From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 9500BC433F5 for ; Fri, 21 Jan 2022 16:17:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1642781856; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=PRErQRNnouoisPgE39GhoNfuBzK/c5BQSWD7HROvPSk=; b=BtiWEHAfA3h3PkBuZvriXdlswv+kOdk/FS4SBwQFTbMRQAWJxseSOwT2SC0w5vb5dL+qNx I3lE/9TE3EJsf47xrmVLHgJ1gm/Ad1YHDBJUIsWc1/c/LJr3QNEDmwrRHqAvBr9SQiRPD9 OuOBmS3JSmWQ6ULpBPGgivTomPNGOMM= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-533-fNCsTFChPE-a187I5vqXgw-1; Fri, 21 Jan 2022 11:17:33 -0500 X-MC-Unique: fNCsTFChPE-a187I5vqXgw-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id DE21118460E8; Fri, 21 Jan 2022 16:17:28 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id BA2337E91B; Fri, 21 Jan 2022 16:17:27 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 2C2C64CA93; Fri, 21 Jan 2022 16:17:26 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 20LGHOIK028664 for ; Fri, 21 Jan 2022 11:17:24 -0500 Received: by smtp.corp.redhat.com (Postfix) id 1A8D4798CC; Fri, 21 Jan 2022 16:17:24 +0000 (UTC) Received: from madcap2.tricolour.com (unknown [10.22.48.17]) by smtp.corp.redhat.com (Postfix) with ESMTP id 1972C798D8; Fri, 21 Jan 2022 16:17:11 +0000 (UTC) From: Richard Guy Briggs To: Linux-Audit Mailing List Subject: [PATCH v2] audit: log AUDIT_TIME_* records only from rules Date: Fri, 21 Jan 2022 11:17:04 -0500 Message-Id: <9bd09a6b4433094803195a037ff59301a24eafc9.1642774100.git.rgb@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-loop: linux-audit@redhat.com Cc: Richard Guy Briggs , Eric Paris X-BeenThere: linux-audit@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Linux Audit Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=linux-audit-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit AUDIT_TIME_* events are generated when there are syscall rules present that are not related to time keeping. This will produce noisy log entries that could flood the logs and hide events we really care about. Rather than immediately produce the AUDIT_TIME_* records, store the data in the context and log it at syscall exit time respecting the filter rules. Please see https://bugzilla.redhat.com/show_bug.cgi?id=1991919 Fixes: 7e8eda734d30 ("ntp: Audit NTP parameters adjustment") Fixes: 2d87a0674bd6 ("timekeeping: Audit clock adjustments") Signed-off-by: Richard Guy Briggs --- Changelog: v2: - rename __audit_ntp_log_ to audit_log_ntp - pre-check ntp before storing - move tk out of the context union and move ntp logging to the bottom of audit_show_special() - restructure logging of ntp to use ab and allocate more only if more - add Fixes lines kernel/audit.h | 2 ++ kernel/auditsc.c | 77 +++++++++++++++++++++++++++++++++++------------- 2 files changed, 59 insertions(+), 20 deletions(-) diff --git a/kernel/audit.h b/kernel/audit.h index c4498090a5bd..11789249d838 100644 --- a/kernel/audit.h +++ b/kernel/audit.h @@ -201,8 +201,10 @@ struct audit_context { struct { char *name; } module; + struct audit_ntp_data ntp_data; }; int fds[2]; + struct timespec64 tk_injoffset; struct audit_proctitle proctitle; }; diff --git a/kernel/auditsc.c b/kernel/auditsc.c index b517947bfa48..1838a2b3ab10 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1331,6 +1331,38 @@ static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name) from_kuid(&init_user_ns, name->fcap.rootid)); } +void audit_log_ntp(struct audit_context *context, struct audit_buffer **ab, + const struct audit_ntp_data *ad) +{ + const char *ntp_name[] = { + "offset", + "freq", + "status", + "tai", + "tick", + "adjust", + }; + int type, first = 1; + + /* use up allocated ab from show_special before new one */ + for (type = 0; type < AUDIT_NTP_NVALS; type++) { + if (ad->vals[type].newval != ad->vals[type].oldval) { + if (first) { + first = 0; + } else { + audit_log_end(*ab); + *ab = audit_log_start(context, GFP_KERNEL, + AUDIT_TIME_ADJNTPVAL); + if (!*ab) + return; + } + audit_log_format(*ab, "op=%s old=%lli new=%lli", + ntp_name[type], ad->vals[type].oldval, + ad->vals[type].newval); + } + } +} + static void show_special(struct audit_context *context, int *call_panic) { struct audit_buffer *ab; @@ -1445,6 +1477,9 @@ static void show_special(struct audit_context *context, int *call_panic) audit_log_format(ab, "(null)"); break; + case AUDIT_TIME_ADJNTPVAL: + audit_log_ntp(context, &ab, &context->ntp_data); + break; } audit_log_end(ab); } @@ -1767,6 +1802,17 @@ static void audit_log_exit(void) audit_log_name(context, n, NULL, i++, &call_panic); } + if (context->tk_injoffset.tv_sec != 0 || + context->tk_injoffset.tv_nsec != 0) { + ab = audit_log_start(context, GFP_KERNEL, AUDIT_TIME_INJOFFSET); + if (ab) { + audit_log_format(ab, "sec=%lli nsec=%li", + (long long)context->tk_injoffset.tv_sec, + context->tk_injoffset.tv_nsec); + audit_log_end(ab); + } + } + if (context->context == AUDIT_CTX_SYSCALL) audit_log_proctitle(); @@ -2840,31 +2886,22 @@ void __audit_fanotify(unsigned int response) void __audit_tk_injoffset(struct timespec64 offset) { - audit_log(audit_context(), GFP_KERNEL, AUDIT_TIME_INJOFFSET, - "sec=%lli nsec=%li", - (long long)offset.tv_sec, offset.tv_nsec); -} - -static void audit_log_ntp_val(const struct audit_ntp_data *ad, - const char *op, enum audit_ntp_type type) -{ - const struct audit_ntp_val *val = &ad->vals[type]; - - if (val->newval == val->oldval) - return; + struct audit_context *context = audit_context(); - audit_log(audit_context(), GFP_KERNEL, AUDIT_TIME_ADJNTPVAL, - "op=%s old=%lli new=%lli", op, val->oldval, val->newval); + memcpy(&context->tk_injoffset, &offset, sizeof(offset)); } void __audit_ntp_log(const struct audit_ntp_data *ad) { - audit_log_ntp_val(ad, "offset", AUDIT_NTP_OFFSET); - audit_log_ntp_val(ad, "freq", AUDIT_NTP_FREQ); - audit_log_ntp_val(ad, "status", AUDIT_NTP_STATUS); - audit_log_ntp_val(ad, "tai", AUDIT_NTP_TAI); - audit_log_ntp_val(ad, "tick", AUDIT_NTP_TICK); - audit_log_ntp_val(ad, "adjust", AUDIT_NTP_ADJUST); + struct audit_context *context = audit_context(); + int type; + + for (type = 0; type < AUDIT_NTP_NVALS; type++) + if (ad->vals[type].newval != ad->vals[type].oldval) { + context->type = AUDIT_TIME_ADJNTPVAL; + memcpy(&context->ntp_data, ad, sizeof(*ad)); + break; + } } void __audit_log_nfcfg(const char *name, u8 af, unsigned int nentries, -- 2.27.0 -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit