info from the associated SYSCALL record (assuming the
admin isn't filtering that, e.g. Fedora defaults).  We can safely drop
most everything except for the "op" and "actions" fields.

Steve might also want an "old-actions" field, but I'll let him speak to that.

-- 
paul moore
www.paul-moore.com

Re: [PATCH 2/3] seccomp: Audit attempts to modify the actions_logged sysctl

[Paul Moore]

On Fri, Apr 27, 2018 at 3:16 PM, Tyler Hicks <tyhicks@canonical.com> wrote:
> The decision to log a seccomp action will always be subject to the
> value of the kernel.seccomp.actions_logged sysctl, even for processes
> that are being inspected via the audit subsystem, in an upcoming patch.
> Therefore, we need to emit an audit record on attempts at writing to the
> actions_logged sysctl when auditing is enabled.
>
> This patch updates the write handler for the actions_logged sysctl to
> emit an audit record on attempts to write to the sysctl. Successful
> writes to the sysctl will result in a record that includes a normalized
> list of logged actions in the "actions" field and a "res" field equal to
> 0. Unsuccessful writes to the sysctl will result in a record that
> doesn't include the "actions" field and has a "res" field equal to 1.
>
> Not all unsuccessful writes to the sysctl are audited. For example, an
> audit record will not be emitted if an unprivileged process attempts to
> open the sysctl file for reading since that access control check is not
> part of the sysctl's write handler.
>
> Below are some example audit records when writing various strings to the
> actions_logged sysctl.
>
> Writing "not-a-real-action" emits:
>
>  type=CONFIG_CHANGE msg=audit(1524600971.363:119): pid=1651 uid=0
>  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
>  op=seccomp-logging res=1
>
> Writing "kill_process kill_thread errno trace log" emits:
>
>  type=CONFIG_CHANGE msg=audit(1524601023.982:131): pid=1658 uid=0
>  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
>  op=seccomp-logging actions="kill_process kill_thread errno trace log"
>  res=0

I've got some additional comments regarding the fields in the code
below, but it would be good to hear Steve comment on the "actions"
field since his userspace tools are extremely picky about what they
will accept.  It looks like you are treating the actions as an
untrusted string, which is good, so I suspect you are okay, but still
...

> Writing the string "log log errno trace kill_process kill_thread", which
> is unordered and contains the log action twice, results in the same
> value as the previous example for the actions field:
>
>  type=CONFIG_CHANGE msg=audit(1524601204.365:152): pid=1704 uid=0
>  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
>  op=seccomp-logging actions="kill_process kill_thread errno trace log"
>  res=0
>
> No audit records are generated when reading the actions_logged sysctl.
>
> Suggested-by: Steve Grubb <sgrubb@redhat.com>
> Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
> ---
>  include/linux/audit.h |  3 +++
>  kernel/auditsc.c      | 37 +++++++++++++++++++++++++++++++++++++
>  kernel/seccomp.c      | 43 ++++++++++++++++++++++++++++++++++---------
>  3 files changed, 74 insertions(+), 9 deletions(-)

...

> diff --git a/include/linux/audit.h b/include/linux/audit.h
> index 75d5b03..b311d7d 100644
> --- a/include/linux/audit.h
> +++ b/include/linux/audit.h
> @@ -233,6 +233,7 @@ extern void __audit_inode_child(struct inode *parent,
>                                 const struct dentry *dentry,
>                                 const unsigned char type);
>  extern void __audit_seccomp(unsigned long syscall, long signr, int code);
> +extern void audit_seccomp_actions_logged(const char *names, int res);
>  extern void __audit_ptrace(struct task_struct *t);
>
>  static inline bool audit_dummy_context(void)
> @@ -502,6 +503,8 @@ static inline void __audit_seccomp(unsigned long syscall, long signr, int code)
>  { }
>  static inline void audit_seccomp(unsigned long syscall, long signr, int code)
>  { }
> +static inline void audit_seccomp_actions_logged(const char *names, int res)
> +{ }
>  static inline int auditsc_get_stamp(struct audit_context *ctx,
>                               struct timespec64 *t, unsigned int *serial)
>  {
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index 4e0a4ac..3496238 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -2478,6 +2478,43 @@ void __audit_seccomp(unsigned long syscall, long signr, int code)
>         audit_log_end(ab);
>  }
>
> +void audit_seccomp_actions_logged(const char *names, int res)
> +{
> +       struct tty_struct *tty;
> +       const struct cred *cred;
> +       struct audit_buffer *ab;
> +       char comm[sizeof(current->comm)];
> +
> +       if (!audit_enabled)
> +               return;
> +
> +       ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
> +       if (unlikely(!ab))
> +               return;

Instead of NULL, let's pass current->audit_context to
audit_log_start().  Yes, most of the AUDIT_CONFIG_CHANGE users pass
NULL but all of that is going to need to change because of 1) the
audit container ID work and 2) it makes sense to connect records that
are related.  Let's do it right the first time here :)

> +       cred = current_cred();
> +       tty = audit_get_tty(current);
> +       audit_log_format(ab, "pid=%d uid=%u auid=%u tty=%s ses=%u",
> +                        task_tgid_nr(current),
> +                        from_kuid(&init_user_ns, cred->uid),
> +                        from_kuid(&init_user_ns,
> +                        audit_get_loginuid(current)),
> +                        tty ? tty_name(tty) : "(none)",
> +                        audit_get_sessionid(current));
> +       audit_put_tty(tty);
> +       audit_log_task_context(ab);
> +       audit_log_format(ab, " comm=");
> +       audit_log_untrustedstring(ab, get_task_comm(comm, current));
> +       audit_log_d_path_exe(ab, current->mm);
> +       audit_log_format(ab, " op=seccomp-logging");
> +       if (names)
> +               audit_log_format(ab, " actions=\"%s\"", names);
> +
> +       audit_log_format(ab, " res=%d", res);
> +       audit_log_end(ab);

One of the benefits of using current->audit_context is that we get a
lot of this info from the associated SYSCALL record (assuming the
admin isn't filtering that, e.g. Fedora defaults).  We can safely drop
most everything except for the "op" and "actions" fields.

Steve might also want an "old-actions" field, but I'll let him speak to that.

-- 
paul moore
www.paul-moore.com
--
To unsubscribe from this list: send the line "unsubscribe linux-doc" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH 2/3] seccomp: Audit attempts to modify the actions_logged sysctl

[Paul Moore]

On Fri, Apr 27, 2018 at 3:16 PM, Tyler Hicks <tyhicks@canonical.com> wrote:
> The decision to log a seccomp action will always be subject to the
> value of the kernel.seccomp.actions_logged sysctl, even for processes
> that are being inspected via the audit subsystem, in an upcoming patch.
> Therefore, we need to emit an audit record on attempts at writing to the
> actions_logged sysctl when auditing is enabled.
>
> This patch updates the write handler for the actions_logged sysctl to
> emit an audit record on attempts to write to the sysctl. Successful
> writes to the sysctl will result in a record that includes a normalized
> list of logged actions in the "actions" field and a "res" field equal to
> 0. Unsuccessful writes to the sysctl will result in a record that
> doesn't include the "actions" field and has a "res" field equal to 1.
>
> Not all unsuccessful writes to the sysctl are audited. For example, an
> audit record will not be emitted if an unprivileged process attempts to
> open the sysctl file for reading since that access control check is not
> part of the sysctl's write handler.
>
> Below are some example audit records when writing various strings to the
> actions_logged sysctl.
>
> Writing "not-a-real-action" emits:
>
>  type=CONFIG_CHANGE msg=audit(1524600971.363:119): pid=1651 uid=0
>  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
>  op=seccomp-logging res=1
>
> Writing "kill_process kill_thread errno trace log" emits:
>
>  type=CONFIG_CHANGE msg=audit(1524601023.982:131): pid=1658 uid=0
>  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
>  op=seccomp-logging actions="kill_process kill_thread errno trace log"
>  res=0

I've got some additional comments regarding the fields in the code
below, but it would be good to hear Steve comment on the "actions"
field since his userspace tools are extremely picky about what they
will accept.  It looks like you are treating the actions as an
untrusted string, which is good, so I suspect you are okay, but still
...

> Writing the string "log log errno trace kill_process kill_thread", which
> is unordered and contains the log action twice, results in the same
> value as the previous example for the actions field:
>
>  type=CONFIG_CHANGE msg=audit(1524601204.365:152): pid=1704 uid=0
>  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
>  op=seccomp-logging actions="kill_process kill_thread errno trace log"
>  res=0
>
> No audit records are generated when reading the actions_logged sysctl.
>
> Suggested-by: Steve Grubb <sgrubb@redhat.com>
> Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
> ---
>  include/linux/audit.h |  3 +++
>  kernel/auditsc.c      | 37 +++++++++++++++++++++++++++++++++++++
>  kernel/seccomp.c      | 43 ++++++++++++++++++++++++++++++++++---------
>  3 files changed, 74 insertions(+), 9 deletions(-)

...

> diff --git a/include/linux/audit.h b/include/linux/audit.h
> index 75d5b03..b311d7d 100644
> --- a/include/linux/audit.h
> +++ b/include/linux/audit.h
> @@ -233,6 +233,7 @@ extern void __audit_inode_child(struct inode *parent,
>                                 const struct dentry *dentry,
>                                 const unsigned char type);
>  extern void __audit_seccomp(unsigned long syscall, long signr, int code);
> +extern void audit_seccomp_actions_logged(const char *names, int res);
>  extern void __audit_ptrace(struct task_struct *t);
>
>  static inline bool audit_dummy_context(void)
> @@ -502,6 +503,8 @@ static inline void __audit_seccomp(unsigned long syscall, long signr, int code)
>  { }
>  static inline void audit_seccomp(unsigned long syscall, long signr, int code)
>  { }
> +static inline void audit_seccomp_actions_logged(const char *names, int res)
> +{ }
>  static inline int auditsc_get_stamp(struct audit_context *ctx,
>                               struct timespec64 *t, unsigned int *serial)
>  {
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index 4e0a4ac..3496238 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -2478,6 +2478,43 @@ void __audit_seccomp(unsigned long syscall, long signr, int code)
>         audit_log_end(ab);
>  }
>
> +void audit_seccomp_actions_logged(const char *names, int res)
> +{
> +       struct tty_struct *tty;
> +       const struct cred *cred;
> +       struct audit_buffer *ab;
> +       char comm[sizeof(current->comm)];
> +
> +       if (!audit_enabled)
> +               return;
> +
> +       ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
> +       if (unlikely(!ab))
> +               return;

Instead of NULL, let's pass current->audit_context to
audit_log_start().  Yes, most of the AUDIT_CONFIG_CHANGE users pass
NULL but all of that is going to need to change because of 1) the
audit container ID work and 2) it makes sense to connect records that
are related.  Let's do it right the first time here :)

> +       cred = current_cred();
> +       tty = audit_get_tty(current);
> +       audit_log_format(ab, "pid=%d uid=%u auid=%u tty=%s ses=%u",
> +                        task_tgid_nr(current),
> +                        from_kuid(&init_user_ns, cred->uid),
> +                        from_kuid(&init_user_ns,
> +                        audit_get_loginuid(current)),
> +                        tty ? tty_name(tty) : "(none)",
> +                        audit_get_sessionid(current));
> +       audit_put_tty(tty);
> +       audit_log_task_context(ab);
> +       audit_log_format(ab, " comm=");
> +       audit_log_untrustedstring(ab, get_task_comm(comm, current));
> +       audit_log_d_path_exe(ab, current->mm);
> +       audit_log_format(ab, " op=seccomp-logging");
> +       if (names)
> +               audit_log_format(ab, " actions=\"%s\"", names);
> +
> +       audit_log_format(ab, " res=%d", res);
> +       audit_log_end(ab);

One of the benefits of using current->audit_context is that we get a
lot of this info from the associated SYSCALL record (assuming the
admin isn't filtering that, e.g. Fedora defaults).  We can safely drop
most everything except for the "op" and "actions" fields.

Steve might also want an "old-actions" field, but I'll let him speak to that.

-- 
paul moore
www.paul-moore.com
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH 3/3] seccomp: Don't special case audited processes when logging

[Paul Moore]

On Fri, Apr 27, 2018 at 3:16 PM, Tyler Hicks <tyhicks@canonical.com> wrote:
> Seccomp logging for "handled" actions such as RET_TRAP, RET_TRACE, or
> RET_ERRNO can be very noisy for processes that are being audited. This
> patch modifies the seccomp logging behavior to treat processes that are
> being inspected via the audit subsystem the same as processes that
> aren't under inspection. Handled actions will no longer be logged just
> because the process is being inspected. Since v4.14, applications have
> the ability to request logging of handled actions by using the
> SECCOMP_FILTER_FLAG_LOG flag when loading seccomp filters.
>
> With this patch, the logic for deciding if an action will be logged is:
>
>   if action == RET_ALLOW:
>     do not log
>   else if action not in actions_logged:
>     do not log
>   else if action == RET_KILL:
>     log
>   else if action == RET_LOG:
>     log
>   else if filter-requests-logging:
>     log
>   else:
>     do not log
>
> Reported-by: Steve Grubb <sgrubb@redhat.com>
> Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
> ---
>  Documentation/userspace-api/seccomp_filter.rst |  7 -------
>  include/linux/audit.h                          | 10 +---------
>  kernel/auditsc.c                               |  2 +-
>  kernel/seccomp.c                               | 15 +++++----------
>  4 files changed, 7 insertions(+), 27 deletions(-)
>
> diff --git a/Documentation/userspace-api/seccomp_filter.rst b/Documentation/userspace-api/seccomp_filter.rst
> index 099c412..82a468b 100644
> --- a/Documentation/userspace-api/seccomp_filter.rst
> +++ b/Documentation/userspace-api/seccomp_filter.rst
> @@ -207,13 +207,6 @@ directory. Here's a description of each file in that directory:
>         to the file do not need to be in ordered form but reads from the file
>         will be ordered in the same way as the actions_avail sysctl.
>
> -       It is important to note that the value of ``actions_logged`` does not
> -       prevent certain actions from being logged when the audit subsystem is
> -       configured to audit a task. If the action is not found in
> -       ``actions_logged`` list, the final decision on whether to audit the
> -       action for that task is ultimately left up to the audit subsystem to
> -       decide for all seccomp return values other than ``SECCOMP_RET_ALLOW``.
> -
>         The ``allow`` string is not accepted in the ``actions_logged`` sysctl
>         as it is not possible to log ``SECCOMP_RET_ALLOW`` actions. Attempting
>         to write ``allow`` to the sysctl will result in an EINVAL being
> diff --git a/include/linux/audit.h b/include/linux/audit.h
> index b311d7d..1964fbd 100644
> --- a/include/linux/audit.h
> +++ b/include/linux/audit.h
> @@ -232,7 +232,7 @@ extern void __audit_file(const struct file *);
>  extern void __audit_inode_child(struct inode *parent,
>                                 const struct dentry *dentry,
>                                 const unsigned char type);
> -extern void __audit_seccomp(unsigned long syscall, long signr, int code);
> +extern void audit_seccomp(unsigned long syscall, long signr, int code);
>  extern void audit_seccomp_actions_logged(const char *names, int res);
>  extern void __audit_ptrace(struct task_struct *t);
>
> @@ -303,12 +303,6 @@ static inline void audit_inode_child(struct inode *parent,
>  }
>  void audit_core_dumps(long signr);
>
> -static inline void audit_seccomp(unsigned long syscall, long signr, int code)
> -{
> -       if (audit_enabled && unlikely(!audit_dummy_context()))
> -               __audit_seccomp(syscall, signr, code);
> -}
> -
>  static inline void audit_ptrace(struct task_struct *t)
>  {
>         if (unlikely(!audit_dummy_context()))
> @@ -499,8 +493,6 @@ static inline void audit_inode_child(struct inode *parent,
>  { }
>  static inline void audit_core_dumps(long signr)
>  { }
> -static inline void __audit_seccomp(unsigned long syscall, long signr, int code)
> -{ }
>  static inline void audit_seccomp(unsigned long syscall, long signr, int code)
>  { }
>  static inline void audit_seccomp_actions_logged(const char *names, int res)
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index 3496238..1e64b91 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -2464,7 +2464,7 @@ void audit_core_dumps(long signr)
>         audit_log_end(ab);
>  }
>
> -void __audit_seccomp(unsigned long syscall, long signr, int code)
> +void audit_seccomp(unsigned long syscall, long signr, int code)
>  {
>         struct audit_buffer *ab;

Since it is a bit unusual, it might be nice to add a comment at the
top of audit_seccomp() that the event filtering is being done in the
seccomp_log() function, and we may need to force auditing independent
of the audit_enabled and dummy context state.

> diff --git a/kernel/seccomp.c b/kernel/seccomp.c
> index e28ddcc..947cc0f 100644
> --- a/kernel/seccomp.c
> +++ b/kernel/seccomp.c
> @@ -584,18 +584,13 @@ static inline void seccomp_log(unsigned long syscall, long signr, u32 action,
>         }
>
>         /*
> -        * Force an audit message to be emitted when the action is RET_KILL_*,
> -        * RET_LOG, or the FILTER_FLAG_LOG bit was set and the action is
> -        * allowed to be logged by the admin.
> +        * Emit an audit message when the action is RET_KILL_*, RET_LOG, or the
> +        * FILTER_FLAG_LOG bit was set. The admin has the ability to silence
> +        * any action from being logged by removing the action name from the
> +        * seccomp_actions_logged sysctl.
>          */
>         if (log)
> -               return __audit_seccomp(syscall, signr, action);
> -
> -       /*
> -        * Let the audit subsystem decide if the action should be audited based
> -        * on whether the current task itself is being audited.
> -        */
> -       return audit_seccomp(syscall, signr, action);
> +               audit_seccomp(syscall, signr, action);
>  }
>
>  /*
> --
> 2.7.4
>



-- 
paul moore
www.paul-moore.com

Re: [PATCH 3/3] seccomp: Don't special case audited processes when logging

[Paul Moore]

On Fri, Apr 27, 2018 at 3:16 PM, Tyler Hicks <tyhicks@canonical.com> wrote:
> Seccomp logging for "handled" actions such as RET_TRAP, RET_TRACE, or
> RET_ERRNO can be very noisy for processes that are being audited. This
> patch modifies the seccomp logging behavior to treat processes that are
> being inspected via the audit subsystem the same as processes that
> aren't under inspection. Handled actions will no longer be logged just
> because the process is being inspected. Since v4.14, applications have
> the ability to request logging of handled actions by using the
> SECCOMP_FILTER_FLAG_LOG flag when loading seccomp filters.
>
> With this patch, the logic for deciding if an action will be logged is:
>
>   if action == RET_ALLOW:
>     do not log
>   else if action not in actions_logged:
>     do not log
>   else if action == RET_KILL:
>     log
>   else if action == RET_LOG:
>     log
>   else if filter-requests-logging:
>     log
>   else:
>     do not log
>
> Reported-by: Steve Grubb <sgrubb@redhat.com>
> Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
> ---
>  Documentation/userspace-api/seccomp_filter.rst |  7 -------
>  include/linux/audit.h                          | 10 +---------
>  kernel/auditsc.c                               |  2 +-
>  kernel/seccomp.c                               | 15 +++++----------
>  4 files changed, 7 insertions(+), 27 deletions(-)
>
> diff --git a/Documentation/userspace-api/seccomp_filter.rst b/Documentation/userspace-api/seccomp_filter.rst
> index 099c412..82a468b 100644
> --- a/Documentation/userspace-api/seccomp_filter.rst
> +++ b/Documentation/userspace-api/seccomp_filter.rst
> @@ -207,13 +207,6 @@ directory. Here's a description of each file in that directory:
>         to the file do not need to be in ordered form but reads from the file
>         will be ordered in the same way as the actions_avail sysctl.
>
> -       It is important to note that the value of ``actions_logged`` does not
> -       prevent certain actions from being logged when the audit subsystem is
> -       configured to audit a task. If the action is not found in
> -       ``actions_logged`` list, the final decision on whether to audit the
> -       action for that task is ultimately left up to the audit subsystem to
> -       decide for all seccomp return values other than ``SECCOMP_RET_ALLOW``.
> -
>         The ``allow`` string is not accepted in the ``actions_logged`` sysctl
>         as it is not possible to log ``SECCOMP_RET_ALLOW`` actions. Attempting
>         to write ``allow`` to the sysctl will result in an EINVAL being
> diff --git a/include/linux/audit.h b/include/linux/audit.h
> index b311d7d..1964fbd 100644
> --- a/include/linux/audit.h
> +++ b/include/linux/audit.h
> @@ -232,7 +232,7 @@ extern void __audit_file(const struct file *);
>  extern void __audit_inode_child(struct inode *parent,
>                                 const struct dentry *dentry,
>                                 const unsigned char type);
> -extern void __audit_seccomp(unsigned long syscall, long signr, int code);
> +extern void audit_seccomp(unsigned long syscall, long signr, int code);
>  extern void audit_seccomp_actions_logged(const char *names, int res);
>  extern void __audit_ptrace(struct task_struct *t);
>
> @@ -303,12 +303,6 @@ static inline void audit_inode_child(struct inode *parent,
>  }
>  void audit_core_dumps(long signr);
>
> -static inline void audit_seccomp(unsigned long syscall, long signr, int code)
> -{
> -       if (audit_enabled && unlikely(!audit_dummy_context()))
> -               __audit_seccomp(syscall, signr, code);
> -}
> -
>  static inline void audit_ptrace(struct task_struct *t)
>  {
>         if (unlikely(!audit_dummy_context()))
> @@ -499,8 +493,6 @@ static inline void audit_inode_child(struct inode *parent,
>  { }
>  static inline void audit_core_dumps(long signr)
>  { }
> -static inline void __audit_seccomp(unsigned long syscall, long signr, int code)
> -{ }
>  static inline void audit_seccomp(unsigned long syscall, long signr, int code)
>  { }
>  static inline void audit_seccomp_actions_logged(const char *names, int res)
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index 3496238..1e64b91 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -2464,7 +2464,7 @@ void audit_core_dumps(long signr)
>         audit_log_end(ab);
>  }
>
> -void __audit_seccomp(unsigned long syscall, long signr, int code)
> +void audit_seccomp(unsigned long syscall, long signr, int code)
>  {
>         struct audit_buffer *ab;

Since it is a bit unusual, it might be nice to add a comment at the
top of audit_seccomp() that the event filtering is being done in the
seccomp_log() function, and we may need to force auditing independent
of the audit_enabled and dummy context state.

> diff --git a/kernel/seccomp.c b/kernel/seccomp.c
> index e28ddcc..947cc0f 100644
> --- a/kernel/seccomp.c
> +++ b/kernel/seccomp.c
> @@ -584,18 +584,13 @@ static inline void seccomp_log(unsigned long syscall, long signr, u32 action,
>         }
>
>         /*
> -        * Force an audit message to be emitted when the action is RET_KILL_*,
> -        * RET_LOG, or the FILTER_FLAG_LOG bit was set and the action is
> -        * allowed to be logged by the admin.
> +        * Emit an audit message when the action is RET_KILL_*, RET_LOG, or the
> +        * FILTER_FLAG_LOG bit was set. The admin has the ability to silence
> +        * any action from being logged by removing the action name from the
> +        * seccomp_actions_logged sysctl.
>          */
>         if (log)
> -               return __audit_seccomp(syscall, signr, action);
> -
> -       /*
> -        * Let the audit subsystem decide if the action should be audited based
> -        * on whether the current task itself is being audited.
> -        */
> -       return audit_seccomp(syscall, signr, action);
> +               audit_seccomp(syscall, signr, action);
>  }
>
>  /*
> --
> 2.7.4
>



-- 
paul moore
www.paul-moore.com
--
To unsubscribe from this list: send the line "unsubscribe linux-doc" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH 3/3] seccomp: Don't special case audited processes when logging

[Paul Moore]

On Fri, Apr 27, 2018 at 3:16 PM, Tyler Hicks <tyhicks@canonical.com> wrote:
> Seccomp logging for "handled" actions such as RET_TRAP, RET_TRACE, or
> RET_ERRNO can be very noisy for processes that are being audited. This
> patch modifies the seccomp logging behavior to treat processes that are
> being inspected via the audit subsystem the same as processes that
> aren't under inspection. Handled actions will no longer be logged just
> because the process is being inspected. Since v4.14, applications have
> the ability to request logging of handled actions by using the
> SECCOMP_FILTER_FLAG_LOG flag when loading seccomp filters.
>
> With this patch, the logic for deciding if an action will be logged is:
>
>   if action == RET_ALLOW:
>     do not log
>   else if action not in actions_logged:
>     do not log
>   else if action == RET_KILL:
>     log
>   else if action == RET_LOG:
>     log
>   else if filter-requests-logging:
>     log
>   else:
>     do not log
>
> Reported-by: Steve Grubb <sgrubb@redhat.com>
> Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
> ---
>  Documentation/userspace-api/seccomp_filter.rst |  7 -------
>  include/linux/audit.h                          | 10 +---------
>  kernel/auditsc.c                               |  2 +-
>  kernel/seccomp.c                               | 15 +++++----------
>  4 files changed, 7 insertions(+), 27 deletions(-)
>
> diff --git a/Documentation/userspace-api/seccomp_filter.rst b/Documentation/userspace-api/seccomp_filter.rst
> index 099c412..82a468b 100644
> --- a/Documentation/userspace-api/seccomp_filter.rst
> +++ b/Documentation/userspace-api/seccomp_filter.rst
> @@ -207,13 +207,6 @@ directory. Here's a description of each file in that directory:
>         to the file do not need to be in ordered form but reads from the file
>         will be ordered in the same way as the actions_avail sysctl.
>
> -       It is important to note that the value of ``actions_logged`` does not
> -       prevent certain actions from being logged when the audit subsystem is
> -       configured to audit a task. If the action is not found in
> -       ``actions_logged`` list, the final decision on whether to audit the
> -       action for that task is ultimately left up to the audit subsystem to
> -       decide for all seccomp return values other than ``SECCOMP_RET_ALLOW``.
> -
>         The ``allow`` string is not accepted in the ``actions_logged`` sysctl
>         as it is not possible to log ``SECCOMP_RET_ALLOW`` actions. Attempting
>         to write ``allow`` to the sysctl will result in an EINVAL being
> diff --git a/include/linux/audit.h b/include/linux/audit.h
> index b311d7d..1964fbd 100644
> --- a/include/linux/audit.h
> +++ b/include/linux/audit.h
> @@ -232,7 +232,7 @@ extern void __audit_file(const struct file *);
>  extern void __audit_inode_child(struct inode *parent,
>                                 const struct dentry *dentry,
>                                 const unsigned char type);
> -extern void __audit_seccomp(unsigned long syscall, long signr, int code);
> +extern void audit_seccomp(unsigned long syscall, long signr, int code);
>  extern void audit_seccomp_actions_logged(const char *names, int res);
>  extern void __audit_ptrace(struct task_struct *t);
>
> @@ -303,12 +303,6 @@ static inline void audit_inode_child(struct inode *parent,
>  }
>  void audit_core_dumps(long signr);
>
> -static inline void audit_seccomp(unsigned long syscall, long signr, int code)
> -{
> -       if (audit_enabled && unlikely(!audit_dummy_context()))
> -               __audit_seccomp(syscall, signr, code);
> -}
> -
>  static inline void audit_ptrace(struct task_struct *t)
>  {
>         if (unlikely(!audit_dummy_context()))
> @@ -499,8 +493,6 @@ static inline void audit_inode_child(struct inode *parent,
>  { }
>  static inline void audit_core_dumps(long signr)
>  { }
> -static inline void __audit_seccomp(unsigned long syscall, long signr, int code)
> -{ }
>  static inline void audit_seccomp(unsigned long syscall, long signr, int code)
>  { }
>  static inline void audit_seccomp_actions_logged(const char *names, int res)
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index 3496238..1e64b91 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -2464,7 +2464,7 @@ void audit_core_dumps(long signr)
>         audit_log_end(ab);
>  }
>
> -void __audit_seccomp(unsigned long syscall, long signr, int code)
> +void audit_seccomp(unsigned long syscall, long signr, int code)
>  {
>         struct audit_buffer *ab;

Since it is a bit unusual, it might be nice to add a comment at the
top of audit_seccomp() that the event filtering is being done in the
seccomp_log() function, and we may need to force auditing independent
of the audit_enabled and dummy context state.

> diff --git a/kernel/seccomp.c b/kernel/seccomp.c
> index e28ddcc..947cc0f 100644
> --- a/kernel/seccomp.c
> +++ b/kernel/seccomp.c
> @@ -584,18 +584,13 @@ static inline void seccomp_log(unsigned long syscall, long signr, u32 action,
>         }
>
>         /*
> -        * Force an audit message to be emitted when the action is RET_KILL_*,
> -        * RET_LOG, or the FILTER_FLAG_LOG bit was set and the action is
> -        * allowed to be logged by the admin.
> +        * Emit an audit message when the action is RET_KILL_*, RET_LOG, or the
> +        * FILTER_FLAG_LOG bit was set. The admin has the ability to silence
> +        * any action from being logged by removing the action name from the
> +        * seccomp_actions_logged sysctl.
>          */
>         if (log)
> -               return __audit_seccomp(syscall, signr, action);
> -
> -       /*
> -        * Let the audit subsystem decide if the action should be audited based
> -        * on whether the current task itself is being audited.
> -        */
> -       return audit_seccomp(syscall, signr, action);
> +               audit_seccomp(syscall, signr, action);
>  }
>
>  /*
> --
> 2.7.4
>



-- 
paul moore
www.paul-moore.com
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH 2/3] seccomp: Audit attempts to modify the actions_logged sysctl

[Steve Grubb]

On Tuesday, May 1, 2018 11:18:55 AM EDT Paul Moore wrote:
> On Fri, Apr 27, 2018 at 3:16 PM, Tyler Hicks <tyhicks@canonical.com> wrote:
> > The decision to log a seccomp action will always be subject to the
> > value of the kernel.seccomp.actions_logged sysctl, even for processes
> > that are being inspected via the audit subsystem, in an upcoming patch.
> > Therefore, we need to emit an audit record on attempts at writing to the
> > actions_logged sysctl when auditing is enabled.
> > 
> > This patch updates the write handler for the actions_logged sysctl to
> > emit an audit record on attempts to write to the sysctl. Successful
> > writes to the sysctl will result in a record that includes a normalized
> > list of logged actions in the "actions" field and a "res" field equal to
> > 0. Unsuccessful writes to the sysctl will result in a record that
> > doesn't include the "actions" field and has a "res" field equal to 1.
> > 
> > Not all unsuccessful writes to the sysctl are audited. For example, an
> > audit record will not be emitted if an unprivileged process attempts to
> > open the sysctl file for reading since that access control check is not
> > part of the sysctl's write handler.
> > 
> > Below are some example audit records when writing various strings to the
> > actions_logged sysctl.
> > 
> > Writing "not-a-real-action" emits:
> >  type=CONFIG_CHANGE msg=audit(1524600971.363:119): pid=1651 uid=0
> >  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
> >  op=seccomp-logging res=1
> > 
> > Writing "kill_process kill_thread errno trace log" emits:
> >  type=CONFIG_CHANGE msg=audit(1524601023.982:131): pid=1658 uid=0
> >  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
> >  op=seccomp-logging actions="kill_process kill_thread errno trace log"
> >  res=0
> 
> I've got some additional comments regarding the fields in the code
> below, but it would be good to hear Steve comment on the "actions"
> field since his userspace tools are extremely picky about what they
> will accept.

Its not that the audit user space applications are picky, its that we have a 
coding standard that everyone needs to abide by so that any parser coded to 
the specification works. In short, we should not have spaces inside the "" 
because that can trick a naive parser. What we typically do in a situation 
like this is add a comma as a separator. But having "" means that the value 
is untrusted and subject to escaping. I don't think that is the case here. 
Output is not controlled by the user. Its a list of well known names.

> It looks like you are treating the actions as an untrusted string, which is
> good, so I suspect you are okay, but still

The function below that logs names is calling audit_log_format which does not 
handle untrusted strings. I would suggest not treating it as an untrusted 
string, but as a string with no spaces in it. 

actions=kill_process,kill_thread,errno,trace,log


> > Writing the string "log log errno trace kill_process kill_thread", which
> > is unordered and contains the log action twice, results in the same
> > 
> > value as the previous example for the actions field:
> >  type=CONFIG_CHANGE msg=audit(1524601204.365:152): pid=1704 uid=0
> >  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
> >  op=seccomp-logging actions="kill_process kill_thread errno trace log"
> >  res=0
> > 
> > No audit records are generated when reading the actions_logged sysctl.
> > 
> > Suggested-by: Steve Grubb <sgrubb@redhat.com>
> > Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
> > ---
> > 
> >  include/linux/audit.h |  3 +++
> >  kernel/auditsc.c      | 37 +++++++++++++++++++++++++++++++++++++
> >  kernel/seccomp.c      | 43 ++++++++++++++++++++++++++++++++++---------
> >  3 files changed, 74 insertions(+), 9 deletions(-)
> 
> ...
> 
> > diff --git a/include/linux/audit.h b/include/linux/audit.h
> > index 75d5b03..b311d7d 100644
> > --- a/include/linux/audit.h
> > +++ b/include/linux/audit.h
> > @@ -233,6 +233,7 @@ extern void __audit_inode_child(struct inode *parent,
> > 
> >                                 const struct dentry *dentry,
> >                                 const unsigned char type);
> >  
> >  extern void __audit_seccomp(unsigned long syscall, long signr, int
> >  code);
> > 
> > +extern void audit_seccomp_actions_logged(const char *names, int res);
> > 
> >  extern void __audit_ptrace(struct task_struct *t);
> >  
> >  static inline bool audit_dummy_context(void)
> > 
> > @@ -502,6 +503,8 @@ static inline void __audit_seccomp(unsigned long
> > syscall, long signr, int code)> 
> >  { }
> >  static inline void audit_seccomp(unsigned long syscall, long signr, int
> >  code) { }
> > 
> > +static inline void audit_seccomp_actions_logged(const char *names, int
> > res) +{ }
> > 
> >  static inline int auditsc_get_stamp(struct audit_context *ctx,
> >  
> >                               struct timespec64 *t, unsigned int *serial)
> >  
> >  {
> > 
> > diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> > index 4e0a4ac..3496238 100644
> > --- a/kernel/auditsc.c
> > +++ b/kernel/auditsc.c
> > @@ -2478,6 +2478,43 @@ void __audit_seccomp(unsigned long syscall, long
> > signr, int code)> 
> >         audit_log_end(ab);
> >  
> >  }
> > 
> > +void audit_seccomp_actions_logged(const char *names, int res)
> > +{
> > +       struct tty_struct *tty;
> > +       const struct cred *cred;
> > +       struct audit_buffer *ab;
> > +       char comm[sizeof(current->comm)];
> > +
> > +       if (!audit_enabled)
> > +               return;
> > +
> > +       ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
> > +       if (unlikely(!ab))
> > +               return;
> 
> Instead of NULL, let's pass current->audit_context to
> audit_log_start().  Yes, most of the AUDIT_CONFIG_CHANGE users pass
> NULL but all of that is going to need to change because of 1) the
> audit container ID work and 2) it makes sense to connect records that
> are related.  Let's do it right the first time here :)
> 
> > +       cred = current_cred();
> > +       tty = audit_get_tty(current);
> > +       audit_log_format(ab, "pid=%d uid=%u auid=%u tty=%s ses=%u",
> > +                        task_tgid_nr(current),
> > +                        from_kuid(&init_user_ns, cred->uid),
> > +                        from_kuid(&init_user_ns,
> > +                        audit_get_loginuid(current)),
> > +                        tty ? tty_name(tty) : "(none)",
> > +                        audit_get_sessionid(current));
> > +       audit_put_tty(tty);
> > +       audit_log_task_context(ab);
> > +       audit_log_format(ab, " comm=");
> > +       audit_log_untrustedstring(ab, get_task_comm(comm, current));
> > +       audit_log_d_path_exe(ab, current->mm);
> > +       audit_log_format(ab, " op=seccomp-logging");
> > +       if (names)
> > +               audit_log_format(ab, " actions=\"%s\"", names);
> > +
> > +       audit_log_format(ab, " res=%d", res);
> > +       audit_log_end(ab);
> 
> One of the benefits of using current->audit_context is that we get a
> lot of this info from the associated SYSCALL record (assuming the
> admin isn't filtering that, e.g. Fedora defaults).  We can safely drop
> most everything except for the "op" and "actions" fields.
> 
> Steve might also want an "old-actions" field, but I'll let him speak to
> that.

Configuration changes are supposed to show current and new values.

-Steve

Re: [PATCH 2/3] seccomp: Audit attempts to modify the actions_logged sysctl

[Steve Grubb]

On Tuesday, May 1, 2018 11:18:55 AM EDT Paul Moore wrote:
> On Fri, Apr 27, 2018 at 3:16 PM, Tyler Hicks <tyhicks@canonical.com> wrote:
> > The decision to log a seccomp action will always be subject to the
> > value of the kernel.seccomp.actions_logged sysctl, even for processes
> > that are being inspected via the audit subsystem, in an upcoming patch.
> > Therefore, we need to emit an audit record on attempts at writing to the
> > actions_logged sysctl when auditing is enabled.
> > 
> > This patch updates the write handler for the actions_logged sysctl to
> > emit an audit record on attempts to write to the sysctl. Successful
> > writes to the sysctl will result in a record that includes a normalized
> > list of logged actions in the "actions" field and a "res" field equal to
> > 0. Unsuccessful writes to the sysctl will result in a record that
> > doesn't include the "actions" field and has a "res" field equal to 1.
> > 
> > Not all unsuccessful writes to the sysctl are audited. For example, an
> > audit record will not be emitted if an unprivileged process attempts to
> > open the sysctl file for reading since that access control check is not
> > part of the sysctl's write handler.
> > 
> > Below are some example audit records when writing various strings to the
> > actions_logged sysctl.
> > 
> > Writing "not-a-real-action" emits:
> >  type=CONFIG_CHANGE msg=audit(1524600971.363:119): pid=1651 uid=0
> >  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
> >  op=seccomp-logging res=1
> > 
> > Writing "kill_process kill_thread errno trace log" emits:
> >  type=CONFIG_CHANGE msg=audit(1524601023.982:131): pid=1658 uid=0
> >  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
> >  op=seccomp-logging actions="kill_process kill_thread errno trace log"
> >  res=0
> 
> I've got some additional comments regarding the fields in the code
> below, but it would be good to hear Steve comment on the "actions"
> field since his userspace tools are extremely picky about what they
> will accept.

Its not that the audit user space applications are picky, its that we have a 
coding standard that everyone needs to abide by so that any parser coded to 
the specification works. In short, we should not have spaces inside the "" 
because that can trick a naive parser. What we typically do in a situation 
like this is add a comma as a separator. But having "" means that the value 
is untrusted and subject to escaping. I don't think that is the case here. 
Output is not controlled by the user. Its a list of well known names.

> It looks like you are treating the actions as an untrusted string, which is
> good, so I suspect you are okay, but still

The function below that logs names is calling audit_log_format which does not 
handle untrusted strings. I would suggest not treating it as an untrusted 
string, but as a string with no spaces in it. 

actions=kill_process,kill_thread,errno,trace,log


> > Writing the string "log log errno trace kill_process kill_thread", which
> > is unordered and contains the log action twice, results in the same
> > 
> > value as the previous example for the actions field:
> >  type=CONFIG_CHANGE msg=audit(1524601204.365:152): pid=1704 uid=0
> >  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
> >  op=seccomp-logging actions="kill_process kill_thread errno trace log"
> >  res=0
> > 
> > No audit records are generated when reading the actions_logged sysctl.
> > 
> > Suggested-by: Steve Grubb <sgrubb@redhat.com>
> > Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
> > ---
> > 
> >  include/linux/audit.h |  3 +++
> >  kernel/auditsc.c      | 37 +++++++++++++++++++++++++++++++++++++
> >  kernel/seccomp.c      | 43 ++++++++++++++++++++++++++++++++++---------
> >  3 files changed, 74 insertions(+), 9 deletions(-)
> 
> ...
> 
> > diff --git a/include/linux/audit.h b/include/linux/audit.h
> > index 75d5b03..b311d7d 100644
> > --- a/include/linux/audit.h
> > +++ b/include/linux/audit.h
> > @@ -233,6 +233,7 @@ extern void __audit_inode_child(struct inode *parent,
> > 
> >                                 const struct dentry *dentry,
> >                                 const unsigned char type);
> >  
> >  extern void __audit_seccomp(unsigned long syscall, long signr, int
> >  code);
> > 
> > +extern void audit_seccomp_actions_logged(const char *names, int res);
> > 
> >  extern void __audit_ptrace(struct task_struct *t);
> >  
> >  static inline bool audit_dummy_context(void)
> > 
> > @@ -502,6 +503,8 @@ static inline void __audit_seccomp(unsigned long
> > syscall, long signr, int code)> 
> >  { }
> >  static inline void audit_seccomp(unsigned long syscall, long signr, int
> >  code) { }
> > 
> > +static inline void audit_seccomp_actions_logged(const char *names, int
> > res) +{ }
> > 
> >  static inline int auditsc_get_stamp(struct audit_context *ctx,
> >  
> >                               struct timespec64 *t, unsigned int *serial)
> >  
> >  {
> > 
> > diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> > index 4e0a4ac..3496238 100644
> > --- a/kernel/auditsc.c
> > +++ b/kernel/auditsc.c
> > @@ -2478,6 +2478,43 @@ void __audit_seccomp(unsigned long syscall, long
> > signr, int code)> 
> >         audit_log_end(ab);
> >  
> >  }
> > 
> > +void audit_seccomp_actions_logged(const char *names, int res)
> > +{
> > +       struct tty_struct *tty;
> > +       const struct cred *cred;
> > +       struct audit_buffer *ab;
> > +       char comm[sizeof(current->comm)];
> > +
> > +       if (!audit_enabled)
> > +               return;
> > +
> > +       ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
> > +       if (unlikely(!ab))
> > +               return;
> 
> Instead of NULL, let's pass current->audit_context to
> audit_log_start().  Yes, most of the AUDIT_CONFIG_CHANGE users pass
> NULL but all of that is going to need to change because of 1) the
> audit container ID work and 2) it makes sense to connect records that
> are related.  Let's do it right the first time here :)
> 
> > +       cred = current_cred();
> > +       tty = audit_get_tty(current);
> > +       audit_log_format(ab, "pid=%d uid=%u auid=%u tty=%s ses=%u",
> > +                        task_tgid_nr(current),
> > +                        from_kuid(&init_user_ns, cred->uid),
> > +                        from_kuid(&init_user_ns,
> > +                        audit_get_loginuid(current)),
> > +                        tty ? tty_name(tty) : "(none)",
> > +                        audit_get_sessionid(current));
> > +       audit_put_tty(tty);
> > +       audit_log_task_context(ab);
> > +       audit_log_format(ab, " comm=");
> > +       audit_log_untrustedstring(ab, get_task_comm(comm, current));
> > +       audit_log_d_path_exe(ab, current->mm);
> > +       audit_log_format(ab, " op=seccomp-logging");
> > +       if (names)
> > +               audit_log_format(ab, " actions=\"%s\"", names);
> > +
> > +       audit_log_format(ab, " res=%d", res);
> > +       audit_log_end(ab);
> 
> One of the benefits of using current->audit_context is that we get a
> lot of this info from the associated SYSCALL record (assuming the
> admin isn't filtering that, e.g. Fedora defaults).  We can safely drop
> most everything except for the "op" and "actions" fields.
> 
> Steve might also want an "old-actions" field, but I'll let him speak to
> that.

Configuration changes are supposed to show current and new values.

-Steve


--
To unsubscribe from this list: send the line "unsubscribe linux-doc" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH 2/3] seccomp: Audit attempts to modify the actions_logged sysctl

[Steve Grubb]

On Tuesday, May 1, 2018 11:18:55 AM EDT Paul Moore wrote:
> On Fri, Apr 27, 2018 at 3:16 PM, Tyler Hicks <tyhicks@canonical.com> wrote:
> > The decision to log a seccomp action will always be subject to the
> > value of the kernel.seccomp.actions_logged sysctl, even for processes
> > that are being inspected via the audit subsystem, in an upcoming patch.
> > Therefore, we need to emit an audit record on attempts at writing to the
> > actions_logged sysctl when auditing is enabled.
> > 
> > This patch updates the write handler for the actions_logged sysctl to
> > emit an audit record on attempts to write to the sysctl. Successful
> > writes to the sysctl will result in a record that includes a normalized
> > list of logged actions in the "actions" field and a "res" field equal to
> > 0. Unsuccessful writes to the sysctl will result in a record that
> > doesn't include the "actions" field and has a "res" field equal to 1.
> > 
> > Not all unsuccessful writes to the sysctl are audited. For example, an
> > audit record will not be emitted if an unprivileged process attempts to
> > open the sysctl file for reading since that access control check is not
> > part of the sysctl's write handler.
> > 
> > Below are some example audit records when writing various strings to the
> > actions_logged sysctl.
> > 
> > Writing "not-a-real-action" emits:
> >  type=CONFIG_CHANGE msg=audit(1524600971.363:119): pid=1651 uid=0
> >  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
> >  op=seccomp-logging res=1
> > 
> > Writing "kill_process kill_thread errno trace log" emits:
> >  type=CONFIG_CHANGE msg=audit(1524601023.982:131): pid=1658 uid=0
> >  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
> >  op=seccomp-logging actions="kill_process kill_thread errno trace log"
> >  res=0
> 
> I've got some additional comments regarding the fields in the code
> below, but it would be good to hear Steve comment on the "actions"
> field since his userspace tools are extremely picky about what they
> will accept.

Its not that the audit user space applications are picky, its that we have a 
coding standard that everyone needs to abide by so that any parser coded to 
the specification works. In short, we should not have spaces inside the "" 
because that can trick a naive parser. What we typically do in a situation 
like this is add a comma as a separator. But having "" means that the value 
is untrusted and subject to escaping. I don't think that is the case here. 
Output is not controlled by the user. Its a list of well known names.

> It looks like you are treating the actions as an untrusted string, which is
> good, so I suspect you are okay, but still

The function below that logs names is calling audit_log_format which does not 
handle untrusted strings. I would suggest not treating it as an untrusted 
string, but as a string with no spaces in it. 

actions=kill_process,kill_thread,errno,trace,log


> > Writing the string "log log errno trace kill_process kill_thread", which
> > is unordered and contains the log action twice, results in the same
> > 
> > value as the previous example for the actions field:
> >  type=CONFIG_CHANGE msg=audit(1524601204.365:152): pid=1704 uid=0
> >  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
> >  op=seccomp-logging actions="kill_process kill_thread errno trace log"
> >  res=0
> > 
> > No audit records are generated when reading the actions_logged sysctl.
> > 
> > Suggested-by: Steve Grubb <sgrubb@redhat.com>
> > Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
> > ---
> > 
> >  include/linux/audit.h |  3 +++
> >  kernel/auditsc.c      | 37 +++++++++++++++++++++++++++++++++++++
> >  kernel/seccomp.c      | 43 ++++++++++++++++++++++++++++++++++---------
> >  3 files changed, 74 insertions(+), 9 deletions(-)
> 
> ...
> 
> > diff --git a/include/linux/audit.h b/include/linux/audit.h
> > index 75d5b03..b311d7d 100644
> > --- a/include/linux/audit.h
> > +++ b/include/linux/audit.h
> > @@ -233,6 +233,7 @@ extern void __audit_inode_child(struct inode *parent,
> > 
> >                                 const struct dentry *dentry,
> >                                 const unsigned char type);
> >  
> >  extern void __audit_seccomp(unsigned long syscall, long signr, int
> >  code);
> > 
> > +extern void audit_seccomp_actions_logged(const char *names, int res);
> > 
> >  extern void __audit_ptrace(struct task_struct *t);
> >  
> >  static inline bool audit_dummy_context(void)
> > 
> > @@ -502,6 +503,8 @@ static inline void __audit_seccomp(unsigned long
> > syscall, long signr, int code)> 
> >  { }
> >  static inline void audit_seccomp(unsigned long syscall, long signr, int
> >  code) { }
> > 
> > +static inline void audit_seccomp_actions_logged(const char *names, int
> > res) +{ }
> > 
> >  static inline int auditsc_get_stamp(struct audit_context *ctx,
> >  
> >                               struct timespec64 *t, unsigned int *serial)
> >  
> >  {
> > 
> > diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> > index 4e0a4ac..3496238 100644
> > --- a/kernel/auditsc.c
> > +++ b/kernel/auditsc.c
> > @@ -2478,6 +2478,43 @@ void __audit_seccomp(unsigned long syscall, long
> > signr, int code)> 
> >         audit_log_end(ab);
> >  
> >  }
> > 
> > +void audit_seccomp_actions_logged(const char *names, int res)
> > +{
> > +       struct tty_struct *tty;
> > +       const struct cred *cred;
> > +       struct audit_buffer *ab;
> > +       char comm[sizeof(current->comm)];
> > +
> > +       if (!audit_enabled)
> > +               return;
> > +
> > +       ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
> > +       if (unlikely(!ab))
> > +               return;
> 
> Instead of NULL, let's pass current->audit_context to
> audit_log_start().  Yes, most of the AUDIT_CONFIG_CHANGE users pass
> NULL but all of that is going to need to change because of 1) the
> audit container ID work and 2) it makes sense to connect records that
> are related.  Let's do it right the first time here :)
> 
> > +       cred = current_cred();
> > +       tty = audit_get_tty(current);
> > +       audit_log_format(ab, "pid=%d uid=%u auid=%u tty=%s ses=%u",
> > +                        task_tgid_nr(current),
> > +                        from_kuid(&init_user_ns, cred->uid),
> > +                        from_kuid(&init_user_ns,
> > +                        audit_get_loginuid(current)),
> > +                        tty ? tty_name(tty) : "(none)",
> > +                        audit_get_sessionid(current));
> > +       audit_put_tty(tty);
> > +       audit_log_task_context(ab);
> > +       audit_log_format(ab, " comm=");
> > +       audit_log_untrustedstring(ab, get_task_comm(comm, current));
> > +       audit_log_d_path_exe(ab, current->mm);
> > +       audit_log_format(ab, " op=seccomp-logging");
> > +       if (names)
> > +               audit_log_format(ab, " actions=\"%s\"", names);
> > +
> > +       audit_log_format(ab, " res=%d", res);
> > +       audit_log_end(ab);
> 
> One of the benefits of using current->audit_context is that we get a
> lot of this info from the associated SYSCALL record (assuming the
> admin isn't filtering that, e.g. Fedora defaults).  We can safely drop
> most everything except for the "op" and "actions" fields.
> 
> Steve might also want an "old-actions" field, but I'll let him speak to
> that.

Configuration changes are supposed to show current and new values.

-Steve


--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH 2/3] seccomp: Audit attempts to modify the actions_logged sysctl

[Paul Moore]

On Tue, May 1, 2018 at 12:41 PM, Steve Grubb <sgrubb@redhat.com> wrote:
> On Tuesday, May 1, 2018 11:18:55 AM EDT Paul Moore wrote:
>> On Fri, Apr 27, 2018 at 3:16 PM, Tyler Hicks <tyhicks@canonical.com> wrote:
>> > The decision to log a seccomp action will always be subject to the
>> > value of the kernel.seccomp.actions_logged sysctl, even for processes
>> > that are being inspected via the audit subsystem, in an upcoming patch.
>> > Therefore, we need to emit an audit record on attempts at writing to the
>> > actions_logged sysctl when auditing is enabled.
>> >
>> > This patch updates the write handler for the actions_logged sysctl to
>> > emit an audit record on attempts to write to the sysctl. Successful
>> > writes to the sysctl will result in a record that includes a normalized
>> > list of logged actions in the "actions" field and a "res" field equal to
>> > 0. Unsuccessful writes to the sysctl will result in a record that
>> > doesn't include the "actions" field and has a "res" field equal to 1.
>> >
>> > Not all unsuccessful writes to the sysctl are audited. For example, an
>> > audit record will not be emitted if an unprivileged process attempts to
>> > open the sysctl file for reading since that access control check is not
>> > part of the sysctl's write handler.
>> >
>> > Below are some example audit records when writing various strings to the
>> > actions_logged sysctl.
>> >
>> > Writing "not-a-real-action" emits:
>> >  type=CONFIG_CHANGE msg=audit(1524600971.363:119): pid=1651 uid=0
>> >  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
>> >  op=seccomp-logging res=1
>> >
>> > Writing "kill_process kill_thread errno trace log" emits:
>> >  type=CONFIG_CHANGE msg=audit(1524601023.982:131): pid=1658 uid=0
>> >  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
>> >  op=seccomp-logging actions="kill_process kill_thread errno trace log"
>> >  res=0
>>
>> I've got some additional comments regarding the fields in the code
>> below, but it would be good to hear Steve comment on the "actions"
>> field since his userspace tools are extremely picky about what they
>> will accept.
>
> Its not that the audit user space applications are picky, its that we have a
> coding standard that everyone needs to abide by so that any parser coded to
> the specification works.

We're getting a bit off track, but the issue with the "specification"
is that there has not been enough checking and enforcement of the
"specification" to give it much weight.  We've made some fixes to
records of lower impact, but I'm not going to merge disruptive record
changes.  After a while, the status-quo becomes the "specification".

At some point in the future I plan to submit patches which disconnect
the audit data from the record format for in-kernel callers; this is
really the only way we can enforce any type of record format.  The
current in-kernel audit API is for too open for misuse and abuse.

> In short, we should not have spaces inside the ""
> because that can trick a naive parser. What we typically do in a situation
> like this is add a comma as a separator. But having "" means that the value
> is untrusted and subject to escaping. I don't think that is the case here.
> Output is not controlled by the user. Its a list of well known names.
>
>> It looks like you are treating the actions as an untrusted string, which is
>> good, so I suspect you are okay, but still
>
> The function below that logs names is calling audit_log_format which does not
> handle untrusted strings. I would suggest not treating it as an untrusted
> string, but as a string with no spaces in it.
>
> actions=kill_process,kill_thread,errno,trace,log

Yes, my mistake, I suspect I was distracted by the comm logging.

>> > Writing the string "log log errno trace kill_process kill_thread", which
>> > is unordered and contains the log action twice, results in the same
>> >
>> > value as the previous example for the actions field:
>> >  type=CONFIG_CHANGE msg=audit(1524601204.365:152): pid=1704 uid=0
>> >  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
>> >  op=seccomp-logging actions="kill_process kill_thread errno trace log"
>> >  res=0
>> >
>> > No audit records are generated when reading the actions_logged sysctl.
>> >
>> > Suggested-by: Steve Grubb <sgrubb@redhat.com>
>> > Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
>> > ---
>> >
>> >  include/linux/audit.h |  3 +++
>> >  kernel/auditsc.c      | 37 +++++++++++++++++++++++++++++++++++++
>> >  kernel/seccomp.c      | 43 ++++++++++++++++++++++++++++++++++---------
>> >  3 files changed, 74 insertions(+), 9 deletions(-)
>>
>> ...
>>
>> > diff --git a/include/linux/audit.h b/include/linux/audit.h
>> > index 75d5b03..b311d7d 100644
>> > --- a/include/linux/audit.h
>> > +++ b/include/linux/audit.h
>> > @@ -233,6 +233,7 @@ extern void __audit_inode_child(struct inode *parent,
>> >
>> >                                 const struct dentry *dentry,
>> >                                 const unsigned char type);
>> >
>> >  extern void __audit_seccomp(unsigned long syscall, long signr, int
>> >  code);
>> >
>> > +extern void audit_seccomp_actions_logged(const char *names, int res);
>> >
>> >  extern void __audit_ptrace(struct task_struct *t);
>> >
>> >  static inline bool audit_dummy_context(void)
>> >
>> > @@ -502,6 +503,8 @@ static inline void __audit_seccomp(unsigned long
>> > syscall, long signr, int code)>
>> >  { }
>> >  static inline void audit_seccomp(unsigned long syscall, long signr, int
>> >  code) { }
>> >
>> > +static inline void audit_seccomp_actions_logged(const char *names, int
>> > res) +{ }
>> >
>> >  static inline int auditsc_get_stamp(struct audit_context *ctx,
>> >
>> >                               struct timespec64 *t, unsigned int *serial)
>> >
>> >  {
>> >
>> > diff --git a/kernel/auditsc.c b/kernel/auditsc.c
>> > index 4e0a4ac..3496238 100644
>> > --- a/kernel/auditsc.c
>> > +++ b/kernel/auditsc.c
>> > @@ -2478,6 +2478,43 @@ void __audit_seccomp(unsigned long syscall, long
>> > signr, int code)>
>> >         audit_log_end(ab);
>> >
>> >  }
>> >
>> > +void audit_seccomp_actions_logged(const char *names, int res)
>> > +{
>> > +       struct tty_struct *tty;
>> > +       const struct cred *cred;
>> > +       struct audit_buffer *ab;
>> > +       char comm[sizeof(current->comm)];
>> > +
>> > +       if (!audit_enabled)
>> > +               return;
>> > +
>> > +       ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
>> > +       if (unlikely(!ab))
>> > +               return;
>>
>> Instead of NULL, let's pass current->audit_context to
>> audit_log_start().  Yes, most of the AUDIT_CONFIG_CHANGE users pass
>> NULL but all of that is going to need to change because of 1) the
>> audit container ID work and 2) it makes sense to connect records that
>> are related.  Let's do it right the first time here :)
>>
>> > +       cred = current_cred();
>> > +       tty = audit_get_tty(current);
>> > +       audit_log_format(ab, "pid=%d uid=%u auid=%u tty=%s ses=%u",
>> > +                        task_tgid_nr(current),
>> > +                        from_kuid(&init_user_ns, cred->uid),
>> > +                        from_kuid(&init_user_ns,
>> > +                        audit_get_loginuid(current)),
>> > +                        tty ? tty_name(tty) : "(none)",
>> > +                        audit_get_sessionid(current));
>> > +       audit_put_tty(tty);
>> > +       audit_log_task_context(ab);
>> > +       audit_log_format(ab, " comm=");
>> > +       audit_log_untrustedstring(ab, get_task_comm(comm, current));
>> > +       audit_log_d_path_exe(ab, current->mm);
>> > +       audit_log_format(ab, " op=seccomp-logging");
>> > +       if (names)
>> > +               audit_log_format(ab, " actions=\"%s\"", names);
>> > +
>> > +       audit_log_format(ab, " res=%d", res);
>> > +       audit_log_end(ab);
>>
>> One of the benefits of using current->audit_context is that we get a
>> lot of this info from the associated SYSCALL record (assuming the
>> admin isn't filtering that, e.g. Fedora defaults).  We can safely drop
>> most everything except for the "op" and "actions" fields.
>>
>> Steve might also want an "old-actions" field, but I'll let him speak to
>> that.
>
> Configuration changes are supposed to show current and new values.
>
> -Steve

-- 
paul moore
www.paul-moore.com

Re: [PATCH 2/3] seccomp: Audit attempts to modify the actions_logged sysctl

[Paul Moore]

On Tue, May 1, 2018 at 12:41 PM, Steve Grubb <sgrubb@redhat.com> wrote:
> On Tuesday, May 1, 2018 11:18:55 AM EDT Paul Moore wrote:
>> On Fri, Apr 27, 2018 at 3:16 PM, Tyler Hicks <tyhicks@canonical.com> wrote:
>> > The decision to log a seccomp action will always be subject to the
>> > value of the kernel.seccomp.actions_logged sysctl, even for processes
>> > that are being inspected via the audit subsystem, in an upcoming patch.
>> > Therefore, we need to emit an audit record on attempts at writing to the
>> > actions_logged sysctl when auditing is enabled.
>> >
>> > This patch updates the write handler for the actions_logged sysctl to
>> > emit an audit record on attempts to write to the sysctl. Successful
>> > writes to the sysctl will result in a record that includes a normalized
>> > list of logged actions in the "actions" field and a "res" field equal to
>> > 0. Unsuccessful writes to the sysctl will result in a record that
>> > doesn't include the "actions" field and has a "res" field equal to 1.
>> >
>> > Not all unsuccessful writes to the sysctl are audited. For example, an
>> > audit record will not be emitted if an unprivileged process attempts to
>> > open the sysctl file for reading since that access control check is not
>> > part of the sysctl's write handler.
>> >
>> > Below are some example audit records when writing various strings to the
>> > actions_logged sysctl.
>> >
>> > Writing "not-a-real-action" emits:
>> >  type=CONFIG_CHANGE msg=audit(1524600971.363:119): pid=1651 uid=0
>> >  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
>> >  op=seccomp-logging res=1
>> >
>> > Writing "kill_process kill_thread errno trace log" emits:
>> >  type=CONFIG_CHANGE msg=audit(1524601023.982:131): pid=1658 uid=0
>> >  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
>> >  op=seccomp-logging actions="kill_process kill_thread errno trace log"
>> >  res=0
>>
>> I've got some additional comments regarding the fields in the code
>> below, but it would be good to hear Steve comment on the "actions"
>> field since his userspace tools are extremely picky about what they
>> will accept.
>
> Its not that the audit user space applications are picky, its that we have a
> coding standard that everyone needs to abide by so that any parser coded to
> the specification works.

We're getting a bit off track, but the issue with the "specification"
is that there has not been enough checking and enforcement of the
"specification" to give it much weight.  We've made some fixes to
records of lower impact, but I'm not going to merge disruptive record
changes.  After a while, the status-quo becomes the "specification".

At some point in the future I plan to submit patches which disconnect
the audit data from the record format for in-kernel callers; this is
really the only way we can enforce any type of record format.  The
current in-kernel audit API is for too open for misuse and abuse.

> In short, we should not have spaces inside the ""
> because that can trick a naive parser. What we typically do in a situation
> like this is add a comma as a separator. But having "" means that the value
> is untrusted and subject to escaping. I don't think that is the case here.
> Output is not controlled by the user. Its a list of well known names.
>
>> It looks like you are treating the actions as an untrusted string, which is
>> good, so I suspect you are okay, but still
>
> The function below that logs names is calling audit_log_format which does not
> handle untrusted strings. I would suggest not treating it as an untrusted
> string, but as a string with no spaces in it.
>
> actions=kill_process,kill_thread,errno,trace,log

Yes, my mistake, I suspect I was distracted by the comm logging.

>> > Writing the string "log log errno trace kill_process kill_thread", which
>> > is unordered and contains the log action twice, results in the same
>> >
>> > value as the previous example for the actions field:
>> >  type=CONFIG_CHANGE msg=audit(1524601204.365:152): pid=1704 uid=0
>> >  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
>> >  op=seccomp-logging actions="kill_process kill_thread errno trace log"
>> >  res=0
>> >
>> > No audit records are generated when reading the actions_logged sysctl.
>> >
>> > Suggested-by: Steve Grubb <sgrubb@redhat.com>
>> > Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
>> > ---
>> >
>> >  include/linux/audit.h |  3 +++
>> >  kernel/auditsc.c      | 37 +++++++++++++++++++++++++++++++++++++
>> >  kernel/seccomp.c      | 43 ++++++++++++++++++++++++++++++++++---------
>> >  3 files changed, 74 insertions(+), 9 deletions(-)
>>
>> ...
>>
>> > diff --git a/include/linux/audit.h b/include/linux/audit.h
>> > index 75d5b03..b311d7d 100644
>> > --- a/include/linux/audit.h
>> > +++ b/include/linux/audit.h
>> > @@ -233,6 +233,7 @@ extern void __audit_inode_child(struct inode *parent,
>> >
>> >                                 const struct dentry *dentry,
>> >                                 const unsigned char type);
>> >
>> >  extern void __audit_seccomp(unsigned long syscall, long signr, int
>> >  code);
>> >
>> > +extern void audit_seccomp_actions_logged(const char *names, int res);
>> >
>> >  extern void __audit_ptrace(struct task_struct *t);
>> >
>> >  static inline bool audit_dummy_context(void)
>> >
>> > @@ -502,6 +503,8 @@ static inline void __audit_seccomp(unsigned long
>> > syscall, long signr, int code)>
>> >  { }
>> >  static inline void audit_seccomp(unsigned long syscall, long signr, int
>> >  code) { }
>> >
>> > +static inline void audit_seccomp_actions_logged(const char *names, int
>> > res) +{ }
>> >
>> >  static inline int auditsc_get_stamp(struct audit_context *ctx,
>> >
>> >                               struct timespec64 *t, unsigned int *serial)
>> >
>> >  {
>> >
>> > diff --git a/kernel/auditsc.c b/kernel/auditsc.c
>> > index 4e0a4ac..3496238 100644
>> > --- a/kernel/auditsc.c
>> > +++ b/kernel/auditsc.c
>> > @@ -2478,6 +2478,43 @@ void __audit_seccomp(unsigned long syscall, long
>> > signr, int code)>
>> >         audit_log_end(ab);
>> >
>> >  }
>> >
>> > +void audit_seccomp_actions_logged(const char *names, int res)
>> > +{
>> > +       struct tty_struct *tty;
>> > +       const struct cred *cred;
>> > +       struct audit_buffer *ab;
>> > +       char comm[sizeof(current->comm)];
>> > +
>> > +       if (!audit_enabled)
>> > +               return;
>> > +
>> > +       ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
>> > +       if (unlikely(!ab))
>> > +               return;
>>
>> Instead of NULL, let's pass current->audit_context to
>> audit_log_start().  Yes, most of the AUDIT_CONFIG_CHANGE users pass
>> NULL but all of that is going to need to change because of 1) the
>> audit container ID work and 2) it makes sense to connect records that
>> are related.  Let's do it right the first time here :)
>>
>> > +       cred = current_cred();
>> > +       tty = audit_get_tty(current);
>> > +       audit_log_format(ab, "pid=%d uid=%u auid=%u tty=%s ses=%u",
>> > +                        task_tgid_nr(current),
>> > +                        from_kuid(&init_user_ns, cred->uid),
>> > +                        from_kuid(&init_user_ns,
>> > +                        audit_get_loginuid(current)),
>> > +                        tty ? tty_name(tty) : "(none)",
>> > +                        audit_get_sessionid(current));
>> > +       audit_put_tty(tty);
>> > +       audit_log_task_context(ab);
>> > +       audit_log_format(ab, " comm=");
>> > +       audit_log_untrustedstring(ab, get_task_comm(comm, current));
>> > +       audit_log_d_path_exe(ab, current->mm);
>> > +       audit_log_format(ab, " op=seccomp-logging");
>> > +       if (names)
>> > +               audit_log_format(ab, " actions=\"%s\"", names);
>> > +
>> > +       audit_log_format(ab, " res=%d", res);
>> > +       audit_log_end(ab);
>>
>> One of the benefits of using current->audit_context is that we get a
>> lot of this info from the associated SYSCALL record (assuming the
>> admin isn't filtering that, e.g. Fedora defaults).  We can safely drop
>> most everything except for the "op" and "actions" fields.
>>
>> Steve might also want an "old-actions" field, but I'll let him speak to
>> that.
>
> Configuration changes are supposed to show current and new values.
>
> -Steve

-- 
paul moore
www.paul-moore.com
--
To unsubscribe from this list: send the line "unsubscribe linux-doc" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH 2/3] seccomp: Audit attempts to modify the actions_logged sysctl

[Paul Moore]

On Tue, May 1, 2018 at 12:41 PM, Steve Grubb <sgrubb@redhat.com> wrote:
> On Tuesday, May 1, 2018 11:18:55 AM EDT Paul Moore wrote:
>> On Fri, Apr 27, 2018 at 3:16 PM, Tyler Hicks <tyhicks@canonical.com> wrote:
>> > The decision to log a seccomp action will always be subject to the
>> > value of the kernel.seccomp.actions_logged sysctl, even for processes
>> > that are being inspected via the audit subsystem, in an upcoming patch.
>> > Therefore, we need to emit an audit record on attempts at writing to the
>> > actions_logged sysctl when auditing is enabled.
>> >
>> > This patch updates the write handler for the actions_logged sysctl to
>> > emit an audit record on attempts to write to the sysctl. Successful
>> > writes to the sysctl will result in a record that includes a normalized
>> > list of logged actions in the "actions" field and a "res" field equal to
>> > 0. Unsuccessful writes to the sysctl will result in a record that
>> > doesn't include the "actions" field and has a "res" field equal to 1.
>> >
>> > Not all unsuccessful writes to the sysctl are audited. For example, an
>> > audit record will not be emitted if an unprivileged process attempts to
>> > open the sysctl file for reading since that access control check is not
>> > part of the sysctl's write handler.
>> >
>> > Below are some example audit records when writing various strings to the
>> > actions_logged sysctl.
>> >
>> > Writing "not-a-real-action" emits:
>> >  type=CONFIG_CHANGE msg=audit(1524600971.363:119): pid=1651 uid=0
>> >  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
>> >  op=seccomp-logging res=1
>> >
>> > Writing "kill_process kill_thread errno trace log" emits:
>> >  type=CONFIG_CHANGE msg=audit(1524601023.982:131): pid=1658 uid=0
>> >  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
>> >  op=seccomp-logging actions="kill_process kill_thread errno trace log"
>> >  res=0
>>
>> I've got some additional comments regarding the fields in the code
>> below, but it would be good to hear Steve comment on the "actions"
>> field since his userspace tools are extremely picky about what they
>> will accept.
>
> Its not that the audit user space applications are picky, its that we have a
> coding standard that everyone needs to abide by so that any parser coded to
> the specification works.

We're getting a bit off track, but the issue with the "specification"
is that there has not been enough checking and enforcement of the
"specification" to give it much weight.  We've made some fixes to
records of lower impact, but I'm not going to merge disruptive record
changes.  After a while, the status-quo becomes the "specification".

At some point in the future I plan to submit patches which disconnect
the audit data from the record format for in-kernel callers; this is
really the only way we can enforce any type of record format.  The
current in-kernel audit API is for too open for misuse and abuse.

> In short, we should not have spaces inside the ""
> because that can trick a naive parser. What we typically do in a situation
> like this is add a comma as a separator. But having "" means that the value
> is untrusted and subject to escaping. I don't think that is the case here.
> Output is not controlled by the user. Its a list of well known names.
>
>> It looks like you are treating the actions as an untrusted string, which is
>> good, so I suspect you are okay, but still
>
> The function below that logs names is calling audit_log_format which does not
> handle untrusted strings. I would suggest not treating it as an untrusted
> string, but as a string with no spaces in it.
>
> actions=kill_process,kill_thread,errno,trace,log

Yes, my mistake, I suspect I was distracted by the comm logging.

>> > Writing the string "log log errno trace kill_process kill_thread", which
>> > is unordered and contains the log action twice, results in the same
>> >
>> > value as the previous example for the actions field:
>> >  type=CONFIG_CHANGE msg=audit(1524601204.365:152): pid=1704 uid=0
>> >  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
>> >  op=seccomp-logging actions="kill_process kill_thread errno trace log"
>> >  res=0
>> >
>> > No audit records are generated when reading the actions_logged sysctl.
>> >
>> > Suggested-by: Steve Grubb <sgrubb@redhat.com>
>> > Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
>> > ---
>> >
>> >  include/linux/audit.h |  3 +++
>> >  kernel/auditsc.c      | 37 +++++++++++++++++++++++++++++++++++++
>> >  kernel/seccomp.c      | 43 ++++++++++++++++++++++++++++++++++---------
>> >  3 files changed, 74 insertions(+), 9 deletions(-)
>>
>> ...
>>
>> > diff --git a/include/linux/audit.h b/include/linux/audit.h
>> > index 75d5b03..b311d7d 100644
>> > --- a/include/linux/audit.h
>> > +++ b/include/linux/audit.h
>> > @@ -233,6 +233,7 @@ extern void __audit_inode_child(struct inode *parent,
>> >
>> >                                 const struct dentry *dentry,
>> >                                 const unsigned char type);
>> >
>> >  extern void __audit_seccomp(unsigned long syscall, long signr, int
>> >  code);
>> >
>> > +extern void audit_seccomp_actions_logged(const char *names, int res);
>> >
>> >  extern void __audit_ptrace(struct task_struct *t);
>> >
>> >  static inline bool audit_dummy_context(void)
>> >
>> > @@ -502,6 +503,8 @@ static inline void __audit_seccomp(unsigned long
>> > syscall, long signr, int code)>
>> >  { }
>> >  static inline void audit_seccomp(unsigned long syscall, long signr, int
>> >  code) { }
>> >
>> > +static inline void audit_seccomp_actions_logged(const char *names, int
>> > res) +{ }
>> >
>> >  static inline int auditsc_get_stamp(struct audit_context *ctx,
>> >
>> >                               struct timespec64 *t, unsigned int *serial)
>> >
>> >  {
>> >
>> > diff --git a/kernel/auditsc.c b/kernel/auditsc.c
>> > index 4e0a4ac..3496238 100644
>> > --- a/kernel/auditsc.c
>> > +++ b/kernel/auditsc.c
>> > @@ -2478,6 +2478,43 @@ void __audit_seccomp(unsigned long syscall, long
>> > signr, int code)>
>> >         audit_log_end(ab);
>> >
>> >  }
>> >
>> > +void audit_seccomp_actions_logged(const char *names, int res)
>> > +{
>> > +       struct tty_struct *tty;
>> > +       const struct cred *cred;
>> > +       struct audit_buffer *ab;
>> > +       char comm[sizeof(current->comm)];
>> > +
>> > +       if (!audit_enabled)
>> > +               return;
>> > +
>> > +       ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
>> > +       if (unlikely(!ab))
>> > +               return;
>>
>> Instead of NULL, let's pass current->audit_context to
>> audit_log_start().  Yes, most of the AUDIT_CONFIG_CHANGE users pass
>> NULL but all of that is going to need to change because of 1) the
>> audit container ID work and 2) it makes sense to connect records that
>> are related.  Let's do it right the first time here :)
>>
>> > +       cred = current_cred();
>> > +       tty = audit_get_tty(current);
>> > +       audit_log_format(ab, "pid=%d uid=%u auid=%u tty=%s ses=%u",
>> > +                        task_tgid_nr(current),
>> > +                        from_kuid(&init_user_ns, cred->uid),
>> > +                        from_kuid(&init_user_ns,
>> > +                        audit_get_loginuid(current)),
>> > +                        tty ? tty_name(tty) : "(none)",
>> > +                        audit_get_sessionid(current));
>> > +       audit_put_tty(tty);
>> > +       audit_log_task_context(ab);
>> > +       audit_log_format(ab, " comm=");
>> > +       audit_log_untrustedstring(ab, get_task_comm(comm, current));
>> > +       audit_log_d_path_exe(ab, current->mm);
>> > +       audit_log_format(ab, " op=seccomp-logging");
>> > +       if (names)
>> > +               audit_log_format(ab, " actions=\"%s\"", names);
>> > +
>> > +       audit_log_format(ab, " res=%d", res);
>> > +       audit_log_end(ab);
>>
>> One of the benefits of using current->audit_context is that we get a
>> lot of this info from the associated SYSCALL record (assuming the
>> admin isn't filtering that, e.g. Fedora defaults).  We can safely drop
>> most everything except for the "op" and "actions" fields.
>>
>> Steve might also want an "old-actions" field, but I'll let him speak to
>> that.
>
> Configuration changes are supposed to show current and new values.
>
> -Steve

-- 
paul moore
www.paul-moore.com
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH 2/3] seccomp: Audit attempts to modify the actions_logged sysctl

[Tyler Hicks]

[-- Attachment #1.1: Type: text/plain, Size: 8826 bytes --]

On 05/01/2018 12:25 PM, Paul Moore wrote:
> On Tue, May 1, 2018 at 12:41 PM, Steve Grubb <sgrubb@redhat.com> wrote:
>> On Tuesday, May 1, 2018 11:18:55 AM EDT Paul Moore wrote:
>>> On Fri, Apr 27, 2018 at 3:16 PM, Tyler Hicks <tyhicks@canonical.com> wrote:
>>>> The decision to log a seccomp action will always be subject to the
>>>> value of the kernel.seccomp.actions_logged sysctl, even for processes
>>>> that are being inspected via the audit subsystem, in an upcoming patch.
>>>> Therefore, we need to emit an audit record on attempts at writing to the
>>>> actions_logged sysctl when auditing is enabled.
>>>>
>>>> This patch updates the write handler for the actions_logged sysctl to
>>>> emit an audit record on attempts to write to the sysctl. Successful
>>>> writes to the sysctl will result in a record that includes a normalized
>>>> list of logged actions in the "actions" field and a "res" field equal to
>>>> 0. Unsuccessful writes to the sysctl will result in a record that
>>>> doesn't include the "actions" field and has a "res" field equal to 1.
>>>>
>>>> Not all unsuccessful writes to the sysctl are audited. For example, an
>>>> audit record will not be emitted if an unprivileged process attempts to
>>>> open the sysctl file for reading since that access control check is not
>>>> part of the sysctl's write handler.
>>>>
>>>> Below are some example audit records when writing various strings to the
>>>> actions_logged sysctl.
>>>>
>>>> Writing "not-a-real-action" emits:
>>>>  type=CONFIG_CHANGE msg=audit(1524600971.363:119): pid=1651 uid=0
>>>>  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
>>>>  op=seccomp-logging res=1
>>>>
>>>> Writing "kill_process kill_thread errno trace log" emits:
>>>>  type=CONFIG_CHANGE msg=audit(1524601023.982:131): pid=1658 uid=0
>>>>  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
>>>>  op=seccomp-logging actions="kill_process kill_thread errno trace log"
>>>>  res=0
>>>
>>> I've got some additional comments regarding the fields in the code
>>> below, but it would be good to hear Steve comment on the "actions"
>>> field since his userspace tools are extremely picky about what they
>>> will accept.
>>
>> Its not that the audit user space applications are picky, its that we have a
>> coding standard that everyone needs to abide by so that any parser coded to
>> the specification works.
> 
> We're getting a bit off track, but the issue with the "specification"
> is that there has not been enough checking and enforcement of the
> "specification" to give it much weight.  We've made some fixes to
> records of lower impact, but I'm not going to merge disruptive record
> changes.  After a while, the status-quo becomes the "specification".
> 
> At some point in the future I plan to submit patches which disconnect
> the audit data from the record format for in-kernel callers; this is
> really the only way we can enforce any type of record format.  The
> current in-kernel audit API is for too open for misuse and abuse.
> 
>> In short, we should not have spaces inside the ""
>> because that can trick a naive parser. What we typically do in a situation
>> like this is add a comma as a separator. But having "" means that the value
>> is untrusted and subject to escaping. I don't think that is the case here.
>> Output is not controlled by the user. Its a list of well known names.
>>
>>> It looks like you are treating the actions as an untrusted string, which is
>>> good, so I suspect you are okay, but still
>>
>> The function below that logs names is calling audit_log_format which does not
>> handle untrusted strings. I would suggest not treating it as an untrusted
>> string, but as a string with no spaces in it.
>>
>> actions=kill_process,kill_thread,errno,trace,log
> 
> Yes, my mistake, I suspect I was distracted by the comm logging.
> 
>>>> Writing the string "log log errno trace kill_process kill_thread", which
>>>> is unordered and contains the log action twice, results in the same
>>>>
>>>> value as the previous example for the actions field:
>>>>  type=CONFIG_CHANGE msg=audit(1524601204.365:152): pid=1704 uid=0
>>>>  auid=1000 tty=pts8 ses=1 comm="tee" exe="/usr/bin/tee"
>>>>  op=seccomp-logging actions="kill_process kill_thread errno trace log"
>>>>  res=0
>>>>
>>>> No audit records are generated when reading the actions_logged sysctl.
>>>>
>>>> Suggested-by: Steve Grubb <sgrubb@redhat.com>
>>>> Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
>>>> ---
>>>>
>>>>  include/linux/audit.h |  3 +++
>>>>  kernel/auditsc.c      | 37 +++++++++++++++++++++++++++++++++++++
>>>>  kernel/seccomp.c      | 43 ++++++++++++++++++++++++++++++++++---------
>>>>  3 files changed, 74 insertions(+), 9 deletions(-)
>>>
>>> ...
>>>
>>>> diff --git a/include/linux/audit.h b/include/linux/audit.h
>>>> index 75d5b03..b311d7d 100644
>>>> --- a/include/linux/audit.h
>>>> +++ b/include/linux/audit.h
>>>> @@ -233,6 +233,7 @@ extern void __audit_inode_child(struct inode *parent,
>>>>
>>>>                                 const struct dentry *dentry,
>>>>                                 const unsigned char type);
>>>>
>>>>  extern void __audit_seccomp(unsigned long syscall, long signr, int
>>>>  code);
>>>>
>>>> +extern void audit_seccomp_actions_logged(const char *names, int res);
>>>>
>>>>  extern void __audit_ptrace(struct task_struct *t);
>>>>
>>>>  static inline bool audit_dummy_context(void)
>>>>
>>>> @@ -502,6 +503,8 @@ static inline void __audit_seccomp(unsigned long
>>>> syscall, long signr, int code)>
>>>>  { }
>>>>  static inline void audit_seccomp(unsigned long syscall, long signr, int
>>>>  code) { }
>>>>
>>>> +static inline void audit_seccomp_actions_logged(const char *names, int
>>>> res) +{ }
>>>>
>>>>  static inline int auditsc_get_stamp(struct audit_context *ctx,
>>>>
>>>>                               struct timespec64 *t, unsigned int *serial)
>>>>
>>>>  {
>>>>
>>>> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
>>>> index 4e0a4ac..3496238 100644
>>>> --- a/kernel/auditsc.c
>>>> +++ b/kernel/auditsc.c
>>>> @@ -2478,6 +2478,43 @@ void __audit_seccomp(unsigned long syscall, long
>>>> signr, int code)>
>>>>         audit_log_end(ab);
>>>>
>>>>  }
>>>>
>>>> +void audit_seccomp_actions_logged(const char *names, int res)
>>>> +{
>>>> +       struct tty_struct *tty;
>>>> +       const struct cred *cred;
>>>> +       struct audit_buffer *ab;
>>>> +       char comm[sizeof(current->comm)];
>>>> +
>>>> +       if (!audit_enabled)
>>>> +               return;
>>>> +
>>>> +       ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
>>>> +       if (unlikely(!ab))
>>>> +               return;
>>>
>>> Instead of NULL, let's pass current->audit_context to
>>> audit_log_start().  Yes, most of the AUDIT_CONFIG_CHANGE users pass
>>> NULL but all of that is going to need to change because of 1) the
>>> audit container ID work and 2) it makes sense to connect records that
>>> are related.  Let's do it right the first time here :)
>>>
>>>> +       cred = current_cred();
>>>> +       tty = audit_get_tty(current);
>>>> +       audit_log_format(ab, "pid=%d uid=%u auid=%u tty=%s ses=%u",
>>>> +                        task_tgid_nr(current),
>>>> +                        from_kuid(&init_user_ns, cred->uid),
>>>> +                        from_kuid(&init_user_ns,
>>>> +                        audit_get_loginuid(current)),
>>>> +                        tty ? tty_name(tty) : "(none)",
>>>> +                        audit_get_sessionid(current));
>>>> +       audit_put_tty(tty);
>>>> +       audit_log_task_context(ab);
>>>> +       audit_log_format(ab, " comm=");
>>>> +       audit_log_untrustedstring(ab, get_task_comm(comm, current));
>>>> +       audit_log_d_path_exe(ab, current->mm);
>>>> +       audit_log_format(ab, " op=seccomp-logging");
>>>> +       if (names)
>>>> +               audit_log_format(ab, " actions=\"%s\"", names);
>>>> +
>>>> +       audit_log_format(ab, " res=%d", res);
>>>> +       audit_log_end(ab);
>>>
>>> One of the benefits of using current->audit_context is that we get a
>>> lot of this info from the associated SYSCALL record (assuming the
>>> admin isn't filtering that, e.g. Fedora defaults).  We can safely drop
>>> most everything except for the "op" and "actions" fields.
>>>
>>> Steve might also want an "old-actions" field, but I'll let him speak to
>>> that.
>>
>> Configuration changes are supposed to show current and new values.
>>
>> -Steve

All of the feedback received for this patch set is addressed in v2:

 https://lkml.kernel.org/r/<1525276400-7161-1-git-send-email-tyhicks@canonical.com>
Thanks for the reviews!

Tyler


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]