From: Richard Guy Briggs <rgb@redhat.com> To: Paul Moore <paul@paul-moore.com> Cc: Linux-Audit Mailing List <linux-audit@redhat.com>, LKML <linux-kernel@vger.kernel.org>, netfilter-devel@vger.kernel.org, sgrubb@redhat.com, Ondrej Mosnacek <omosnace@redhat.com>, fw@strlen.de, twoerner@redhat.com, Eric Paris <eparis@parisplace.org>, tgraf@infradead.org Subject: Re: [PATCH ghak25 v5] audit: add subj creds to NETFILTER_CFG record to cover async unregister Date: Tue, 19 May 2020 15:44:57 -0400 [thread overview] Message-ID: <20200519194457.nouzteqv2vpcqnta@madcap2.tricolour.ca> (raw) In-Reply-To: <CAHC9VhQYUooJbZ9tcOOwb=48LTjtnfo0g11vQuyLzoxdetaxnw@mail.gmail.com> On 2020-05-19 15:18, Paul Moore wrote: > On Tue, May 19, 2020 at 11:31 AM Richard Guy Briggs <rgb@redhat.com> wrote: > > Some table unregister actions seem to be initiated by the kernel to > > garbage collect unused tables that are not initiated by any userspace > > actions. It was found to be necessary to add the subject credentials to > > cover this case to reveal the source of these actions. A sample record: > > > > The tty, ses and exe fields have not been included since they are in the > > SYSCALL record and contain nothing useful in the non-user context. > > > > type=NETFILTER_CFG msg=audit(2020-03-11 21:25:21.491:269) : table=nat family=bridge entries=0 op=unregister pid=153 uid=root auid=unset subj=system_u:system_r:kernel_t:s0 comm=kworker/u4:2 > > Based on where things were left in the discussion on the previous > draft, I think it would be good if you could explain a bit why the uid > and auid fields are useful here. They aren't really useful here. I was hoping to remove them given your reasoning, but I was having trouble guessing what you wanted even after asking for clarity. Can you clarify what you would prefer to see in this patch? I was hoping to skip this extra patch revision which took longer than hoped due to trying to guess what you wanted while working yesterday during a public holiday to get this patch out in time for the merge window. A UID of 0="root" is really a bit misleading since while it is the most trusted user running the most privileged level, the event wasn't triggered by a user. It is the default value of that field. I did think aloud that uid could be set by the kernel to run under a particular user's id (like a daemon dropping capabilities and switching user after setup to limit abuse), but the kernel is just a tracker for these IDs and doesn't really know what they mean other than root. I saw no reply to that idea. It was set to "root" which isn't unset or unexpected, but granted is useless in this case. You had offered that keeping auid was a concession to Steve so I kept it in since I had the impression that is what you wanted to see. That explanation seems pretty thin to include in a patch description if what you are getting at in your sentence above. I am willing to purge both if that is what you would prefer to accept in the patch. > paul moore - RGB -- Richard Guy Briggs <rgb@redhat.com> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635
WARNING: multiple messages have this Message-ID (diff)
From: Richard Guy Briggs <rgb@redhat.com> To: Paul Moore <paul@paul-moore.com> Cc: fw@strlen.de, LKML <linux-kernel@vger.kernel.org>, Linux-Audit Mailing List <linux-audit@redhat.com>, netfilter-devel@vger.kernel.org, twoerner@redhat.com, Eric Paris <eparis@parisplace.org>, tgraf@infradead.org Subject: Re: [PATCH ghak25 v5] audit: add subj creds to NETFILTER_CFG record to cover async unregister Date: Tue, 19 May 2020 15:44:57 -0400 [thread overview] Message-ID: <20200519194457.nouzteqv2vpcqnta@madcap2.tricolour.ca> (raw) In-Reply-To: <CAHC9VhQYUooJbZ9tcOOwb=48LTjtnfo0g11vQuyLzoxdetaxnw@mail.gmail.com> On 2020-05-19 15:18, Paul Moore wrote: > On Tue, May 19, 2020 at 11:31 AM Richard Guy Briggs <rgb@redhat.com> wrote: > > Some table unregister actions seem to be initiated by the kernel to > > garbage collect unused tables that are not initiated by any userspace > > actions. It was found to be necessary to add the subject credentials to > > cover this case to reveal the source of these actions. A sample record: > > > > The tty, ses and exe fields have not been included since they are in the > > SYSCALL record and contain nothing useful in the non-user context. > > > > type=NETFILTER_CFG msg=audit(2020-03-11 21:25:21.491:269) : table=nat family=bridge entries=0 op=unregister pid=153 uid=root auid=unset subj=system_u:system_r:kernel_t:s0 comm=kworker/u4:2 > > Based on where things were left in the discussion on the previous > draft, I think it would be good if you could explain a bit why the uid > and auid fields are useful here. They aren't really useful here. I was hoping to remove them given your reasoning, but I was having trouble guessing what you wanted even after asking for clarity. Can you clarify what you would prefer to see in this patch? I was hoping to skip this extra patch revision which took longer than hoped due to trying to guess what you wanted while working yesterday during a public holiday to get this patch out in time for the merge window. A UID of 0="root" is really a bit misleading since while it is the most trusted user running the most privileged level, the event wasn't triggered by a user. It is the default value of that field. I did think aloud that uid could be set by the kernel to run under a particular user's id (like a daemon dropping capabilities and switching user after setup to limit abuse), but the kernel is just a tracker for these IDs and doesn't really know what they mean other than root. I saw no reply to that idea. It was set to "root" which isn't unset or unexpected, but granted is useless in this case. You had offered that keeping auid was a concession to Steve so I kept it in since I had the impression that is what you wanted to see. That explanation seems pretty thin to include in a patch description if what you are getting at in your sentence above. I am willing to purge both if that is what you would prefer to accept in the patch. > paul moore - RGB -- Richard Guy Briggs <rgb@redhat.com> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635 -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit
next prev parent reply other threads:[~2020-05-19 19:45 UTC|newest] Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-05-19 15:30 [PATCH ghak25 v5] audit: add subj creds to NETFILTER_CFG record to cover async unregister Richard Guy Briggs 2020-05-19 15:30 ` Richard Guy Briggs 2020-05-19 19:18 ` Paul Moore 2020-05-19 19:18 ` Paul Moore 2020-05-19 19:44 ` Richard Guy Briggs [this message] 2020-05-19 19:44 ` Richard Guy Briggs 2020-05-19 19:59 ` Paul Moore 2020-05-19 19:59 ` Paul Moore
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20200519194457.nouzteqv2vpcqnta@madcap2.tricolour.ca \ --to=rgb@redhat.com \ --cc=eparis@parisplace.org \ --cc=fw@strlen.de \ --cc=linux-audit@redhat.com \ --cc=linux-kernel@vger.kernel.org \ --cc=netfilter-devel@vger.kernel.org \ --cc=omosnace@redhat.com \ --cc=paul@paul-moore.com \ --cc=sgrubb@redhat.com \ --cc=tgraf@infradead.org \ --cc=twoerner@redhat.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.