From: Richard Guy Briggs <rgb@redhat.com> To: Paul Moore <paul@paul-moore.com> Cc: Linux-Audit Mailing List <linux-audit@redhat.com>, LKML <linux-kernel@vger.kernel.org>, netfilter-devel@vger.kernel.org, Eric Paris <eparis@parisplace.org>, Steve Grubb <sgrubb@redhat.com>, Florian Westphal <fw@strlen.de>, Phil Sutter <phil@nwl.cc>, twoerner@redhat.com, tgraf@infradead.org, dan.carpenter@oracle.com, Jones Desougi <jones.desougi+netfilter@gmail.com> Subject: Re: [PATCH v3] audit: log nftables configuration change events once per table Date: Wed, 24 Mar 2021 23:15:32 -0400 [thread overview] Message-ID: <20210325031532.GU3141668@madcap2.tricolour.ca> (raw) In-Reply-To: <CAHC9VhTtkar8zt9JP2o0EX5R5bpHaX45=tNtCLuaDNcwtV8baQ@mail.gmail.com> On 2021-03-24 12:32, Paul Moore wrote: > On Tue, Mar 23, 2021 at 4:05 PM Richard Guy Briggs <rgb@redhat.com> wrote: > > > > Reduce logging of nftables events to a level similar to iptables. > > Restore the table field to list the table, adding the generation. > > > > Indicate the op as the most significant operation in the event. > > > > A couple of sample events: > > > > type=PROCTITLE msg=audit(2021-03-18 09:30:49.801:143) : proctitle=/usr/bin/python3 -s /usr/sbin/firewalld --nofork --nopid > > type=SYSCALL msg=audit(2021-03-18 09:30:49.801:143) : arch=x86_64 syscall=sendmsg success=yes exit=172 a0=0x6 a1=0x7ffdcfcbe650 a2=0x0 a3=0x7ffdcfcbd52c items=0 ppid=1 pid=367 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=roo > > t sgid=root fsgid=root tty=(none) ses=unset comm=firewalld exe=/usr/bin/python3.9 subj=system_u:system_r:firewalld_t:s0 key=(null) > > type=NETFILTER_CFG msg=audit(2021-03-18 09:30:49.801:143) : table=firewalld:2 family=ipv6 entries=1 op=nft_register_table pid=367 subj=system_u:system_r:firewalld_t:s0 comm=firewalld > > type=NETFILTER_CFG msg=audit(2021-03-18 09:30:49.801:143) : table=firewalld:2 family=ipv4 entries=1 op=nft_register_table pid=367 subj=system_u:system_r:firewalld_t:s0 comm=firewalld > > type=NETFILTER_CFG msg=audit(2021-03-18 09:30:49.801:143) : table=firewalld:2 family=inet entries=1 op=nft_register_table pid=367 subj=system_u:system_r:firewalld_t:s0 comm=firewalld > > > > type=PROCTITLE msg=audit(2021-03-18 09:30:49.839:144) : proctitle=/usr/bin/python3 -s /usr/sbin/firewalld --nofork --nopid > > type=SYSCALL msg=audit(2021-03-18 09:30:49.839:144) : arch=x86_64 syscall=sendmsg success=yes exit=22792 a0=0x6 a1=0x7ffdcfcbe650 a2=0x0 a3=0x7ffdcfcbd52c items=0 ppid=1 pid=367 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=r > > oot sgid=root fsgid=root tty=(none) ses=unset comm=firewalld exe=/usr/bin/python3.9 subj=system_u:system_r:firewalld_t:s0 key=(null) > > type=NETFILTER_CFG msg=audit(2021-03-18 09:30:49.839:144) : table=firewalld:3 family=ipv6 entries=30 op=nft_register_chain pid=367 subj=system_u:system_r:firewalld_t:s0 comm=firewalld > > type=NETFILTER_CFG msg=audit(2021-03-18 09:30:49.839:144) : table=firewalld:3 family=ipv4 entries=30 op=nft_register_chain pid=367 subj=system_u:system_r:firewalld_t:s0 comm=firewalld > > type=NETFILTER_CFG msg=audit(2021-03-18 09:30:49.839:144) : table=firewalld:3 family=inet entries=165 op=nft_register_chain pid=367 subj=system_u:system_r:firewalld_t:s0 comm=firewalld > > > > The issue was originally documented in > > https://github.com/linux-audit/audit-kernel/issues/124 > > > > Signed-off-by: Richard Guy Briggs <rgb@redhat.com> > > --- > > Changelog: > > v3: > > - fix function braces, reduce parameter scope > > - pre-allocate nft_audit_data per table in step 1, bail on ENOMEM > > > > v2: > > - convert NFT ops to array indicies in nft2audit_op[] > > - use linux lists > > - use functions for each of collection and logging of audit data > > --- > > include/linux/audit.h | 28 ++++++ > > net/netfilter/nf_tables_api.c | 160 ++++++++++++++++------------------ > > 2 files changed, 105 insertions(+), 83 deletions(-) > > ... > > > diff --git a/include/linux/audit.h b/include/linux/audit.h > > index 82b7c1116a85..5fafcf4c13de 100644 > > --- a/include/linux/audit.h > > +++ b/include/linux/audit.h > > @@ -118,6 +118,34 @@ enum audit_nfcfgop { > > AUDIT_NFT_OP_INVALID, > > }; > > > > +static const u8 nft2audit_op[NFT_MSG_MAX] = { // enum nf_tables_msg_types > > + [NFT_MSG_NEWTABLE] = AUDIT_NFT_OP_TABLE_REGISTER, > > + [NFT_MSG_GETTABLE] = AUDIT_NFT_OP_INVALID, > > + [NFT_MSG_DELTABLE] = AUDIT_NFT_OP_TABLE_UNREGISTER, > > + [NFT_MSG_NEWCHAIN] = AUDIT_NFT_OP_CHAIN_REGISTER, > > + [NFT_MSG_GETCHAIN] = AUDIT_NFT_OP_INVALID, > > + [NFT_MSG_DELCHAIN] = AUDIT_NFT_OP_CHAIN_UNREGISTER, > > + [NFT_MSG_NEWRULE] = AUDIT_NFT_OP_RULE_REGISTER, > > + [NFT_MSG_GETRULE] = AUDIT_NFT_OP_INVALID, > > + [NFT_MSG_DELRULE] = AUDIT_NFT_OP_RULE_UNREGISTER, > > + [NFT_MSG_NEWSET] = AUDIT_NFT_OP_SET_REGISTER, > > + [NFT_MSG_GETSET] = AUDIT_NFT_OP_INVALID, > > + [NFT_MSG_DELSET] = AUDIT_NFT_OP_SET_UNREGISTER, > > + [NFT_MSG_NEWSETELEM] = AUDIT_NFT_OP_SETELEM_REGISTER, > > + [NFT_MSG_GETSETELEM] = AUDIT_NFT_OP_INVALID, > > + [NFT_MSG_DELSETELEM] = AUDIT_NFT_OP_SETELEM_UNREGISTER, > > + [NFT_MSG_NEWGEN] = AUDIT_NFT_OP_GEN_REGISTER, > > + [NFT_MSG_GETGEN] = AUDIT_NFT_OP_INVALID, > > + [NFT_MSG_TRACE] = AUDIT_NFT_OP_INVALID, > > + [NFT_MSG_NEWOBJ] = AUDIT_NFT_OP_OBJ_REGISTER, > > + [NFT_MSG_GETOBJ] = AUDIT_NFT_OP_INVALID, > > + [NFT_MSG_DELOBJ] = AUDIT_NFT_OP_OBJ_UNREGISTER, > > + [NFT_MSG_GETOBJ_RESET] = AUDIT_NFT_OP_OBJ_RESET, > > + [NFT_MSG_NEWFLOWTABLE] = AUDIT_NFT_OP_FLOWTABLE_REGISTER, > > + [NFT_MSG_GETFLOWTABLE] = AUDIT_NFT_OP_INVALID, > > + [NFT_MSG_DELFLOWTABLE] = AUDIT_NFT_OP_FLOWTABLE_UNREGISTER, > > +}; > > The previously reported problem with this as a static still exists, > correct? It does seem like this should live in nf_tables_api.c > doesn't it? Yes. Thank you. > paul moore - RGB -- Richard Guy Briggs <rgb@redhat.com> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635
WARNING: multiple messages have this Message-ID (diff)
From: Richard Guy Briggs <rgb@redhat.com> To: Paul Moore <paul@paul-moore.com> Cc: Jones Desougi <jones.desougi+netfilter@gmail.com>, Phil Sutter <phil@nwl.cc>, Florian Westphal <fw@strlen.de>, LKML <linux-kernel@vger.kernel.org>, Linux-Audit Mailing List <linux-audit@redhat.com>, netfilter-devel@vger.kernel.org, twoerner@redhat.com, Eric Paris <eparis@parisplace.org>, tgraf@infradead.org, dan.carpenter@oracle.com Subject: Re: [PATCH v3] audit: log nftables configuration change events once per table Date: Wed, 24 Mar 2021 23:15:32 -0400 [thread overview] Message-ID: <20210325031532.GU3141668@madcap2.tricolour.ca> (raw) In-Reply-To: <CAHC9VhTtkar8zt9JP2o0EX5R5bpHaX45=tNtCLuaDNcwtV8baQ@mail.gmail.com> On 2021-03-24 12:32, Paul Moore wrote: > On Tue, Mar 23, 2021 at 4:05 PM Richard Guy Briggs <rgb@redhat.com> wrote: > > > > Reduce logging of nftables events to a level similar to iptables. > > Restore the table field to list the table, adding the generation. > > > > Indicate the op as the most significant operation in the event. > > > > A couple of sample events: > > > > type=PROCTITLE msg=audit(2021-03-18 09:30:49.801:143) : proctitle=/usr/bin/python3 -s /usr/sbin/firewalld --nofork --nopid > > type=SYSCALL msg=audit(2021-03-18 09:30:49.801:143) : arch=x86_64 syscall=sendmsg success=yes exit=172 a0=0x6 a1=0x7ffdcfcbe650 a2=0x0 a3=0x7ffdcfcbd52c items=0 ppid=1 pid=367 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=roo > > t sgid=root fsgid=root tty=(none) ses=unset comm=firewalld exe=/usr/bin/python3.9 subj=system_u:system_r:firewalld_t:s0 key=(null) > > type=NETFILTER_CFG msg=audit(2021-03-18 09:30:49.801:143) : table=firewalld:2 family=ipv6 entries=1 op=nft_register_table pid=367 subj=system_u:system_r:firewalld_t:s0 comm=firewalld > > type=NETFILTER_CFG msg=audit(2021-03-18 09:30:49.801:143) : table=firewalld:2 family=ipv4 entries=1 op=nft_register_table pid=367 subj=system_u:system_r:firewalld_t:s0 comm=firewalld > > type=NETFILTER_CFG msg=audit(2021-03-18 09:30:49.801:143) : table=firewalld:2 family=inet entries=1 op=nft_register_table pid=367 subj=system_u:system_r:firewalld_t:s0 comm=firewalld > > > > type=PROCTITLE msg=audit(2021-03-18 09:30:49.839:144) : proctitle=/usr/bin/python3 -s /usr/sbin/firewalld --nofork --nopid > > type=SYSCALL msg=audit(2021-03-18 09:30:49.839:144) : arch=x86_64 syscall=sendmsg success=yes exit=22792 a0=0x6 a1=0x7ffdcfcbe650 a2=0x0 a3=0x7ffdcfcbd52c items=0 ppid=1 pid=367 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=r > > oot sgid=root fsgid=root tty=(none) ses=unset comm=firewalld exe=/usr/bin/python3.9 subj=system_u:system_r:firewalld_t:s0 key=(null) > > type=NETFILTER_CFG msg=audit(2021-03-18 09:30:49.839:144) : table=firewalld:3 family=ipv6 entries=30 op=nft_register_chain pid=367 subj=system_u:system_r:firewalld_t:s0 comm=firewalld > > type=NETFILTER_CFG msg=audit(2021-03-18 09:30:49.839:144) : table=firewalld:3 family=ipv4 entries=30 op=nft_register_chain pid=367 subj=system_u:system_r:firewalld_t:s0 comm=firewalld > > type=NETFILTER_CFG msg=audit(2021-03-18 09:30:49.839:144) : table=firewalld:3 family=inet entries=165 op=nft_register_chain pid=367 subj=system_u:system_r:firewalld_t:s0 comm=firewalld > > > > The issue was originally documented in > > https://github.com/linux-audit/audit-kernel/issues/124 > > > > Signed-off-by: Richard Guy Briggs <rgb@redhat.com> > > --- > > Changelog: > > v3: > > - fix function braces, reduce parameter scope > > - pre-allocate nft_audit_data per table in step 1, bail on ENOMEM > > > > v2: > > - convert NFT ops to array indicies in nft2audit_op[] > > - use linux lists > > - use functions for each of collection and logging of audit data > > --- > > include/linux/audit.h | 28 ++++++ > > net/netfilter/nf_tables_api.c | 160 ++++++++++++++++------------------ > > 2 files changed, 105 insertions(+), 83 deletions(-) > > ... > > > diff --git a/include/linux/audit.h b/include/linux/audit.h > > index 82b7c1116a85..5fafcf4c13de 100644 > > --- a/include/linux/audit.h > > +++ b/include/linux/audit.h > > @@ -118,6 +118,34 @@ enum audit_nfcfgop { > > AUDIT_NFT_OP_INVALID, > > }; > > > > +static const u8 nft2audit_op[NFT_MSG_MAX] = { // enum nf_tables_msg_types > > + [NFT_MSG_NEWTABLE] = AUDIT_NFT_OP_TABLE_REGISTER, > > + [NFT_MSG_GETTABLE] = AUDIT_NFT_OP_INVALID, > > + [NFT_MSG_DELTABLE] = AUDIT_NFT_OP_TABLE_UNREGISTER, > > + [NFT_MSG_NEWCHAIN] = AUDIT_NFT_OP_CHAIN_REGISTER, > > + [NFT_MSG_GETCHAIN] = AUDIT_NFT_OP_INVALID, > > + [NFT_MSG_DELCHAIN] = AUDIT_NFT_OP_CHAIN_UNREGISTER, > > + [NFT_MSG_NEWRULE] = AUDIT_NFT_OP_RULE_REGISTER, > > + [NFT_MSG_GETRULE] = AUDIT_NFT_OP_INVALID, > > + [NFT_MSG_DELRULE] = AUDIT_NFT_OP_RULE_UNREGISTER, > > + [NFT_MSG_NEWSET] = AUDIT_NFT_OP_SET_REGISTER, > > + [NFT_MSG_GETSET] = AUDIT_NFT_OP_INVALID, > > + [NFT_MSG_DELSET] = AUDIT_NFT_OP_SET_UNREGISTER, > > + [NFT_MSG_NEWSETELEM] = AUDIT_NFT_OP_SETELEM_REGISTER, > > + [NFT_MSG_GETSETELEM] = AUDIT_NFT_OP_INVALID, > > + [NFT_MSG_DELSETELEM] = AUDIT_NFT_OP_SETELEM_UNREGISTER, > > + [NFT_MSG_NEWGEN] = AUDIT_NFT_OP_GEN_REGISTER, > > + [NFT_MSG_GETGEN] = AUDIT_NFT_OP_INVALID, > > + [NFT_MSG_TRACE] = AUDIT_NFT_OP_INVALID, > > + [NFT_MSG_NEWOBJ] = AUDIT_NFT_OP_OBJ_REGISTER, > > + [NFT_MSG_GETOBJ] = AUDIT_NFT_OP_INVALID, > > + [NFT_MSG_DELOBJ] = AUDIT_NFT_OP_OBJ_UNREGISTER, > > + [NFT_MSG_GETOBJ_RESET] = AUDIT_NFT_OP_OBJ_RESET, > > + [NFT_MSG_NEWFLOWTABLE] = AUDIT_NFT_OP_FLOWTABLE_REGISTER, > > + [NFT_MSG_GETFLOWTABLE] = AUDIT_NFT_OP_INVALID, > > + [NFT_MSG_DELFLOWTABLE] = AUDIT_NFT_OP_FLOWTABLE_UNREGISTER, > > +}; > > The previously reported problem with this as a static still exists, > correct? It does seem like this should live in nf_tables_api.c > doesn't it? Yes. Thank you. > paul moore - RGB -- Richard Guy Briggs <rgb@redhat.com> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635 -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit
next prev parent reply other threads:[~2021-03-25 3:16 UTC|newest] Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-03-23 20:04 [PATCH v3] audit: log nftables configuration change events once per table Richard Guy Briggs 2021-03-23 20:04 ` Richard Guy Briggs 2021-03-23 21:36 ` Florian Westphal 2021-03-23 21:36 ` Florian Westphal 2021-03-24 16:32 ` Paul Moore 2021-03-24 16:32 ` Paul Moore 2021-03-25 3:15 ` Richard Guy Briggs [this message] 2021-03-25 3:15 ` Richard Guy Briggs
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20210325031532.GU3141668@madcap2.tricolour.ca \ --to=rgb@redhat.com \ --cc=dan.carpenter@oracle.com \ --cc=eparis@parisplace.org \ --cc=fw@strlen.de \ --cc=jones.desougi+netfilter@gmail.com \ --cc=linux-audit@redhat.com \ --cc=linux-kernel@vger.kernel.org \ --cc=netfilter-devel@vger.kernel.org \ --cc=paul@paul-moore.com \ --cc=phil@nwl.cc \ --cc=sgrubb@redhat.com \ --cc=tgraf@infradead.org \ --cc=twoerner@redhat.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.