From: Chris Mason <clm@fb.com> To: Paul Moore <paul@paul-moore.com> Cc: Eric Paris <eparis@redhat.com>, Dave Jones <davej@codemonkey.org.uk>, <linux-audit@redhat.com>, Kyle McMartin <jkkm@fb.com>, <linux-kernel@vger.kernel.org>, Chris Mason <clm@fb.com> Subject: [PATCH] audit: set context->dummy even when audit is off Date: Thu, 31 Oct 2019 09:39:31 -0700 [thread overview] Message-ID: <20191031163931.1102669-1-clm@fb.com> (raw) In-Reply-To: <CAHC9VhTyz7fd+iQaymVXUGFe3ZA5Z_WkJeY_snDYiZ9GP6gCOA@mail.gmail.com> Dave Jones reported that we're finding a considerable amount of dmesg traffic from NTP time adjustments being reported through the audit subsystem. His original post is here: https://lore.kernel.org/lkml/20190923155041.GA14807@codemonkey.org.uk/ The confusing part is that we're seeing this on machines that don't have audit on. The NTP code uses audit_dummy_context() to decide if it should log things: static inline void audit_ntp_log(const struct audit_ntp_data *ad) { if (!audit_dummy_context()) __audit_ntp_log(ad); } I confirmed with perf probes that: context->dummy = 0 audit_n_rules = 0 audit_enabled = 0 audit_ever_enabled = 1 // seems to be from journald The box boots, journald turns audit on, some time later our configuration management runs around and turns audit off. This journald feature is discussed here: https://github.com/systemd/systemd/issues/959 From what I can tell, audit_syscall_entry is responsible for setting context->dummy, but we never get down to the test for audit_n_rules: __audit_syscall_entry(int major, unsigned long a1, unsigned long a2, unsigned long a3, unsigned long a4) { struct audit_context *context = audit_context(); enum audit_state state; if (!audit_enabled || !context) return; ^^^^^^^^^^^^^^^^^^ --- we bail here [ ... ] context->dummy = !audit_n_rules; This leaves context->dummy at 0, which appears to be the original value from kzalloc(). If you've gotten this far, you've read everything I know about the audit code. With that said, my preference is to make a single source of truth for decisions about logging. This commit changes __audit_syscall_entry() to set context->dummy when audit is off. Reported-by: Dave Jones <davej@codemonkey.org.uk> Signed-off-by: Chris Mason <clm@fb.com> --- kernel/auditsc.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 4effe01ebbe2..a5c82d8f9c2b 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1631,8 +1631,19 @@ void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2, struct audit_context *context = audit_context(); enum audit_state state; - if (!audit_enabled || !context) + if (!context) + return; + + if (!audit_enabled) { + /* + * ntp clock adjustments and a few other places check for + * a dummy context without checking to see if audit + * is enabled. Make sure we set context->dummy when audit + * is off, otherwise they will try to log things. + */ + context->dummy = 1; return; + } BUG_ON(context->in_syscall || context->name_count); -- 2.17.1
WARNING: multiple messages have this Message-ID (diff)
From: Chris Mason <clm@fb.com> To: Paul Moore <paul@paul-moore.com> Cc: Eric Paris <eparis@redhat.com>, Dave Jones <davej@codemonkey.org.uk>, linux-audit@redhat.com, Kyle McMartin <jkkm@fb.com>, linux-kernel@vger.kernel.org, Chris Mason <clm@fb.com> Subject: [PATCH] audit: set context->dummy even when audit is off Date: Thu, 31 Oct 2019 09:39:31 -0700 [thread overview] Message-ID: <20191031163931.1102669-1-clm@fb.com> (raw) In-Reply-To: <CAHC9VhTyz7fd+iQaymVXUGFe3ZA5Z_WkJeY_snDYiZ9GP6gCOA@mail.gmail.com> Dave Jones reported that we're finding a considerable amount of dmesg traffic from NTP time adjustments being reported through the audit subsystem. His original post is here: https://lore.kernel.org/lkml/20190923155041.GA14807@codemonkey.org.uk/ The confusing part is that we're seeing this on machines that don't have audit on. The NTP code uses audit_dummy_context() to decide if it should log things: static inline void audit_ntp_log(const struct audit_ntp_data *ad) { if (!audit_dummy_context()) __audit_ntp_log(ad); } I confirmed with perf probes that: context->dummy = 0 audit_n_rules = 0 audit_enabled = 0 audit_ever_enabled = 1 // seems to be from journald The box boots, journald turns audit on, some time later our configuration management runs around and turns audit off. This journald feature is discussed here: https://github.com/systemd/systemd/issues/959 >From what I can tell, audit_syscall_entry is responsible for setting context->dummy, but we never get down to the test for audit_n_rules: __audit_syscall_entry(int major, unsigned long a1, unsigned long a2, unsigned long a3, unsigned long a4) { struct audit_context *context = audit_context(); enum audit_state state; if (!audit_enabled || !context) return; ^^^^^^^^^^^^^^^^^^ --- we bail here [ ... ] context->dummy = !audit_n_rules; This leaves context->dummy at 0, which appears to be the original value from kzalloc(). If you've gotten this far, you've read everything I know about the audit code. With that said, my preference is to make a single source of truth for decisions about logging. This commit changes __audit_syscall_entry() to set context->dummy when audit is off. Reported-by: Dave Jones <davej@codemonkey.org.uk> Signed-off-by: Chris Mason <clm@fb.com> --- kernel/auditsc.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 4effe01ebbe2..a5c82d8f9c2b 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1631,8 +1631,19 @@ void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2, struct audit_context *context = audit_context(); enum audit_state state; - if (!audit_enabled || !context) + if (!context) + return; + + if (!audit_enabled) { + /* + * ntp clock adjustments and a few other places check for + * a dummy context without checking to see if audit + * is enabled. Make sure we set context->dummy when audit + * is off, otherwise they will try to log things. + */ + context->dummy = 1; return; + } BUG_ON(context->in_syscall || context->name_count); -- 2.17.1
next prev parent reply other threads:[~2019-10-31 16:40 UTC|newest] Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-09-23 15:50 ntp audit spew Dave Jones 2019-09-23 16:14 ` Paul Moore 2019-09-23 16:58 ` Dave Jones 2019-09-23 18:57 ` Paul Moore 2019-09-23 19:49 ` Dave Jones 2019-09-23 19:49 ` Eric Paris 2019-09-24 2:39 ` Paul Moore 2019-09-24 13:30 ` Steve Grubb 2019-09-23 21:00 ` Richard Guy Briggs 2019-09-24 3:01 ` Paul Moore 2019-09-24 13:50 ` Richard Guy Briggs 2019-09-24 17:05 ` Paul Moore 2019-09-26 15:50 ` Paul Moore 2019-09-24 13:19 ` Steve Grubb 2019-09-24 17:01 ` Paul Moore 2019-10-31 16:39 ` Chris Mason [this message] 2019-10-31 16:39 ` [PATCH] audit: set context->dummy even when audit is off Chris Mason 2019-10-31 23:27 ` Paul Moore 2019-11-01 13:24 ` Chris Mason 2019-11-01 14:16 ` Steve Grubb 2019-11-01 14:26 ` Lenny Bruzenak 2019-11-01 14:49 ` Steve Grubb 2019-11-01 14:58 ` Lenny Bruzenak 2019-11-01 15:55 ` Chris Mason 2019-11-05 0:15 ` Paul Moore 2019-11-05 0:39 ` Chris Mason 2019-11-05 0:45 ` Paul Moore
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20191031163931.1102669-1-clm@fb.com \ --to=clm@fb.com \ --cc=davej@codemonkey.org.uk \ --cc=eparis@redhat.com \ --cc=jkkm@fb.com \ --cc=linux-audit@redhat.com \ --cc=linux-kernel@vger.kernel.org \ --cc=paul@paul-moore.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.