[PATCH ghak28/ghak25 user v6 0/2] parse EVENT_LISTENER and NETFILTER_CFG

[PATCH ghak28/ghak25 user v6 0/2] parse EVENT_LISTENER and NETFILTER_CFG

[Richard Guy Briggs]

Add a parser to parse subject attributes from EVENT_LISTENER and
NETFILTER_CFG record types.

This is a new order for subject attributes for two record types that
usually occur in user context and therefore would be informed by a
SYSCALL record, but occasionally stand alone and need the subject
attributes added.  In the case of the NETFILTER_CFG event, since it is
kernel-initiated, several of the subject attributes are unset and
meaningless in the kernel context and duplicates in user context, hence
removed.

Please see the upstream issues
https://github.com/linux-audit/audit-kernel/issues/28 and
https://github.com/linux-audit/audit-kernel/issues/25 .

changelog:
v6
- remove uid, auid as duplicates or unset

v1-4
- no userspace patches

Richard Guy Briggs (2):
  ausearch-parse: add parser for YAASAO
  ausearch-parse: mod parser for YAASAO for NETFILTER_CFG

 src/ausearch-parse.c | 168 ++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 167 insertions(+), 1 deletion(-)

-- 
1.8.3.1

--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit

[PATCH ghak28/ghak25 user v6 1/2] ausearch-parse: add parser for YAASAO

[Richard Guy Briggs]

Add a parser for Yet Another Audit Subject Attributes Order that was
introduced with ghak28 for the AUDIT_EVENT_LISTENER.

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
---
 src/ausearch-parse.c | 166 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 166 insertions(+)

diff --git a/src/ausearch-parse.c b/src/ausearch-parse.c
index a2cdb1fb5c60..be1d32cdfa5f 100644
--- a/src/ausearch-parse.c
+++ b/src/ausearch-parse.c
@@ -62,6 +62,7 @@ static int parse_kernel_anom(const lnode *n, search_items *s);
 static int parse_simple_message(const lnode *n, search_items *s);
 static int parse_tty(const lnode *n, search_items *s);
 static int parse_pkt(const lnode *n, search_items *s);
+static int parse_yaasao(lnode *n, search_items *s);
 
 
 static int audit_avc_init(search_items *s)
@@ -177,6 +178,9 @@ int extract_search_items(llist *l)
 			case AUDIT_REPLACE...AUDIT_BPF:
 				// Nothing to parse
 				break;
+			case AUDIT_EVENT_LISTENER:
+				ret = parse_yaasao(n, s);
+				break;
 			case AUDIT_TTY:
 				ret = parse_tty(n, s);
 				break;
@@ -2568,3 +2572,165 @@ static int parse_pkt(const lnode *n, search_items *s)
 	return 0;
 }
 
+// parse Yet Another Audit Subject Attributes Order
+// /pid.*uid.*auid.*tty.*ses.*subj.*comm.*exe
+static int parse_yaasao(lnode *n, search_items *s)
+{
+	char *ptr, *str, *term;
+	term = n->message;
+
+	// get pid if not already filled
+	if (event_pid != -1 && s->pid == -1) {
+		str = strstr(term, " pid=");
+		if (str) {
+			ptr = str + 5;
+			term = strchr(ptr, ' ');
+			if (term == NULL)
+				return 52;
+			*term = 0;
+			errno = 0;
+			s->pid = strtoul(ptr, NULL, 10);
+			if (errno)
+				return 53;
+			*term = ' ';
+		} else
+			return 54;
+	}
+	// get uid if not already filled
+	if ((s->uid == -1 && !s->tuid) && (event_uid != -1 || event_tuid)) {
+		str = strstr(term, "uid=");
+		if (str) {
+			ptr = str + 4;
+			term = strchr(ptr, ' ');
+			if (term == NULL)
+				return 55;
+			*term = 0;
+			errno = 0;
+			s->uid = strtoul(ptr, NULL, 10);
+			if (errno)
+				return 56;
+			*term = ' ';
+			if (s->tuid) free((void *)s->tuid);
+			s->tuid = lookup_uid("uid", s->uid);
+		} else
+			return 57;
+	}
+	// get loginuid if not already filled
+	if ((s->loginuid == -2 && !s->tauid) && (event_loginuid != -2 || event_tauid)) {
+		str = strstr(term, "auid=");
+		if (str) {
+			ptr = str + 5;
+			term = strchr(ptr, ' ');
+			if (term == NULL)
+				return 58;
+			*term = 0;
+			errno = 0;
+			s->loginuid = strtoul(ptr, NULL, 10);
+			if (errno)
+				return 59;
+			*term = ' ';
+			if (s->tauid) free((void *)s->tauid);
+			s->tauid = lookup_uid("auid", s->loginuid);
+		} else
+			return 60;
+	}
+	// get tty if not already filled
+	if (!s->terminal && event_terminal) {
+		// dont do this search unless needed
+		str = strstr(term, "tty=");
+		if (str) {
+			str += 4;
+			term = strchr(str, ' ');
+			if (term == NULL)
+				return 61;
+			*term = 0;
+			if (s->terminal) // ANOM_NETLINK has one
+				free(s->terminal);
+			s->terminal = strdup(str);
+			*term = ' ';
+		} else
+			return 62;
+	}
+	// get ses if not already filled
+	if (s->session_id == -2 && event_session_id != -2 ) {
+		str = strstr(term, "ses=");
+		if (str) {
+			ptr = str + 4;
+			term = strchr(ptr, ' ');
+			if (term == NULL)
+				return 63;
+			*term = 0;
+			errno = 0;
+			s->session_id = strtoul(ptr, NULL, 10);
+			if (errno)
+				return 64;
+			*term = ' ';
+		} else
+			return 65
+	}
+	// get subject if not already filled
+	if (!s->avc && event_subject) {
+		// scontext
+		str = strstr(term, "subj=");
+		if (str) {
+			str += 5;
+			term = strchr(str, ' ');
+			if (term == NULL)
+				return 66;
+			*term = 0;
+			if (audit_avc_init(s) == 0) {
+				anode an;
+
+				anode_init(&an);
+				an.scontext = strdup(str);
+				alist_append(s->avc, &an);
+				*term = ' ';
+			} else
+				return 67;
+		} else
+			return 68;
+	}
+	// get command line if not already filled
+	if (!s->comm && event_comm) {
+		// dont do this search unless needed
+		str = strstr(term, "comm=");
+		if (str) {
+			/* Make the syscall one override */
+			if (s->comm)
+				free(s->comm);
+			str += 5;
+			if (*str == '"') {
+				str++;
+				term = strchr(str, '"');
+				if (term == NULL)
+					return 69;
+				*term = 0;
+				s->comm = strdup(str);
+				*term = '"';
+			} else 
+				s->comm = unescape(str);
+		} else
+			return 70;
+	}
+	// get exe if not already filled
+	if (!s->exe && event_exe) {
+		// dont do this search unless needed
+		str = strstr(n->message, "exe=");
+		if (str) {
+			str += 4;
+			if (*str == '"') {
+				str++;
+				term = strchr(str, '"');
+				if (term == NULL)
+					return 71;
+				*term = 0;
+				s->exe = strdup(str);
+				*term = '"';
+			} else 
+				s->exe = unescape(str);
+		} else
+			return 72;
+	}
+	return 0;
+}
+
-- 
1.8.3.1

--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit

[PATCH ghak28/ghak25 user v6 2/2] ausearch-parse: mod parser for YAASAO for NETFILTER_CFG

[Richard Guy Briggs]

Modify the YAASAO parser to accomodate the ghak25 NETFILTER_CFG record.

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
---
 src/ausearch-parse.c | 52 ++++++++++++++++++++++++++--------------------------
 1 file changed, 26 insertions(+), 26 deletions(-)

diff --git a/src/ausearch-parse.c b/src/ausearch-parse.c
index be1d32cdfa5f..cd8632a58ac0 100644
--- a/src/ausearch-parse.c
+++ b/src/ausearch-parse.c
@@ -173,11 +173,11 @@ int extract_search_items(llist *l)
 			case AUDIT_BPRM_FCAPS:
 			case AUDIT_CAPSET:
 			case AUDIT_MMAP:
-			case AUDIT_NETFILTER_CFG:
 			case AUDIT_PROCTITLE:
 			case AUDIT_REPLACE...AUDIT_BPF:
 				// Nothing to parse
 				break;
+			case AUDIT_NETFILTER_CFG:
 			case AUDIT_EVENT_LISTENER:
 				ret = parse_yaasao(n, s);
 				break;
@@ -2596,7 +2596,7 @@ static int parse_yaasao(lnode *n, search_items *s)
 		} else
 			return 54;
 	}
-	// get uid if not already filled
+	// optionally get uid if not already filled
 	if ((s->uid == -1 && !s->tuid) && (event_uid != -1 || event_tuid)) {
 		str = strstr(term, "uid=");
 		if (str) {
@@ -2610,31 +2610,31 @@ static int parse_yaasao(lnode *n, search_items *s)
 			if (errno)
 				return 56;
 			*term = ' ';
-			if (s->tuid) free((void *)s->tuid);
-			s->tuid = lookup_uid("uid", s->uid);
 		} else
-			return 57;
+			s->uid = 0;
+		if (s->tuid) free((void *)s->tuid);
+		s->tuid = lookup_uid("uid", s->uid);
 	}
-	// get loginuid if not already filled
+	// optionally get loginuid if not already filled
 	if ((s->loginuid == -2 && !s->tauid) && (event_loginuid != -2 || event_tauid)) {
 		str = strstr(term, "auid=");
 		if (str) {
 			ptr = str + 5;
 			term = strchr(ptr, ' ');
 			if (term == NULL)
-				return 58;
+				return 57;
 			*term = 0;
 			errno = 0;
 			s->loginuid = strtoul(ptr, NULL, 10);
 			if (errno)
-				return 59;
+				return 58;
 			*term = ' ';
-			if (s->tauid) free((void *)s->tauid);
-			s->tauid = lookup_uid("auid", s->loginuid);
 		} else
-			return 60;
+			s->loginuid = (unsigned long)-1;
+		if (s->tauid) free((void *)s->tauid);
+		s->tauid = lookup_uid("auid", s->loginuid);
 	}
-	// get tty if not already filled
+	// optionally get tty if not already filled
 	if (!s->terminal && event_terminal) {
 		// dont do this search unless needed
 		str = strstr(term, "tty=");
@@ -2642,31 +2642,31 @@ static int parse_yaasao(lnode *n, search_items *s)
 			str += 4;
 			term = strchr(str, ' ');
 			if (term == NULL)
-				return 61;
+				return 59;
 			*term = 0;
 			if (s->terminal) // ANOM_NETLINK has one
 				free(s->terminal);
 			s->terminal = strdup(str);
 			*term = ' ';
 		} else
-			return 62;
+			s->terminal = strdup("(none)");
 	}
-	// get ses if not already filled
+	// optionally get ses if not already filled
 	if (s->session_id == -2 && event_session_id != -2 ) {
 		str = strstr(term, "ses=");
 		if (str) {
 			ptr = str + 4;
 			term = strchr(ptr, ' ');
 			if (term == NULL)
-				return 63;
+				return 60;
 			*term = 0;
 			errno = 0;
 			s->session_id = strtoul(ptr, NULL, 10);
 			if (errno)
-				return 64;
+				return 61;
 			*term = ' ';
 		} else
-			return 65
+			s->session_id = (unsigned long)-1;
 	}
 	// get subject if not already filled
 	if (!s->avc && event_subject) {
@@ -2676,7 +2676,7 @@ static int parse_yaasao(lnode *n, search_items *s)
 			str += 5;
 			term = strchr(str, ' ');
 			if (term == NULL)
-				return 66;
+				return 62;
 			*term = 0;
 			if (audit_avc_init(s) == 0) {
 				anode an;
@@ -2686,9 +2686,9 @@ static int parse_yaasao(lnode *n, search_items *s)
 				alist_append(s->avc, &an);
 				*term = ' ';
 			} else
-				return 67;
+				return 63;
 		} else
-			return 68;
+			return 64;
 	}
 	// get command line if not already filled
 	if (!s->comm && event_comm) {
@@ -2703,16 +2703,16 @@ static int parse_yaasao(lnode *n, search_items *s)
 				str++;
 				term = strchr(str, '"');
 				if (term == NULL)
-					return 69;
+					return 65;
 				*term = 0;
 				s->comm = strdup(str);
 				*term = '"';
 			} else 
 				s->comm = unescape(str);
 		} else
-			return 70;
+			return 66;
 	}
-	// get exe if not already filled
+	// optionally get exe if not already filled
 	if (!s->exe && event_exe) {
 		// dont do this search unless needed
 		str = strstr(n->message, "exe=");
@@ -2722,14 +2722,14 @@ static int parse_yaasao(lnode *n, search_items *s)
 				str++;
 				term = strchr(str, '"');
 				if (term == NULL)
-					return 71;
+					return 67;
 				*term = 0;
 				s->exe = strdup(str);
 				*term = '"';
 			} else 
 				s->exe = unescape(str);
 		} else
-			return 72;
+			s->exe = strdup("(null)");
 	}
 	return 0;
 }
-- 
1.8.3.1

--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit