From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D0BADC48BD1 for ; Fri, 11 Jun 2021 00:32:22 +0000 (UTC) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 6AACF61073 for ; Fri, 11 Jun 2021 00:32:22 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 6AACF61073 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com Authentication-Results: mail.kernel.org; spf=tempfail smtp.mailfrom=linux-audit-bounces@redhat.com Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-566-ySFfky9GP9Sq7On7b-fyTA-1; Thu, 10 Jun 2021 20:32:19 -0400 X-MC-Unique: ySFfky9GP9Sq7On7b-fyTA-1 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 0B8CF91278; Fri, 11 Jun 2021 00:32:12 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id D76DA60937; Fri, 11 Jun 2021 00:32:11 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 8A66D1832DAB; Fri, 11 Jun 2021 00:32:11 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.rdu2.redhat.com [10.11.54.6]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 15B0SDCd029376 for ; Thu, 10 Jun 2021 20:28:13 -0400 Received: by smtp.corp.redhat.com (Postfix) id 0FE3E20877DA; Fri, 11 Jun 2021 00:28:13 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast04.extmail.prod.ext.rdu2.redhat.com [10.11.55.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 0B5F121602B4 for ; Fri, 11 Jun 2021 00:28:09 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-2.mimecast.com [205.139.110.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id C2336101D221 for ; Fri, 11 Jun 2021 00:28:08 +0000 (UTC) Received: from sonic312-31.consmr.mail.ne1.yahoo.com (sonic312-31.consmr.mail.ne1.yahoo.com [66.163.191.212]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-272-2H3nFZkWNUKVSQkxv83AUA-1; Thu, 10 Jun 2021 20:28:06 -0400 X-MC-Unique: 2H3nFZkWNUKVSQkxv83AUA-1 X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1623371285; bh=vJxgvEmJ50fqSZZQUpBsn1288uDgaGKP4jySsukHIgJ=; h=X-Sonic-MF:From:To:Subject:Date:From:Subject; b=Haainc8GXLFWrjQYZHXiCFJf57+GcmXpV2j/4CbgzxyZPK7zTXGQl7O7y2sM1QBkkJM4GJDcM8zJ+vAj061PU4nIz3Xx8j1zbBAYci+Khl0c6HzBJ9cXyUjHF5vZqaPqVWKrQ9vT54LzGiqy30I9EgLU/olioeHqmZ+WNW+x9LoWrr3Usb6xOuh9jHxNITKQP+xj6WCdB6WPvguVv32/adFquP0XSxqj4SFk3zTUOuSdwDxR0aIHoorzezWuzIQXv6EZznP+jEQ9wX7IC4Pk/x5kNlfYwvs1L2+dHEBSXbh7amQX2vJx4zc+pDcmLhS/BJZoGdLfKmc/hpmclF7mgQ== X-YMail-OSG: jHyRJOUVM1nfLGTW2Md_ZjNO6VRfXLCt_w8x.tnfXCj2eVQoAMbsyc3XRgZM7.O GWGYoDrxgOo0GhHvc2Nw05opUWUvuC4kldArZEOHsGz8h22f1byFlcJziikmTela4zgXOBQQmzpe LP6CMuh77l6Mgs5zVH9gG.BLnmYUpw2rqa8avEnf2tISMMFffKaXOLbZ6I4wdbkp5fAmglohYp7c 0NY7k0R3ajR7TdZlA.sap4O.e2Rt_lzG8XKpV6CH9MB6WCnuJCrtJlum7bRWZA_Z37tBIw4rHBJZ VOw804rTUF_eeDIz2t6vZG0FBiU27Y9381KleCTgcE.y.YLwjhuyieEhOA_t8votaTh2BnibNn0M 38Yjvl1G9ysZNDp4h7Ea9tO4xFCVnBLgqVokQOJ391_tvgsbTff3PVjtggvptEQnodmIxHpSqPGQ UT57qJf9WFB_TkyxwFU1cPKa5QuSxTI61pd3_dn7OJWFYlVOdFBXa18ZyEAOFcdpv4zFuxnHCiyZ A43QQvemMpFm.bUgRlp3hIL66jMlTVGrduZNqBTgqarExQctIRefRLdtdqofNqIDE7jclshvhhh2 7eoyadS6nqkdJ0olKfb7uNnqD_Yr740V3CEAt2wwpSHiZXmDNAqEvP_M.P6PlTw3KUKjxdyq8DjX v0gmma_1A0tQVOy_Rdp0ia7ItUCULwXaaAw7dVOyutYZwWWfitAb6UQpKrSM5oGTgpfYGSEljq0_ RfsBD6xE7wyxjpDLgHGk8TvOzCSUjntMkYtTQN1jd9YUxYCECBQ4zseEugvb1fBLDL8iNpJrlrBp hXEDUB9p0DazJ0a4QvJ83pRfAYFASR0rS3nhLSGgxdkS2N6xoK1uF2i97h.7PMY2L0J23g9GoYT6 exZ3ozLBpZ1rdi4l6hTvGrlImXCQHRRE.A.HpzyK0y6Qb5BHoIyo8rrugCVgeQhfBVLV0zrgYoXA NHNoRntKvMIdkh8ZG0M40TmbbeArpmEM5U1PIerXRiUA3FUBHQNI0SEDschnYYacvkE599sW4FcA Tn_K217A..e0CbYgwZFpv21NcrrKr3kpbSsV7DX_PEXn14sD0GXfypQtlLVtnfkR7xEYsmuSOCf9 jre51x7XYxzEjDo9EiQUscYZzzC62iW79dJJtg9ukfi9P.F4YZpKzckWmDQjYarST4RrqZ6HRTeq RtyGDBF.I_KritetrziT4SLcYydFzMjl91gmyh.7rtRZkQs8eCYdpi0.a_.4s.EqXZQ0oXTwqdkH avTqmC1o27LU1wvKX2LKw4d3Va8cY8J5pnh5i5qEqX.ysjNnCxo8FddtFke8Sdx0PGmr0FV8LxlW niblF2rMMX.XzJe.ak2LwyVyw4rIXJYVOvOz2ARMP.doEuSkN7wyS6pmizxCmSxUlpoCG_FtDqRC HfMuE9DFk.4LPKJbrZr.i2QCXA6l1MBQT103Jro_3NX7jU0bHl_54COfCMsf1cZjbZshga5pO8OT uBrGw2ieMc_gXL42VqdakwjM2Ze5eOnVEbaJL6afUT8IwV1rU1269bX1hP6O.KWfUBNyMokdu2Hl Jh353DVFVSXiRptfeu_t_Ix_fkozMHvy08QkbF61ZdKfe9Q1.BmPrRvEHafJKfU13ztWHwokBI5W TBfg0Y0R3USfB_7U3P2PeVp3CAxy_tb92gZrn6IidsB_iw7.X89boyoXx_wmhuv0aaeAsV0LXXRn o.NdBhreWBo87T8Erl2F8V9ooSStP1MS22CdwbQzklE7ddP9sVh3c3PrcPeqocoy4bPx6rMUxmQ5 3pTxXKt3v9uY5PCcdeH96KO2qYafp9rMxQNT1Ahi5jrGnZMfYe4fR3TkytWwhaEBsSP8XgWQVHgA BO_vvvTvYo_Q8LK76pGHPtFEeZF3FWRb9kkALy6SzOJs_qfVtvgWfZLqaPgFVcpBcKjzFQgyrNKz yMafqWidZVC7SCVgnUxBqVEmhy.6Vn4PSIn1_43Cu1sbBTRTb8E8u7RuIafQtfB2Gjik9znNIjMq fexWuxedlizmcVyLWxWjb_w_eb241YzDY3er7.GPaveJLkcf0rW2PC9CBXnmX0db.RVKMXbS8cRT 4NqmFt6oqs0MfU5UoioQwwuSx_LoW2SOrqq1SZca_Eg3VYtbhIkIgD88g.HLPrGy8ac_RCgZPb0s .t4l2Hf2y_rBVYYtQqoE4wzR.9GZXOETfXh9SCxBIUwajk7rX6cL5E5.cumTNZwnI.y9hKM9VjlW IrWTtnyiJ2m_PcWLx3xlyuGNHY6tq7JSql9YMtq1pUHUTl1SJhb8tgGuHe9qwFKiP8mEWGSTObyV UDBln4X8RRrt_RFr6lFGltLBGGkoZadY6j6t1RO00UaD1V7VQuLcoluXjNlNZ9t8eL8_43fRPUrb TtQKUeFjwaMgpjQRqvv0LD.8DBoZoUBvIE8GkOA7LkNMY2M_d5I5Eo4MevOHraxQWHeIvu00pV6N YMnSqfwa_5_DCf0x_n0IQSB3DmyTQ9x.pRuEcoBJxfxl8BrcwlwHJSynAQeJyWv1o3G_mRyFBvNO YIlHYu3KXyU2YfubAbTXbcvVWck8YVbTglfKZczi3ENt8vBIob.S_MQMDpcnq35JSbVZNk9cU.Dp K_Vdsd4lbGW53SogZJy8RumSdT4ECFskivCkh5SC1o5lHs2kTZ_77QBuBn4jmQJxwLSK3Qm.PL_L 0sQQ.tyUVEK3thwTpo2bAQExA2FL4GniCtK5iyH.9zedoK7aSrJwfyhlxli6oGaTQ2WeAruqa58e wDsXcypO.nM.bK4YBJwc5yGvmRgII9MBfRbPVbnut0GujR28KFbkaoNK3LH18_2gm8zyKTne6j54 96YxdpT74ASYxrBrkuq.7uLHgkNGSyhFiSll7ioQzQ.GsL3Q3GcXP3X7OyyzFP3rGxdiEqQfsNDC XCT9uS14prnPvZuQk1vV5.5GBcvQHOxA8ODEVIzXBlHJ80.riSOw5XD5Zm3GoLZLD5hG7NWlxB4D tZiFA8q9ZbNueXMUEq1YGRqExMeNZyoJhEKKoKBmjTiMm1S6a4MQrI4CfjDldNZSW4YymewgBKDP QmZcoIKcGoOlfTFbNF5S1z9kZlh9vL_KBEjnlDAE6eJgWg4R55gJ3LNjxUQqs8nb_WvwHj5Psg9w Xsfqmh9KJQzsF8eq1wo06mEHkzSD91fHDBxMViCSfma63FpwOk5GjCvlXMT4- X-Sonic-MF: Received: from sonic.gate.mail.ne1.yahoo.com by sonic312.consmr.mail.ne1.yahoo.com with HTTP; Fri, 11 Jun 2021 00:28:05 +0000 Received: by kubenode560.mail-prod1.omega.gq1.yahoo.com (VZM Hermes SMTP Server) with ESMTPA ID 03105bb17edb9375c7f9fde1dbc1d821; Fri, 11 Jun 2021 00:27:59 +0000 (UTC) From: Casey Schaufler To: casey.schaufler@intel.com, jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Subject: [PATCH v27 21/25] audit: add support for non-syscall auxiliary records Date: Thu, 10 Jun 2021 17:04:31 -0700 Message-Id: <20210611000435.36398-22-casey@schaufler-ca.com> In-Reply-To: <20210611000435.36398-1-casey@schaufler-ca.com> References: <20210611000435.36398-1-casey@schaufler-ca.com> MIME-Version: 1.0 X-Mimecast-Impersonation-Protect: Policy=CLT - Impersonation Protection Definition; Similar Internal Domain=false; Similar Monitored External Domain=false; Custom External Domain=false; Mimecast External Domain=false; Newly Observed Domain=false; Internal User Name=false; Custom Display Name List=false; Reply-to Address Mismatch=false; Targeted Threat Dictionary=false; Mimecast Threat Dictionary=false; Custom Threat Dictionary=false X-Scanned-By: MIMEDefang 2.78 on 10.11.54.6 X-loop: linux-audit@redhat.com Cc: john.johansen@canonical.com, linux-kernel@vger.kernel.org, Richard Guy Briggs , linux-audit@redhat.com, sds@tycho.nsa.gov X-BeenThere: linux-audit@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Linux Audit Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=linux-audit-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Standalone audit records have the timestamp and serial number generated on the fly and as such are unique, making them standalone. This new function audit_alloc_local() generates a local audit context that will be used only for a standalone record and its auxiliary record(s). The context is discarded immediately after the local associated records are produced. Signed-off-by: Richard Guy Briggs Signed-off-by: Casey Schaufler Cc: linux-audit@redhat.com To: Richard Guy Briggs --- include/linux/audit.h | 8 ++++++++ kernel/audit.h | 1 + kernel/auditsc.c | 33 ++++++++++++++++++++++++++++----- 3 files changed, 37 insertions(+), 5 deletions(-) diff --git a/include/linux/audit.h b/include/linux/audit.h index 418a485af114..97cd7471e572 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -289,6 +289,8 @@ static inline int audit_signal_info(int sig, struct task_struct *t) /* Public API */ extern int audit_alloc(struct task_struct *task); extern void __audit_free(struct task_struct *task); +extern struct audit_context *audit_alloc_local(gfp_t gfpflags); +extern void audit_free_context(struct audit_context *context); extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1, unsigned long a2, unsigned long a3); extern void __audit_syscall_exit(int ret_success, long ret_value); @@ -552,6 +554,12 @@ static inline void audit_log_nfcfg(const char *name, u8 af, extern int audit_n_rules; extern int audit_signals; #else /* CONFIG_AUDITSYSCALL */ ++static inline struct audit_context *audit_alloc_local(gfp_t gfpflags) +{ + return NULL; +} +static inline void audit_free_context(struct audit_context *context) +{ } static inline int audit_alloc(struct task_struct *task) { return 0; diff --git a/kernel/audit.h b/kernel/audit.h index 23a85a470121..27ef690afd30 100644 --- a/kernel/audit.h +++ b/kernel/audit.h @@ -99,6 +99,7 @@ struct audit_proctitle { struct audit_context { int dummy; /* must be the first element */ int in_syscall; /* 1 if task is in a syscall */ + bool local; /* local context needed */ enum audit_state state, current_state; unsigned int serial; /* serial number for record */ int major; /* syscall number */ diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 67da23f6bebd..d4e061f95da8 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -925,11 +925,13 @@ static inline void audit_free_aux(struct audit_context *context) } } -static inline struct audit_context *audit_alloc_context(enum audit_state state) +static inline struct audit_context *audit_alloc_context(enum audit_state state, + gfp_t gfpflags) { struct audit_context *context; - context = kzalloc(sizeof(*context), GFP_KERNEL); + /* We can be called in atomic context via audit_tg() */ + context = kzalloc(sizeof(*context), gfpflags); if (!context) return NULL; context->state = state; @@ -965,7 +967,8 @@ int audit_alloc(struct task_struct *tsk) return 0; } - if (!(context = audit_alloc_context(state))) { + context = audit_alloc_context(state, GFP_KERNEL); + if (!context) { kfree(key); audit_log_lost("out of memory in audit_alloc"); return -ENOMEM; @@ -977,8 +980,27 @@ int audit_alloc(struct task_struct *tsk) return 0; } -static inline void audit_free_context(struct audit_context *context) +struct audit_context *audit_alloc_local(gfp_t gfpflags) { + struct audit_context *context = NULL; + + context = audit_alloc_context(AUDIT_RECORD_CONTEXT, gfpflags); + if (!context) { + audit_log_lost("out of memory in audit_alloc_local"); + goto out; + } + context->serial = audit_serial(); + ktime_get_coarse_real_ts64(&context->ctime); + context->local = true; +out: + return context; +} +EXPORT_SYMBOL(audit_alloc_local); + +void audit_free_context(struct audit_context *context) +{ + if (!context) + return; audit_free_module(context); audit_free_names(context); unroll_tree_refs(context, NULL, 0); @@ -989,6 +1011,7 @@ static inline void audit_free_context(struct audit_context *context) audit_proctitle_free(context); kfree(context); } +EXPORT_SYMBOL(audit_free_context); static int audit_log_pid_context(struct audit_context *context, pid_t pid, kuid_t auid, kuid_t uid, @@ -2210,7 +2233,7 @@ EXPORT_SYMBOL_GPL(__audit_inode_child); int auditsc_get_stamp(struct audit_context *ctx, struct timespec64 *t, unsigned int *serial) { - if (!ctx->in_syscall) + if (!ctx->in_syscall && !ctx->local) return 0; if (!ctx->serial) ctx->serial = audit_serial(); -- 2.29.2 -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit