From: Richard Guy Briggs <rgb@redhat.com> To: linux-kernel@vger.kernel.org, linux-audit@redhat.com Cc: Richard Guy Briggs <rgb@redhat.com>, Steven Rostedt <rostedt@goodmis.org>, Eric Paris <eparis@redhat.com>, Paul Moore <pmoore@redhat.com>, Steve Grubb <sgrubb@redhat.com> Subject: [PATCH ALT4 V3 1/2] audit: show fstype:pathname for entries with anonymous parents Date: Wed, 23 Aug 2017 07:03:38 -0400 [thread overview] Message-ID: <fa0938a05c2d783556d67d4dafef208b156a35ad.1503484357.git.rgb@redhat.com> (raw) Tracefs or debugfs were causing hundreds to thousands of null PATH records to be associated with the init_module and finit_module SYSCALL records on a few modules when the following rule was in place for startup: -a always,exit -F arch=x86_64 -S init_module -F key=mod-load This happens because the parent inode is not found in the task's audit_names list and hence treats it as anonymous. This gives us no information other than a numerical device number that may no longer be visible upon log inspeciton, and an inode number. Fill in the filesystem type, filesystem magic number and full pathname from the filesystem mount point on previously null PATH records from entries that have an anonymous parent from the child dentry using dentry_path_raw(). Make the dentry argument of __audit_inode_child() non-const so that we can take a reference to it in the case of an anonymous parent with dget() and dget_parent() to be able to later print a partial path from the host filesystem rather than null. Since all we are given is an inode of the parent and the dentry of the child, finding the path from the mount point to the root of the filesystem is more challenging that would involve searching all vfsmounts from "/" until a matching dentry is found for that filesystem's root dentry. Even if one is found, there may be more than one mount point. At this point the gain seems marginal since knowing the filesystem type and path are a significant help in tracking down the source of the PATH records and being to address them. Sample output: type=PROCTITLE msg=audit(1488317694.446:143): proctitle=2F7362696E2F6D6F6470726F6265002D71002D2D006E66737634 type=PATH msg=audit(1488317694.446:143): item=797 name=tracefs(74726163):/events/nfs4/nfs4_setclientid/format inode=15969 dev=00:09 mode=0100444 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tracefs_t:s0 nametype=CREATE type=PATH msg=audit(1488317694.446:143): item=796 name=tracefs(74726163):/events/nfs4/nfs4_setclientid inode=15964 dev=00:09 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tracefs_t:s0 nametype=PARENT ... type=PATH msg=audit(1488317694.446:143): item=1 name=tracefs(74726163):/events/nfs4 inode=15571 dev=00:09 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tracefs_t:s0 nametype=CREATE type=PATH msg=audit(1488317694.446:143): item=0 name=tracefs(74726163):/events inode=119 dev=00:09 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tracefs_t:s0 nametype=PARENT type=UNKNOWN[1330] msg=audit(1488317694.446:143): name="nfsv4" type=SYSCALL msg=audit(1488317694.446:143): arch=c000003e syscall=313 success=yes exit=0 a0=1 a1=55d5a35ce106 a2=0 a3=1 items=798 ppid=6 pid=528 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="modprobe" exe="/usr/bin/kmod" subj=system_u:system_r:insmod_t:s0 key="mod-load" See: https://github.com/linux-audit/audit-kernel/issues/8 Test case: https://github.com/linux-audit/audit-testsuite/issues/42 Signed-off-by: Richard Guy Briggs <rgb@redhat.com> --- v3: fix audit_buffer leak and dname error allocation leak audit_log_name only put audit_name->dentry if it is being replaced v2: minor cosmetic changes and support fs filter patch --- include/linux/audit.h | 8 ++++---- kernel/audit.c | 19 +++++++++++++++++++ kernel/audit.h | 1 + kernel/auditsc.c | 8 +++++++- 4 files changed, 31 insertions(+), 5 deletions(-) diff --git a/include/linux/audit.h b/include/linux/audit.h index 2150bdc..1ef4ec8 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -240,7 +240,7 @@ extern void __audit_inode(struct filename *name, const struct dentry *dentry, unsigned int flags); extern void __audit_file(const struct file *); extern void __audit_inode_child(struct inode *parent, - const struct dentry *dentry, + struct dentry *dentry, const unsigned char type); extern void __audit_seccomp(unsigned long syscall, long signr, int code); extern void __audit_ptrace(struct task_struct *t); @@ -305,7 +305,7 @@ static inline void audit_inode_parent_hidden(struct filename *name, AUDIT_INODE_PARENT | AUDIT_INODE_HIDDEN); } static inline void audit_inode_child(struct inode *parent, - const struct dentry *dentry, + struct dentry *dentry, const unsigned char type) { if (unlikely(!audit_dummy_context())) __audit_inode_child(parent, dentry, type); @@ -486,7 +486,7 @@ static inline void __audit_inode(struct filename *name, unsigned int flags) { } static inline void __audit_inode_child(struct inode *parent, - const struct dentry *dentry, + struct dentry *dentry, const unsigned char type) { } static inline void audit_inode(struct filename *name, @@ -500,7 +500,7 @@ static inline void audit_inode_parent_hidden(struct filename *name, const struct dentry *dentry) { } static inline void audit_inode_child(struct inode *parent, - const struct dentry *dentry, + struct dentry *dentry, const unsigned char type) { } static inline void audit_core_dumps(long signr) diff --git a/kernel/audit.c b/kernel/audit.c index 59e60e0..d6e6e4e 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -72,6 +72,7 @@ #include <linux/freezer.h> #include <linux/pid_namespace.h> #include <net/netns/generic.h> +#include <linux/dcache.h> #include "audit.h" @@ -2047,6 +2048,10 @@ void audit_copy_inode(struct audit_names *name, const struct dentry *dentry, name->gid = inode->i_gid; name->rdev = inode->i_rdev; security_inode_getsecid(inode, &name->osid); + if (name->dentry) { + dput(name->dentry); + name->dentry = NULL; + } audit_copy_fcaps(name, dentry); } @@ -2088,6 +2093,20 @@ void audit_log_name(struct audit_context *context, struct audit_names *n, audit_log_n_untrustedstring(ab, n->name->name, n->name_len); } + } else if (n->dentry) { + char *fullpath; + const char *fullpathp = NULL; + + fullpath = kmalloc(PATH_MAX, GFP_KERNEL); + if (fullpath) + fullpathp = dentry_path_raw(n->dentry, fullpath, PATH_MAX); + if (IS_ERR(fullpathp)) { + fullpathp = NULL; + kfree(fullpath); + } + audit_log_format(ab, " name=%s(0x%lx):%s", + n->dentry->d_sb->s_type->name ?: "?", + n->dentry->d_sb->s_magic, fullpathp ?: "?"); } else audit_log_format(ab, " name=(null)"); diff --git a/kernel/audit.h b/kernel/audit.h index b331d9b..c01defb 100644 --- a/kernel/audit.h +++ b/kernel/audit.h @@ -85,6 +85,7 @@ struct audit_names { unsigned long ino; dev_t dev; + struct dentry *dentry; umode_t mode; kuid_t uid; kgid_t gid; diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 4a42db5..11848df 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -74,6 +74,7 @@ #include <linux/string.h> #include <linux/uaccess.h> #include <uapi/linux/limits.h> +#include <linux/dcache.h> #include "audit.h" @@ -881,6 +882,8 @@ static inline void audit_free_names(struct audit_context *context) list_del(&n->list); if (n->name) putname(n->name); + if (n->dentry) + dput(n->dentry); if (n->should_free) kfree(n); } @@ -1861,7 +1864,7 @@ void __audit_file(const struct file *file) * unsuccessful attempts. */ void __audit_inode_child(struct inode *parent, - const struct dentry *dentry, + struct dentry *dentry, const unsigned char type) { struct audit_context *context = current->audit_context; @@ -1917,6 +1920,7 @@ void __audit_inode_child(struct inode *parent, if (!n) return; audit_copy_inode(n, NULL, parent); + n->dentry = dget_parent(dentry); } if (!found_child) { @@ -1938,6 +1942,8 @@ void __audit_inode_child(struct inode *parent, audit_copy_inode(found_child, dentry, inode); else found_child->ino = AUDIT_INO_UNSET; + if (!found_parent) + found_child->dentry = dget(dentry); } EXPORT_SYMBOL_GPL(__audit_inode_child); -- 1.7.1
WARNING: multiple messages have this Message-ID (diff)
From: Richard Guy Briggs <rgb@redhat.com> To: linux-kernel@vger.kernel.org, linux-audit@redhat.com Cc: Richard Guy Briggs <rgb@redhat.com>, Steven Rostedt <rostedt@goodmis.org> Subject: [PATCH ALT4 V3 1/2] audit: show fstype:pathname for entries with anonymous parents Date: Wed, 23 Aug 2017 07:03:38 -0400 [thread overview] Message-ID: <fa0938a05c2d783556d67d4dafef208b156a35ad.1503484357.git.rgb@redhat.com> (raw) Tracefs or debugfs were causing hundreds to thousands of null PATH records to be associated with the init_module and finit_module SYSCALL records on a few modules when the following rule was in place for startup: -a always,exit -F arch=x86_64 -S init_module -F key=mod-load This happens because the parent inode is not found in the task's audit_names list and hence treats it as anonymous. This gives us no information other than a numerical device number that may no longer be visible upon log inspeciton, and an inode number. Fill in the filesystem type, filesystem magic number and full pathname from the filesystem mount point on previously null PATH records from entries that have an anonymous parent from the child dentry using dentry_path_raw(). Make the dentry argument of __audit_inode_child() non-const so that we can take a reference to it in the case of an anonymous parent with dget() and dget_parent() to be able to later print a partial path from the host filesystem rather than null. Since all we are given is an inode of the parent and the dentry of the child, finding the path from the mount point to the root of the filesystem is more challenging that would involve searching all vfsmounts from "/" until a matching dentry is found for that filesystem's root dentry. Even if one is found, there may be more than one mount point. At this point the gain seems marginal since knowing the filesystem type and path are a significant help in tracking down the source of the PATH records and being to address them. Sample output: type=PROCTITLE msg=audit(1488317694.446:143): proctitle=2F7362696E2F6D6F6470726F6265002D71002D2D006E66737634 type=PATH msg=audit(1488317694.446:143): item=797 name=tracefs(74726163):/events/nfs4/nfs4_setclientid/format inode=15969 dev=00:09 mode=0100444 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tracefs_t:s0 nametype=CREATE type=PATH msg=audit(1488317694.446:143): item=796 name=tracefs(74726163):/events/nfs4/nfs4_setclientid inode=15964 dev=00:09 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tracefs_t:s0 nametype=PARENT ... type=PATH msg=audit(1488317694.446:143): item=1 name=tracefs(74726163):/events/nfs4 inode=15571 dev=00:09 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tracefs_t:s0 nametype=CREATE type=PATH msg=audit(1488317694.446:143): item=0 name=tracefs(74726163):/events inode=119 dev=00:09 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tracefs_t:s0 nametype=PARENT type=UNKNOWN[1330] msg=audit(1488317694.446:143): name="nfsv4" type=SYSCALL msg=audit(1488317694.446:143): arch=c000003e syscall=313 success=yes exit=0 a0=1 a1=55d5a35ce106 a2=0 a3=1 items=798 ppid=6 pid=528 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="modprobe" exe="/usr/bin/kmod" subj=system_u:system_r:insmod_t:s0 key="mod-load" See: https://github.com/linux-audit/audit-kernel/issues/8 Test case: https://github.com/linux-audit/audit-testsuite/issues/42 Signed-off-by: Richard Guy Briggs <rgb@redhat.com> --- v3: fix audit_buffer leak and dname error allocation leak audit_log_name only put audit_name->dentry if it is being replaced v2: minor cosmetic changes and support fs filter patch --- include/linux/audit.h | 8 ++++---- kernel/audit.c | 19 +++++++++++++++++++ kernel/audit.h | 1 + kernel/auditsc.c | 8 +++++++- 4 files changed, 31 insertions(+), 5 deletions(-) diff --git a/include/linux/audit.h b/include/linux/audit.h index 2150bdc..1ef4ec8 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -240,7 +240,7 @@ extern void __audit_inode(struct filename *name, const struct dentry *dentry, unsigned int flags); extern void __audit_file(const struct file *); extern void __audit_inode_child(struct inode *parent, - const struct dentry *dentry, + struct dentry *dentry, const unsigned char type); extern void __audit_seccomp(unsigned long syscall, long signr, int code); extern void __audit_ptrace(struct task_struct *t); @@ -305,7 +305,7 @@ static inline void audit_inode_parent_hidden(struct filename *name, AUDIT_INODE_PARENT | AUDIT_INODE_HIDDEN); } static inline void audit_inode_child(struct inode *parent, - const struct dentry *dentry, + struct dentry *dentry, const unsigned char type) { if (unlikely(!audit_dummy_context())) __audit_inode_child(parent, dentry, type); @@ -486,7 +486,7 @@ static inline void __audit_inode(struct filename *name, unsigned int flags) { } static inline void __audit_inode_child(struct inode *parent, - const struct dentry *dentry, + struct dentry *dentry, const unsigned char type) { } static inline void audit_inode(struct filename *name, @@ -500,7 +500,7 @@ static inline void audit_inode_parent_hidden(struct filename *name, const struct dentry *dentry) { } static inline void audit_inode_child(struct inode *parent, - const struct dentry *dentry, + struct dentry *dentry, const unsigned char type) { } static inline void audit_core_dumps(long signr) diff --git a/kernel/audit.c b/kernel/audit.c index 59e60e0..d6e6e4e 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -72,6 +72,7 @@ #include <linux/freezer.h> #include <linux/pid_namespace.h> #include <net/netns/generic.h> +#include <linux/dcache.h> #include "audit.h" @@ -2047,6 +2048,10 @@ void audit_copy_inode(struct audit_names *name, const struct dentry *dentry, name->gid = inode->i_gid; name->rdev = inode->i_rdev; security_inode_getsecid(inode, &name->osid); + if (name->dentry) { + dput(name->dentry); + name->dentry = NULL; + } audit_copy_fcaps(name, dentry); } @@ -2088,6 +2093,20 @@ void audit_log_name(struct audit_context *context, struct audit_names *n, audit_log_n_untrustedstring(ab, n->name->name, n->name_len); } + } else if (n->dentry) { + char *fullpath; + const char *fullpathp = NULL; + + fullpath = kmalloc(PATH_MAX, GFP_KERNEL); + if (fullpath) + fullpathp = dentry_path_raw(n->dentry, fullpath, PATH_MAX); + if (IS_ERR(fullpathp)) { + fullpathp = NULL; + kfree(fullpath); + } + audit_log_format(ab, " name=%s(0x%lx):%s", + n->dentry->d_sb->s_type->name ?: "?", + n->dentry->d_sb->s_magic, fullpathp ?: "?"); } else audit_log_format(ab, " name=(null)"); diff --git a/kernel/audit.h b/kernel/audit.h index b331d9b..c01defb 100644 --- a/kernel/audit.h +++ b/kernel/audit.h @@ -85,6 +85,7 @@ struct audit_names { unsigned long ino; dev_t dev; + struct dentry *dentry; umode_t mode; kuid_t uid; kgid_t gid; diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 4a42db5..11848df 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -74,6 +74,7 @@ #include <linux/string.h> #include <linux/uaccess.h> #include <uapi/linux/limits.h> +#include <linux/dcache.h> #include "audit.h" @@ -881,6 +882,8 @@ static inline void audit_free_names(struct audit_context *context) list_del(&n->list); if (n->name) putname(n->name); + if (n->dentry) + dput(n->dentry); if (n->should_free) kfree(n); } @@ -1861,7 +1864,7 @@ void __audit_file(const struct file *file) * unsuccessful attempts. */ void __audit_inode_child(struct inode *parent, - const struct dentry *dentry, + struct dentry *dentry, const unsigned char type) { struct audit_context *context = current->audit_context; @@ -1917,6 +1920,7 @@ void __audit_inode_child(struct inode *parent, if (!n) return; audit_copy_inode(n, NULL, parent); + n->dentry = dget_parent(dentry); } if (!found_child) { @@ -1938,6 +1942,8 @@ void __audit_inode_child(struct inode *parent, audit_copy_inode(found_child, dentry, inode); else found_child->ino = AUDIT_INO_UNSET; + if (!found_parent) + found_child->dentry = dget(dentry); } EXPORT_SYMBOL_GPL(__audit_inode_child); -- 1.7.1
next reply other threads:[~2017-08-23 11:04 UTC|newest] Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-08-23 11:03 Richard Guy Briggs [this message] 2017-08-23 11:03 ` [PATCH ALT4 V3 1/2] audit: show fstype:pathname for entries with anonymous parents Richard Guy Briggs 2017-08-23 11:03 ` [PATCH ALT4 V3 2/2] audit: filter PATH records keyed on filesystem magic Richard Guy Briggs 2017-08-23 11:03 ` Richard Guy Briggs 2017-09-07 22:36 ` Paul Moore 2017-09-07 22:40 ` Steven Rostedt 2017-09-07 23:05 ` Paul Moore 2017-09-07 23:07 ` Steven Rostedt 2017-10-10 0:13 ` Steve Grubb 2017-10-19 19:58 ` Paul Moore 2017-10-19 20:10 ` Richard Guy Briggs 2017-09-20 16:52 ` [PATCH ALT4 V3 1/2] audit: show fstype:pathname for entries with anonymous parents Paul Moore 2017-09-21 14:57 ` Richard Guy Briggs 2017-10-12 1:36 ` Richard Guy Briggs 2017-11-08 23:29 ` Steve Grubb 2017-11-09 15:18 ` Paul Moore 2017-11-09 15:31 ` Steve Grubb 2017-11-09 15:59 ` Paul Moore 2017-11-09 20:52 ` Richard Guy Briggs 2017-11-09 21:47 ` Paul Moore 2017-11-09 21:56 ` Richard Guy Briggs 2017-11-13 18:30 ` Steve Grubb 2017-11-13 19:01 ` Paul Moore
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=fa0938a05c2d783556d67d4dafef208b156a35ad.1503484357.git.rgb@redhat.com \ --to=rgb@redhat.com \ --cc=eparis@redhat.com \ --cc=linux-audit@redhat.com \ --cc=linux-kernel@vger.kernel.org \ --cc=pmoore@redhat.com \ --cc=rostedt@goodmis.org \ --cc=sgrubb@redhat.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.