From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 79E00C433F5 for ; Thu, 4 Nov 2021 21:00:53 +0000 (UTC) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 271FA6124D for ; Thu, 4 Nov 2021 21:00:53 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 271FA6124D Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: mail.kernel.org; spf=tempfail smtp.mailfrom=redhat.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1636059652; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=GCiLC1jIfY+WauF6smZ1b9KISbdrRLccnONKJSVtg2Y=; b=ZZsuFGC/emyk8N/Xs8VPhaibCJ9DRB65GCPVmj18uwNrBNkz2qlqlI5vQnOD7NJItPfZYD TaMFHKit2/H89GIKYjNkMkpI/MWnGT82nyLa/Wvm+ptjjeXGaQIwWO5cRc8P5KQzpVlXBe ACeyZzNk+6Eza1bzHJ+dnM+GHNFNbVQ= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-53-J0-vHkHYNyuKaek3sfgpNQ-1; Thu, 04 Nov 2021 17:00:50 -0400 X-MC-Unique: J0-vHkHYNyuKaek3sfgpNQ-1 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id D99AB100C620; Thu, 4 Nov 2021 21:00:42 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 2C8D518A8F; Thu, 4 Nov 2021 21:00:41 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 872844E58E; Thu, 4 Nov 2021 21:00:39 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 1A4L0Sld025058 for ; Thu, 4 Nov 2021 17:00:28 -0400 Received: by smtp.corp.redhat.com (Postfix) id 065C870958; Thu, 4 Nov 2021 21:00:28 +0000 (UTC) Received: from madcap2.tricolour.com (unknown [10.3.128.2]) by smtp.corp.redhat.com (Postfix) with ESMTP id D31997092D; Thu, 4 Nov 2021 20:59:51 +0000 (UTC) From: Richard Guy Briggs To: Linux-Audit Mailing List Subject: [RFC PATCH v1] audit: log AUDIT_TIME_* records only from rules Date: Thu, 4 Nov 2021 16:59:40 -0400 Message-Id: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-loop: linux-audit@redhat.com Cc: Richard Guy Briggs , Eric Paris X-BeenThere: linux-audit@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Linux Audit Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=linux-audit-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit AUDIT_TIME_* events are generated when there are syscall rules present that are not related to time keeping. This will produce noisy log entries that could flood the logs and hide events we really care about. Rather than immediately produce the AUDIT_TIME_* records, store the data and log it at syscall exit time respecting the filter rules. Please see https://bugzilla.redhat.com/show_bug.cgi?id=1991919 Signed-off-by: Richard Guy Briggs --- Note: This is a quick and dirty proof-of-concept. If this approach of storing the values in the audit_context for later filtering is acceptable I'll clean up the patch (re-name functions) and re-submit. kernel/audit.h | 6 ++++++ kernel/auditsc.c | 29 +++++++++++++++++++++++++---- 2 files changed, 31 insertions(+), 4 deletions(-) diff --git a/kernel/audit.h b/kernel/audit.h index 3b64a97f6091..25d63731b0e0 100644 --- a/kernel/audit.h +++ b/kernel/audit.h @@ -196,6 +196,12 @@ struct audit_context { struct { char *name; } module; + struct { + struct audit_ntp_data data; + } ntp; + struct { + struct timespec64 injoffset; + } tk; }; int fds[2]; struct audit_proctitle proctitle; diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 6efb0bb909d0..8983790ad86a 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1210,11 +1210,18 @@ static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name) from_kuid(&init_user_ns, name->fcap.rootid)); } +void __audit_ntp_log_(const struct audit_ntp_data *ad); + static void show_special(struct audit_context *context, int *call_panic) { struct audit_buffer *ab; int i; + if (context->type == AUDIT_TIME_ADJNTPVAL) { + __audit_ntp_log_(&context->ntp.data); + return; + } + ab = audit_log_start(context, GFP_KERNEL, context->type); if (!ab) return; @@ -1324,6 +1331,11 @@ static void show_special(struct audit_context *context, int *call_panic) audit_log_format(ab, "(null)"); break; + case AUDIT_TIME_INJOFFSET: + audit_log_format(ab, "sec=%lli nsec=%li", + (long long)context->tk.injoffset.tv_sec, + context->tk.injoffset.tv_nsec); + break; } audit_log_end(ab); } @@ -2571,9 +2583,18 @@ void __audit_fanotify(unsigned int response) void __audit_tk_injoffset(struct timespec64 offset) { - audit_log(audit_context(), GFP_KERNEL, AUDIT_TIME_INJOFFSET, - "sec=%lli nsec=%li", - (long long)offset.tv_sec, offset.tv_nsec); + struct audit_context *context = audit_context(); + + context->type = AUDIT_TIME_INJOFFSET; + memcpy(&context->tk.injoffset, &offset, sizeof(offset)); +} + +void __audit_ntp_log(const struct audit_ntp_data *ad) +{ + struct audit_context *context = audit_context(); + + context->type = AUDIT_TIME_ADJNTPVAL; + memcpy(&context->ntp.data, ad, sizeof(*ad)); } static void audit_log_ntp_val(const struct audit_ntp_data *ad, @@ -2588,7 +2609,7 @@ static void audit_log_ntp_val(const struct audit_ntp_data *ad, "op=%s old=%lli new=%lli", op, val->oldval, val->newval); } -void __audit_ntp_log(const struct audit_ntp_data *ad) +void __audit_ntp_log_(const struct audit_ntp_data *ad) { audit_log_ntp_val(ad, "offset", AUDIT_NTP_OFFSET); audit_log_ntp_val(ad, "freq", AUDIT_NTP_FREQ); -- 2.27.0 -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit