From: Richard Guy Briggs <rgb@redhat.com> To: containers@lists.linux-foundation.org, linux-api@vger.kernel.org, Linux-Audit Mailing List <linux-audit@redhat.com>, linux-fsdevel@vger.kernel.org, LKML <linux-kernel@vger.kernel.org>, netdev@vger.kernel.org, netfilter-devel@vger.kernel.org Cc: Paul Moore <paul@paul-moore.com>, sgrubb@redhat.com, omosnace@redhat.com, dhowells@redhat.com, simo@redhat.com, eparis@parisplace.org, serge@hallyn.com, ebiederm@xmission.com, nhorman@tuxdriver.com, Richard Guy Briggs <rgb@redhat.com> Subject: [PATCH ghak90 V5 10/10] audit: NETFILTER_PKT: record each container ID associated with a netNS Date: Fri, 15 Mar 2019 14:29:58 -0400 [thread overview] Message-ID: <56127b2a5b82f15cb0d0f040502c2e3bb6945f30.1552665316.git.rgb@redhat.com> (raw) In-Reply-To: <cover.1552665316.git.rgb@redhat.com> In-Reply-To: <cover.1552665316.git.rgb@redhat.com> Add audit container identifier auxiliary record(s) to NETFILTER_PKT event standalone records. Iterate through all potential audit container identifiers associated with a network namespace. Signed-off-by: Richard Guy Briggs <rgb@redhat.com> --- include/linux/audit.h | 5 +++++ kernel/audit.c | 41 +++++++++++++++++++++++++++++++++++++++++ net/netfilter/nft_log.c | 11 +++++++++-- net/netfilter/xt_AUDIT.c | 11 +++++++++-- 4 files changed, 64 insertions(+), 4 deletions(-) diff --git a/include/linux/audit.h b/include/linux/audit.h index 70255c2dfb9f..723e2d020228 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -214,6 +214,8 @@ static inline u64 audit_get_contid(struct task_struct *tsk) extern void audit_netns_contid_del(struct net *net, u64 contid); extern void audit_switch_task_namespaces(struct nsproxy *ns, struct task_struct *p); +extern void audit_log_netns_contid_list(struct net *net, + struct audit_context *context); extern u32 audit_enabled; #else /* CONFIG_AUDIT */ @@ -290,6 +292,9 @@ static inline void audit_netns_contid_del(struct net *net, u64 contid) static inline void audit_switch_task_namespaces(struct nsproxy *ns, struct task_struct *p) { } +static inline void audit_log_netns_contid_list(struct net *net, + struct audit_context *context) +{ } #define audit_enabled AUDIT_OFF #endif /* CONFIG_AUDIT */ diff --git a/kernel/audit.c b/kernel/audit.c index 7fa3194f5342..80ed323feeb5 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -451,6 +451,47 @@ void audit_switch_task_namespaces(struct nsproxy *ns, struct task_struct *p) audit_netns_contid_add(new->net_ns, contid); } +/** + * audit_log_netns_contid_list - List contids for the given network namespace + * @net: the network namespace of interest + * @context: the audit context to use + * + * Description: + * Issues a CONTAINER_ID record with a CSV list of contids associated + * with a network namespace to accompany a NETFILTER_PKT record. + */ +void audit_log_netns_contid_list(struct net *net, struct audit_context *context) +{ + struct audit_buffer *ab = NULL; + struct audit_contid *cont; + bool first = true; + struct audit_net *aunet; + + /* Generate AUDIT_CONTAINER_ID record with container ID CSV list */ + rcu_read_lock(); + aunet = net_generic(net, audit_net_id); + if (!aunet) + goto out; + list_for_each_entry_rcu(cont, &aunet->contid_list, list) { + if (first) { + ab = audit_log_start(context, GFP_ATOMIC, + AUDIT_CONTAINER_ID); + if (!ab) { + audit_log_lost("out of memory in audit_log_netns_contid_list"); + goto out; + } + audit_log_format(ab, "contid="); + } else + audit_log_format(ab, ","); + audit_log_format(ab, "%llu", cont->id); + first = false; + } + audit_log_end(ab); +out: + rcu_read_unlock(); +} +EXPORT_SYMBOL(audit_log_netns_contid_list); + void audit_panic(const char *message) { switch (audit_failure) { diff --git a/net/netfilter/nft_log.c b/net/netfilter/nft_log.c index 655187bed5d8..bdb1ec2368a7 100644 --- a/net/netfilter/nft_log.c +++ b/net/netfilter/nft_log.c @@ -69,13 +69,16 @@ static void nft_log_eval_audit(const struct nft_pktinfo *pkt) struct sk_buff *skb = pkt->skb; struct audit_buffer *ab; int fam = -1; + struct audit_context *context; + struct net *net; if (!audit_enabled) return; - ab = audit_log_start(NULL, GFP_ATOMIC, AUDIT_NETFILTER_PKT); + context = audit_alloc_local(GFP_ATOMIC); + ab = audit_log_start(context, GFP_ATOMIC, AUDIT_NETFILTER_PKT); if (!ab) - return; + goto errout; audit_log_format(ab, "mark=%#x", skb->mark); @@ -102,6 +105,10 @@ static void nft_log_eval_audit(const struct nft_pktinfo *pkt) audit_log_format(ab, " saddr=? daddr=? proto=-1"); audit_log_end(ab); + net = xt_net(&pkt->xt); + audit_log_netns_contid_list(net, context); +errout: + audit_free_context(context); } static void nft_log_eval(const struct nft_expr *expr, diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c index af883f1b64f9..a3e547435f13 100644 --- a/net/netfilter/xt_AUDIT.c +++ b/net/netfilter/xt_AUDIT.c @@ -71,10 +71,13 @@ static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb) { struct audit_buffer *ab; int fam = -1; + struct audit_context *context; + struct net *net; if (audit_enabled == AUDIT_OFF) - goto errout; - ab = audit_log_start(NULL, GFP_ATOMIC, AUDIT_NETFILTER_PKT); + goto out; + context = audit_alloc_local(GFP_ATOMIC); + ab = audit_log_start(context, GFP_ATOMIC, AUDIT_NETFILTER_PKT); if (ab == NULL) goto errout; @@ -104,7 +107,11 @@ static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb) audit_log_end(ab); + net = xt_net(par); + audit_log_netns_contid_list(net, context); errout: + audit_free_context(context); +out: return XT_CONTINUE; } -- 1.8.3.1
WARNING: multiple messages have this Message-ID (diff)
From: Richard Guy Briggs <rgb@redhat.com> To: containers@lists.linux-foundation.org, linux-api@vger.kernel.org, Linux-Audit Mailing List <linux-audit@redhat.com>, linux-fsdevel@vger.kernel.org, LKML <linux-kernel@vger.kernel.org>, netdev@vger.kernel.org, netfilter-devel@vger.kernel.org Cc: nhorman@tuxdriver.com, Richard Guy Briggs <rgb@redhat.com>, dhowells@redhat.com, ebiederm@xmission.com, simo@redhat.com, eparis@parisplace.org, serge@hallyn.com Subject: [PATCH ghak90 V5 10/10] audit: NETFILTER_PKT: record each container ID associated with a netNS Date: Fri, 15 Mar 2019 14:29:58 -0400 [thread overview] Message-ID: <56127b2a5b82f15cb0d0f040502c2e3bb6945f30.1552665316.git.rgb@redhat.com> (raw) In-Reply-To: <cover.1552665316.git.rgb@redhat.com> In-Reply-To: <cover.1552665316.git.rgb@redhat.com> Add audit container identifier auxiliary record(s) to NETFILTER_PKT event standalone records. Iterate through all potential audit container identifiers associated with a network namespace. Signed-off-by: Richard Guy Briggs <rgb@redhat.com> --- include/linux/audit.h | 5 +++++ kernel/audit.c | 41 +++++++++++++++++++++++++++++++++++++++++ net/netfilter/nft_log.c | 11 +++++++++-- net/netfilter/xt_AUDIT.c | 11 +++++++++-- 4 files changed, 64 insertions(+), 4 deletions(-) diff --git a/include/linux/audit.h b/include/linux/audit.h index 70255c2dfb9f..723e2d020228 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -214,6 +214,8 @@ static inline u64 audit_get_contid(struct task_struct *tsk) extern void audit_netns_contid_del(struct net *net, u64 contid); extern void audit_switch_task_namespaces(struct nsproxy *ns, struct task_struct *p); +extern void audit_log_netns_contid_list(struct net *net, + struct audit_context *context); extern u32 audit_enabled; #else /* CONFIG_AUDIT */ @@ -290,6 +292,9 @@ static inline void audit_netns_contid_del(struct net *net, u64 contid) static inline void audit_switch_task_namespaces(struct nsproxy *ns, struct task_struct *p) { } +static inline void audit_log_netns_contid_list(struct net *net, + struct audit_context *context) +{ } #define audit_enabled AUDIT_OFF #endif /* CONFIG_AUDIT */ diff --git a/kernel/audit.c b/kernel/audit.c index 7fa3194f5342..80ed323feeb5 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -451,6 +451,47 @@ void audit_switch_task_namespaces(struct nsproxy *ns, struct task_struct *p) audit_netns_contid_add(new->net_ns, contid); } +/** + * audit_log_netns_contid_list - List contids for the given network namespace + * @net: the network namespace of interest + * @context: the audit context to use + * + * Description: + * Issues a CONTAINER_ID record with a CSV list of contids associated + * with a network namespace to accompany a NETFILTER_PKT record. + */ +void audit_log_netns_contid_list(struct net *net, struct audit_context *context) +{ + struct audit_buffer *ab = NULL; + struct audit_contid *cont; + bool first = true; + struct audit_net *aunet; + + /* Generate AUDIT_CONTAINER_ID record with container ID CSV list */ + rcu_read_lock(); + aunet = net_generic(net, audit_net_id); + if (!aunet) + goto out; + list_for_each_entry_rcu(cont, &aunet->contid_list, list) { + if (first) { + ab = audit_log_start(context, GFP_ATOMIC, + AUDIT_CONTAINER_ID); + if (!ab) { + audit_log_lost("out of memory in audit_log_netns_contid_list"); + goto out; + } + audit_log_format(ab, "contid="); + } else + audit_log_format(ab, ","); + audit_log_format(ab, "%llu", cont->id); + first = false; + } + audit_log_end(ab); +out: + rcu_read_unlock(); +} +EXPORT_SYMBOL(audit_log_netns_contid_list); + void audit_panic(const char *message) { switch (audit_failure) { diff --git a/net/netfilter/nft_log.c b/net/netfilter/nft_log.c index 655187bed5d8..bdb1ec2368a7 100644 --- a/net/netfilter/nft_log.c +++ b/net/netfilter/nft_log.c @@ -69,13 +69,16 @@ static void nft_log_eval_audit(const struct nft_pktinfo *pkt) struct sk_buff *skb = pkt->skb; struct audit_buffer *ab; int fam = -1; + struct audit_context *context; + struct net *net; if (!audit_enabled) return; - ab = audit_log_start(NULL, GFP_ATOMIC, AUDIT_NETFILTER_PKT); + context = audit_alloc_local(GFP_ATOMIC); + ab = audit_log_start(context, GFP_ATOMIC, AUDIT_NETFILTER_PKT); if (!ab) - return; + goto errout; audit_log_format(ab, "mark=%#x", skb->mark); @@ -102,6 +105,10 @@ static void nft_log_eval_audit(const struct nft_pktinfo *pkt) audit_log_format(ab, " saddr=? daddr=? proto=-1"); audit_log_end(ab); + net = xt_net(&pkt->xt); + audit_log_netns_contid_list(net, context); +errout: + audit_free_context(context); } static void nft_log_eval(const struct nft_expr *expr, diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c index af883f1b64f9..a3e547435f13 100644 --- a/net/netfilter/xt_AUDIT.c +++ b/net/netfilter/xt_AUDIT.c @@ -71,10 +71,13 @@ static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb) { struct audit_buffer *ab; int fam = -1; + struct audit_context *context; + struct net *net; if (audit_enabled == AUDIT_OFF) - goto errout; - ab = audit_log_start(NULL, GFP_ATOMIC, AUDIT_NETFILTER_PKT); + goto out; + context = audit_alloc_local(GFP_ATOMIC); + ab = audit_log_start(context, GFP_ATOMIC, AUDIT_NETFILTER_PKT); if (ab == NULL) goto errout; @@ -104,7 +107,11 @@ static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb) audit_log_end(ab); + net = xt_net(par); + audit_log_netns_contid_list(net, context); errout: + audit_free_context(context); +out: return XT_CONTINUE; } -- 1.8.3.1
next prev parent reply other threads:[~2019-03-15 18:35 UTC|newest] Thread overview: 80+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-03-15 18:29 [PATCH ghak90 V5 00/10] audit: implement container identifier Richard Guy Briggs 2019-03-15 18:29 ` [PATCH ghak90 V5 01/10] audit: collect audit task parameters Richard Guy Briggs 2019-03-16 19:57 ` Neil Horman 2019-03-27 20:33 ` Ondrej Mosnacek 2019-03-15 18:29 ` [PATCH ghak90 V5 02/10] audit: add container id Richard Guy Briggs 2019-03-16 20:00 ` Neil Horman 2019-03-27 20:38 ` Ondrej Mosnacek 2019-03-27 20:38 ` Ondrej Mosnacek 2019-03-27 20:44 ` Richard Guy Briggs 2019-03-15 18:29 ` [PATCH ghak90 V5 03/10] audit: read container ID of a process Richard Guy Briggs 2019-03-18 11:10 ` Neil Horman 2019-03-18 18:17 ` Richard Guy Briggs 2019-03-18 18:48 ` Neil Horman 2019-03-18 18:54 ` Richard Guy Briggs 2019-03-18 18:54 ` Richard Guy Briggs 2019-03-27 20:44 ` Ondrej Mosnacek 2019-03-15 18:29 ` [PATCH ghak90 V5 04/10] audit: log container info of syscalls Richard Guy Briggs 2019-03-15 18:29 ` Richard Guy Briggs 2019-03-16 22:44 ` Neil Horman 2019-03-27 21:01 ` Ondrej Mosnacek 2019-03-27 22:10 ` Richard Guy Briggs 2019-03-15 18:29 ` [PATCH ghak90 V5 05/10] audit: add containerid support for ptrace and signals Richard Guy Briggs 2019-03-15 18:29 ` Richard Guy Briggs 2019-03-18 19:04 ` Neil Horman 2019-03-18 19:29 ` Richard Guy Briggs 2019-03-18 19:29 ` Richard Guy Briggs 2019-03-27 21:17 ` Ondrej Mosnacek 2019-03-28 2:04 ` Richard Guy Briggs 2019-03-30 12:55 ` Richard Guy Briggs 2019-03-15 18:29 ` [PATCH ghak90 V5 06/10] audit: add support for non-syscall auxiliary records Richard Guy Briggs 2019-03-15 18:29 ` Richard Guy Briggs 2019-03-18 19:34 ` Neil Horman 2019-03-27 21:22 ` Ondrej Mosnacek 2019-04-01 14:49 ` Paul Moore 2019-04-01 17:44 ` Richard Guy Briggs 2019-04-01 17:44 ` Richard Guy Briggs 2019-04-01 18:57 ` Paul Moore 2019-04-01 20:43 ` Richard Guy Briggs 2019-03-15 18:29 ` [PATCH ghak90 V5 07/10] audit: add containerid support for user records Richard Guy Briggs 2019-03-15 18:29 ` Richard Guy Briggs 2019-03-18 19:41 ` Neil Horman 2019-03-27 21:30 ` Ondrej Mosnacek 2019-03-15 18:29 ` [PATCH ghak90 V5 08/10] audit: add containerid filtering Richard Guy Briggs 2019-03-15 18:29 ` Richard Guy Briggs 2019-03-18 20:02 ` Ondrej Mosnacek 2019-03-18 23:47 ` Richard Guy Briggs 2019-03-27 21:41 ` Ondrej Mosnacek 2019-03-27 22:00 ` Richard Guy Briggs 2019-03-27 22:00 ` Richard Guy Briggs 2019-03-18 20:39 ` Neil Horman 2019-03-15 18:29 ` [PATCH ghak90 V5 09/10] audit: add support for containerid to network namespaces Richard Guy Briggs 2019-03-18 20:56 ` Neil Horman 2019-03-27 22:42 ` Ondrej Mosnacek 2019-03-28 1:12 ` Richard Guy Briggs 2019-03-28 8:01 ` Ondrej Mosnacek 2019-03-28 8:01 ` Ondrej Mosnacek 2019-03-28 15:46 ` Paul Moore 2019-03-28 21:40 ` Richard Guy Briggs 2019-03-28 22:00 ` Paul Moore 2019-03-31 2:11 ` Neil Horman 2019-03-29 14:50 ` Neil Horman 2019-03-29 14:49 ` Neil Horman 2019-04-01 14:50 ` Paul Moore 2019-04-01 20:41 ` Richard Guy Briggs 2019-04-02 11:31 ` Neil Horman 2019-04-02 13:31 ` Paul Moore 2019-04-02 14:28 ` Neil Horman 2019-04-04 21:40 ` Richard Guy Briggs 2019-04-04 21:40 ` Richard Guy Briggs 2019-04-05 2:06 ` Paul Moore 2019-04-05 11:32 ` Neil Horman 2019-03-15 18:29 ` Richard Guy Briggs [this message] 2019-03-15 18:29 ` [PATCH ghak90 V5 10/10] audit: NETFILTER_PKT: record each container ID associated with a netNS Richard Guy Briggs 2019-03-15 18:43 ` Richard Guy Briggs 2019-03-18 20:58 ` Neil Horman 2019-03-27 22:52 ` Ondrej Mosnacek 2019-04-01 14:50 ` Paul Moore 2019-04-01 17:50 ` Richard Guy Briggs 2019-04-01 17:50 ` Richard Guy Briggs 2019-03-19 22:06 ` [PATCH ghak90 V5 00/10] audit: implement container identifier Richard Guy Briggs
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=56127b2a5b82f15cb0d0f040502c2e3bb6945f30.1552665316.git.rgb@redhat.com \ --to=rgb@redhat.com \ --cc=containers@lists.linux-foundation.org \ --cc=dhowells@redhat.com \ --cc=ebiederm@xmission.com \ --cc=eparis@parisplace.org \ --cc=linux-api@vger.kernel.org \ --cc=linux-audit@redhat.com \ --cc=linux-fsdevel@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=netdev@vger.kernel.org \ --cc=netfilter-devel@vger.kernel.org \ --cc=nhorman@tuxdriver.com \ --cc=omosnace@redhat.com \ --cc=paul@paul-moore.com \ --cc=serge@hallyn.com \ --cc=sgrubb@redhat.com \ --cc=simo@redhat.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.