Re: [PATCH v3 2/7] add support for the uring filter list

[Richard Guy Briggs <rgb@redhat.com>]

On 2021-10-29 14:39, Steve Grubb wrote:
> On Thursday, October 28, 2021 3:59:34 PM EDT Richard Guy Briggs wrote:
> > Kernel support to audit io_uring operations filtering was added with
> > commit 67daf270cebc ("audit: add filtering for io_uring records").  Add
> > support for the "uring" filter list to auditctl.
> 
> Might have been good to show what the resulting auditctl command looks like. 
> I think it would be:
> 
> auditctl -a always,io_ring  -U  open -F uid!=0 -F key=io_ring
> 
> But I wonder, why the choice of  -U rather than -S? That would make 
> remembering the syntax easier.
> 
> auditctl -a always,io_ring  -S  open -F uid!=0 -F key=io_ring

Well, I keep seeing the same what I assume is a typo in your
communications about io_uring where the "u" is missing, which might help
trigger your memory about the syntax.

The io_uring operations name list is different than the syscall list, so
it needs to use a different lookup table.

Have I misunderstood something?

> > Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
> > ---
> >  docs/audit.rules.7         |  19 ++++--
> >  docs/audit_add_rule_data.3 |   4 ++
> >  docs/auditctl.8            |  10 ++-
> >  lib/flagtab.h              |  11 ++--
> >  lib/libaudit.c             |  50 ++++++++++++---
> >  lib/libaudit.h             |   7 +++
> >  lib/lookup_table.c         |  20 ++++++
> >  lib/private.h              |   1 +
> >  src/auditctl-listing.c     |  52 ++++++++++------
> >  src/auditctl.c             | 121 ++++++++++++++++++++++++++++++++-----
> >  10 files changed, 240 insertions(+), 55 deletions(-)
> 
> 
> <snip a whole lot of documentation> 
> 
> 
> > diff --git a/lib/libaudit.c b/lib/libaudit.c
> > index 54e276156ef0..3790444f4497 100644
> > --- a/lib/libaudit.c
> > +++ b/lib/libaudit.c
> > @@ -86,6 +86,7 @@ static const struct nv_list failure_actions[] =
> >  int _audit_permadded = 0;
> >  int _audit_archadded = 0;
> >  int _audit_syscalladded = 0;
> > +int _audit_uringopadded = 0;
> >  int _audit_exeadded = 0;
> >  int _audit_filterfsadded = 0;
> >  unsigned int _audit_elf = 0U;
> > @@ -999,6 +1000,26 @@ int audit_rule_syscallbyname_data(struct
> > audit_rule_data *rule, return -1;
> >  }
> > 
> > +int audit_rule_uringopbyname_data(struct audit_rule_data *rule,
> > +                                  const char *uringop)
> > +{
> > +	int nr, i;
> > +
> > +	if (!strcmp(uringop, "all")) {
> > +		for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
> > +			rule->mask[i] = ~0;
> > +		return 0;
> > +	}
> > +	nr = audit_name_to_uringop(uringop);
> > +	if (nr < 0) {
> > +		if (isdigit(uringop[0]))
> > +			nr = strtol(uringop, NULL, 0);
> > +	}
> > +	if (nr >= 0)
> > +		return audit_rule_syscall_data(rule, nr);
> > +	return -1;
> > +}
> > +
> >  int audit_rule_interfield_comp_data(struct audit_rule_data **rulep,
> >  					 const char *pair,
> >  					 int flags)
> > @@ -1044,7 +1065,7 @@ int audit_rule_interfield_comp_data(struct
> > audit_rule_data **rulep, return -EAU_COMPVALUNKNOWN;
> > 
> >  	/* Interfield comparison can only be in exit filter */
> > -	if (flags != AUDIT_FILTER_EXIT)
> > +	if (flags != AUDIT_FILTER_EXIT && flags != AUDIT_FILTER_URING_EXIT)
> >  		return -EAU_EXITONLY;
> > 
> >  	// It should always be AUDIT_FIELD_COMPARE
> > @@ -1557,7 +1578,8 @@ int audit_rule_fieldpair_data(struct audit_rule_data
> > **rulep, const char *pair, }
> >  			break;
> >  		case AUDIT_EXIT:
> > -			if (flags != AUDIT_FILTER_EXIT)
> > +			if (flags != AUDIT_FILTER_EXIT &&
> > +			    flags != AUDIT_FILTER_URING_EXIT)
> >  				return -EAU_EXITONLY;
> >  			vlen = strlen(v);
> >  			if (isdigit((char)*(v)))
> > @@ -1599,7 +1621,8 @@ int audit_rule_fieldpair_data(struct audit_rule_data
> > **rulep, const char *pair, case AUDIT_DIR:
> >  			/* Watch & object filtering is invalid on anything
> >  			 * but exit */
> > -			if (flags != AUDIT_FILTER_EXIT)
> > +			if (flags != AUDIT_FILTER_EXIT &&
> > +			    flags != AUDIT_FILTER_URING_EXIT)
> >  				return -EAU_EXITONLY;
> >  			if (field == AUDIT_WATCH || field == AUDIT_DIR)
> >  				_audit_permadded = 1;
> > @@ -1621,9 +1644,11 @@ int audit_rule_fieldpair_data(struct audit_rule_data
> > **rulep, const char *pair, _audit_exeadded = 1;
> >  			}
> >  			if (field == AUDIT_FILTERKEY &&
> > -				!(_audit_syscalladded || _audit_permadded ||
> > -				_audit_exeadded ||
> > -				_audit_filterfsadded))
> > +				!(_audit_syscalladded ||
> > +				  _audit_uringopadded ||
> > +				  _audit_permadded ||
> > +				  _audit_exeadded ||
> > +				  _audit_filterfsadded))
> >                                  return -EAU_KEYDEP;
> >  			vlen = strlen(v);
> >  			if (field == AUDIT_FILTERKEY &&
> > @@ -1712,7 +1737,8 @@ int audit_rule_fieldpair_data(struct audit_rule_data
> > **rulep, const char *pair, }
> >  			break;
> >  		case AUDIT_FILETYPE:
> > -			if (!(flags == AUDIT_FILTER_EXIT))
> > +			if (!(flags == AUDIT_FILTER_EXIT ||
> > +			      flags == AUDIT_FILTER_URING_EXIT))
> >  				return -EAU_EXITONLY;
> >  			rule->values[rule->field_count] =
> >  				audit_name_to_ftype(v);
> > @@ -1754,7 +1780,8 @@ int audit_rule_fieldpair_data(struct audit_rule_data
> > **rulep, const char *pair, return -EAU_FIELDNOSUPPORT;
> >  			if (flags != AUDIT_FILTER_EXCLUDE &&
> >  			    flags != AUDIT_FILTER_USER &&
> > -			    flags != AUDIT_FILTER_EXIT)
> > +			    flags != AUDIT_FILTER_EXIT &&
> > +			    flags != AUDIT_FILTER_URING_EXIT)
> 
> This is in the session_id code. Looking at the example audit event:
> 
> https://listman.redhat.com/archives/linux-audit/2021-September/msg00058.html
> 
> session_id is not in the record.

Fair enough.  It can be re-added if we are able to reliably report it.

> >  				return -EAU_FIELDNOFILTER;
> >  			// Do positive & negative separate for 32 bit systems
> >  			vlen = strlen(v);
> > @@ -1775,7 +1802,8 @@ int audit_rule_fieldpair_data(struct audit_rule_data
> > **rulep, const char *pair, break;
> >  		case AUDIT_DEVMAJOR...AUDIT_INODE:
> 
> ^^^ Can you audit by devmajor, devminor, or inode in io_ring?

Should be able to monitor files.  The old "-w" syntax is not supported
but path= and dir= should be.

> >  		case AUDIT_SUCCESS:
> > -			if (flags != AUDIT_FILTER_EXIT)
> > +			if (flags != AUDIT_FILTER_EXIT &&
> > +			    flags != AUDIT_FILTER_URING_EXIT)
> >  				return -EAU_EXITONLY;
> >  			/* fallthrough */
> >  		default:
> > @@ -1785,7 +1813,9 @@ int audit_rule_fieldpair_data(struct audit_rule_data
> > **rulep, const char *pair, return -EAU_OPEQNOTEQ;
> >  			}
> > 
> > -			if (field == AUDIT_PPID && !(flags==AUDIT_FILTER_EXIT))
> > +			if (field == AUDIT_PPID &&
> > +			    !(flags == AUDIT_FILTER_EXIT ||
> > +			      flags == AUDIT_FILTER_URING_EXIT))
> >  				return -EAU_EXITONLY;
> > 
> >  			if (!isdigit((char)*(v)))
> > diff --git a/lib/libaudit.h b/lib/libaudit.h
> > index 08b7d22678aa..a73edc677df0 100644
> > --- a/lib/libaudit.h
> > +++ b/lib/libaudit.h
> > @@ -341,6 +341,9 @@ extern "C" {
> >  #ifndef AUDIT_FILTER_EXCLUDE
> >  #define AUDIT_FILTER_EXCLUDE	AUDIT_FILTER_TYPE
> >  #endif
> > +#ifndef AUDIT_FILTER_URING_EXIT
> > +#define AUDIT_FILTER_URING_EXIT	0x07 /* filter on exit from io_uring op 
> */
> > +#endif
> >  #define AUDIT_FILTER_MASK	0x07	/* Mask to get actual filter */
> >  #define AUDIT_FILTER_UNSET	0x80	/* This value means filter is unset */
> > 
> > @@ -612,6 +615,8 @@ extern int        audit_name_to_field(const char
> > *field); extern const char *audit_field_to_name(int field);
> >  extern int        audit_name_to_syscall(const char *sc, int machine);
> >  extern const char *audit_syscall_to_name(int sc, int machine);
> > +extern int        audit_name_to_uringop(const char *uringopop);
> > +extern const char *audit_uringop_to_name(int uringop);
> >  extern int        audit_name_to_flag(const char *flag);
> >  extern const char *audit_flag_to_name(int flag);
> >  extern int        audit_name_to_action(const char *action);
> > @@ -706,6 +711,8 @@ extern struct audit_rule_data
> > *audit_rule_create_data(void); extern void audit_rule_init_data(struct
> > audit_rule_data *rule);
> >  extern int audit_rule_syscallbyname_data(struct audit_rule_data *rule,
> >                                            const char *scall);
> > +extern int audit_rule_uringopbyname_data(struct audit_rule_data *rule,
> > +                                          const char *uringop);
> >  /* Note that the following function takes a **, where
> > audit_rule_fieldpair() * takes just a *.  That structure may need to be
> > reallocated as a result of * adding new fields */
> > diff --git a/lib/lookup_table.c b/lib/lookup_table.c
> > index 23678a4d142e..ca619fba930d 100644
> > --- a/lib/lookup_table.c
> > +++ b/lib/lookup_table.c
> > @@ -142,6 +142,18 @@ int audit_name_to_syscall(const char *sc, int machine)
> > return -1;
> >  }
> > 
> > +int audit_name_to_uringop(const char *uringop)
> > +{
> > +	int res = -1, found = 0;
> > +
> > +#ifndef NO_TABLES
> > +	//found = uringop_s2i(uringop, &res);
> 
> Why are we creating commented out function calls? It seems like this belongs 
> in another patch and not here. But let's save everyone some iterations and 
> overlook that.

That's a placeholder for the following patch that could be squashed in
with this one, or it might belong in another if things are re-ordered.

> Review complete...
> 
> -Steve
> 
> > +#endif
> > +	if (found)
> > +		return res;
> > +	return -1;
> > +}
> > +
> >  const char *audit_syscall_to_name(int sc, int machine)
> >  {
> >  #ifndef NO_TABLES
> > @@ -172,6 +184,14 @@ const char *audit_syscall_to_name(int sc, int machine)
> > return NULL;
> >  }
> > 
> > +const char *audit_uringop_to_name(int uringop)
> > +{
> > +#ifndef NO_TABLES
> > +	//return uringop_i2s(uringop);
> > +#endif
> > +	return NULL;
> > +}
> > +
> >  int audit_name_to_flag(const char *flag)
> >  {
> >  	int res;
> > diff --git a/lib/private.h b/lib/private.h
> > index c3a7364fcfb8..b0d3fa4109c5 100644
> > --- a/lib/private.h
> > +++ b/lib/private.h
> > @@ -135,6 +135,7 @@ AUDIT_HIDDEN_END
> >  extern int _audit_permadded;
> >  extern int _audit_archadded;
> >  extern int _audit_syscalladded;
> > +extern int _audit_uringopadded;
> >  extern int _audit_exeadded;
> >  extern int _audit_filterfsadded;
> >  extern unsigned int _audit_elf;
> > diff --git a/src/auditctl-listing.c b/src/auditctl-listing.c
> > index a5d6bc2b046f..3d80906ffd24 100644
> > --- a/src/auditctl-listing.c
> > +++ b/src/auditctl-listing.c
> > @@ -137,15 +137,22 @@ static int print_syscall(const struct audit_rule_data
> > *r, unsigned int *sc) int all = 1;
> >  	unsigned int i;
> >  	int machine = audit_detect_machine();
> > -
> > -	/* Rules on the following filters do not take a syscall */
> > -	if (((r->flags & AUDIT_FILTER_MASK) == AUDIT_FILTER_USER) ||
> > -	    ((r->flags & AUDIT_FILTER_MASK) == AUDIT_FILTER_TASK) ||
> > -	    ((r->flags &AUDIT_FILTER_MASK) == AUDIT_FILTER_EXCLUDE) ||
> > -	    ((r->flags &AUDIT_FILTER_MASK) == AUDIT_FILTER_FS))
> > +	int uring = 0;
> > +
> > +	/* Rules on the following filters do not take a syscall (or uringop) 
> */
> > +	switch (r->flags & AUDIT_FILTER_MASK) {
> > +	case AUDIT_FILTER_USER:
> > +	case AUDIT_FILTER_TASK:
> > +	case AUDIT_FILTER_EXCLUDE:
> > +	case AUDIT_FILTER_FS:
> >  		return 0;
> > +		break;
> > +	case AUDIT_FILTER_URING_EXIT:
> > +		uring = 1;
> > +		break;
> > +	}
> > 
> > -	/* See if its all or specific syscalls */
> > +	/* See if its all or specific syscalls/uringops */
> >  	for (i = 0; i < (AUDIT_BITMASK_SIZE-1); i++) {
> >  		if (r->mask[i] != (uint32_t)~0) {
> >  			all = 0;
> > @@ -154,21 +161,32 @@ static int print_syscall(const struct audit_rule_data
> > *r, unsigned int *sc) }
> > 
> >  	if (all) {
> > -		printf(" -S all");
> > +		if (uring)
> > +			printf(" -U all");
> > +		else
> > +			printf(" -S all");
> >  		count = i;
> >  	} else for (i = 0; i < AUDIT_BITMASK_SIZE * 32; i++) {
> >  		int word = AUDIT_WORD(i);
> >  		int bit  = AUDIT_BIT(i);
> >  		if (r->mask[word] & bit) {
> >  			const char *ptr;
> > -			if (_audit_elf)
> > -				machine = audit_elf_to_machine(_audit_elf);
> > -			if (machine < 0)
> > -				ptr = NULL;
> > -			else
> > -				ptr = audit_syscall_to_name(i, machine);
> > +
> > +			if (uring)
> > +				ptr = audit_uringop_to_name(i);
> > +			else {
> > +				if (_audit_elf)
> > +					machine = 
> audit_elf_to_machine(_audit_elf);
> > +				if (machine < 0)
> > +					ptr = NULL;
> > +				else
> > +					ptr = audit_syscall_to_name(i, machine);
> > +			}
> >  			if (!count)
> > -				printf(" -S ");
> > +				if (uring)
> > +					printf(" -U ");
> > +				else
> > +					printf(" -S ");
> >  			if (ptr)
> >  				printf("%s%s", !count ? "" : ",", ptr);
> >  			else
> > @@ -297,7 +315,7 @@ static void print_rule(const struct audit_rule_data *r)
> > int mach = -1, watch = is_watch(r);
> >  	unsigned long long a0 = 0, a1 = 0;
> > 
> > -	if (!watch) { /* This is syscall auditing */
> > +	if (!watch) { /* This is syscall or uring auditing */
> >  		printf("-a %s,%s",
> >  			audit_action_to_name((int)r->action),
> >  				audit_flag_to_name(r->flags));
> > @@ -310,7 +328,7 @@ static void print_rule(const struct audit_rule_data *r)
> > mach = print_arch(r->values[i], op);
> >  			}
> >  		}
> > -		// And last do the syscalls
> > +		// And last do the syscalls/uringops
> >  		count = print_syscall(r, &sc);
> >  	}
> > 
> > diff --git a/src/auditctl.c b/src/auditctl.c
> > index f9bfc2a247d2..74df4f17f887 100644
> > --- a/src/auditctl.c
> > +++ b/src/auditctl.c
> > @@ -76,6 +76,7 @@ static int reset_vars(void)
> >  {
> >  	list_requested = 0;
> >  	_audit_syscalladded = 0;
> > +	_audit_uringopadded = 0;
> >  	_audit_permadded = 0;
> >  	_audit_archadded = 0;
> >  	_audit_exeadded = 0;
> > @@ -110,7 +111,7 @@ static void usage(void)
> >       "    -C f=f                            Compare collected fields if
> > available:\n" "                                      Field name,
> > operator(=,!=), field name\n" "    -d <l,a>                         
> > Delete rule from <l>ist with <a>ction\n" -     "                          
> >            l=task,exit,user,exclude,filesystem\n" +     "                 
> >                     l=task,exit,user,exclude,filesystem,uring\n" "        
> >                              a=never,always\n"
> >       "    -D                                Delete all rules and
> > watches\n" "    -e [0..2]                         Set enabled flag\n"
> > @@ -132,6 +133,7 @@ static void usage(void)
> >       "    -S syscall                        Build rule: syscall name or
> > number\n" "    --signal <signal>                 Send the specified signal
> > to the daemon\n" "    -t                                Trim directory
> > watches\n" +     "    -U uringop                        Build rule: uring
> > op name or number\n" "    -v                                Version\n"
> >       "    -w <path>                         Insert watch at <path>\n"
> >       "    -W <path>                         Remove watch at <path>\n"
> > @@ -164,6 +166,8 @@ static int lookup_filter(const char *str, int *filter)
> >  		exclude = 1;
> >  	} else if (strcmp(str, "filesystem") == 0)
> >  		*filter = AUDIT_FILTER_FS;
> > +	else if (strcmp(str, "uring") == 0)
> > +		*filter = AUDIT_FILTER_URING_EXIT;
> >  	else
> >  		return 2;
> >  	return 0;
> > @@ -541,6 +545,36 @@ static int parse_syscall(const char *optarg)
> >  	return audit_rule_syscallbyname_data(rule_new, optarg);
> >  }
> > 
> > +static int parse_uringop(const char *optarg)
> > +{
> > +	int retval = 0;
> > +	char *saved;
> > +
> > +	if (strchr(optarg, ',')) {
> > +		char *ptr, *tmp = strdup(optarg);
> > +		if (tmp == NULL)
> > +			return -1;
> > +		ptr = strtok_r(tmp, ",", &saved);
> > +		while (ptr) {
> > +			retval = audit_rule_uringopbyname_data(rule_new, ptr);
> > +			if (retval != 0) {
> > +				if (retval == -1) {
> > +					audit_msg(LOG_ERR,
> > +						"Uring op name unknown: %s",
> > +						ptr);
> > +					retval = -3; // error reported
> > +				}
> > +				break;
> > +			}
> > +			ptr = strtok_r(NULL, ",", &saved);
> > +		}
> > +		free(tmp);
> > +		return retval;
> > +	}
> > +
> > +	return audit_rule_uringopbyname_data(rule_new, optarg);
> > +}
> > +
> >  static struct option long_opts[] =
> >  {
> >  #if HAVE_DECL_AUDIT_FEATURE_VERSION == 1
> > @@ -576,7 +610,7 @@ static int setopt(int count, int lineno, char *vars[])
> >      keylen = AUDIT_MAX_KEY_LEN;
> > 
> >      while ((retval >= 0) && (c = getopt_long(count, vars,
> > -			"hicslDvtC:e:f:r:b:a:A:d:S:F:m:R:w:W:k:p:q:",
> > +			"hicslDvtC:e:f:r:b:a:A:d:S:U:F:m:R:w:W:k:p:q:",
> >  			long_opts, &lidx)) != EOF) {
> >  	int flags = AUDIT_FILTER_UNSET;
> >  	rc = 10;	// Init to something impossible to see if unused.
> > @@ -715,9 +749,10 @@ static int setopt(int count, int lineno, char *vars[])
> > retval = -1;
> >  		break;
> >          case 'a':
> > -		if (strstr(optarg, "task") && _audit_syscalladded) {
> > +		if (strstr(optarg, "task") && (_audit_syscalladded ||
> > +					       _audit_uringopadded)) {
> >  			audit_msg(LOG_ERR,
> > -				"Syscall auditing requested for task list");
> > +				"Syscall or uring op auditing requested for task 
> list");
> >  			retval = -1;
> >  		} else {
> >  			rc = audit_rule_setup(optarg, &add, &action);
> > @@ -739,9 +774,10 @@ static int setopt(int count, int lineno, char *vars[])
> > }
> >  		break;
> >          case 'A':
> > -		if (strstr(optarg, "task") && _audit_syscalladded) {
> > -			audit_msg(LOG_ERR,
> > -			   "Error: syscall auditing requested for task list");
> > +		if (strstr(optarg, "task") && (_audit_syscalladded ||
> > +					       _audit_uringopadded)) {
> > +			audit_msg(LOG_ERR,
> > +				"Syscall or uring op auditing requested for task 
> list");
> >  			retval = -1;
> >  		} else {
> >  			rc = audit_rule_setup(optarg, &add, &action);
> > @@ -809,6 +845,10 @@ static int setopt(int count, int lineno, char *vars[])
> > audit_msg(LOG_ERR,
> >  		    "Error: syscall auditing cannot be put on exclude list");
> >  			return -1;
> > +		} else if (((add | del) & AUDIT_FILTER_MASK) == 
> AUDIT_FILTER_URING_EXIT)
> > { +			audit_msg(LOG_ERR,
> > +		    "Error: syscall auditing cannot be put on uringop list");
> > +			return -1;
> >  		} else {
> >  			if (unknown_arch) {
> >  				int machine;
> > @@ -853,14 +893,63 @@ static int setopt(int count, int lineno, char
> > *vars[]) break;
> >  		}}
> >  		break;
> > +        case 'U':
> > +		/* Do some checking to make sure that we are not adding a
> > +		 * uring op rule to a list that does not make sense. */
> > +		if (((add & (AUDIT_FILTER_MASK|AUDIT_FILTER_UNSET)) ==
> > +				AUDIT_FILTER_TASK || (del &
> > +				(AUDIT_FILTER_MASK|AUDIT_FILTER_UNSET)) ==
> > +				AUDIT_FILTER_TASK)) {
> > +			audit_msg(LOG_ERR,
> > +			  "Error: uring op auditing being added to task list");
> > +			return -1;
> > +		} else if (((add & (AUDIT_FILTER_MASK|AUDIT_FILTER_UNSET)) ==
> > +				AUDIT_FILTER_USER || (del &
> > +				(AUDIT_FILTER_MASK|AUDIT_FILTER_UNSET)) ==
> > +				AUDIT_FILTER_USER)) {
> > +			audit_msg(LOG_ERR,
> > +			  "Error: uring op auditing being added to user list");
> > +			return -1;
> > +		} else if (((add & (AUDIT_FILTER_MASK|AUDIT_FILTER_UNSET)) ==
> > +				AUDIT_FILTER_FS || (del &
> > +				(AUDIT_FILTER_MASK|AUDIT_FILTER_UNSET)) ==
> > +				AUDIT_FILTER_FS)) {
> > +			audit_msg(LOG_ERR,
> > +			  "Error: uring op auditing being added to filesystem 
> list");
> > +			return -1;
> > +		} else if (exclude) {
> > +			audit_msg(LOG_ERR,
> > +		    "Error: uring op auditing cannot be put on exclude list");
> > +			return -1;
> > +		} else if (((add | del) & AUDIT_FILTER_MASK) == 
> AUDIT_FILTER_EXIT) {
> > +			audit_msg(LOG_ERR,
> > +		    "Error: uringop auditing cannot be put on syscall list");
> > +			return -1;
> > +		}
> > +		rc = parse_uringop(optarg);
> > +		switch (rc)
> > +		{
> > +			case 0:
> > +				_audit_uringopadded = 1;
> > +				break;
> > +			case -1:
> > +				audit_msg(LOG_ERR, "Uring op name unknown: %s",
> > +							optarg);
> > +				retval = -1;
> > +				break;
> > +			case -3: // Error reported - do nothing here
> > +				retval = -1;
> > +				break;
> > +		}
> > +		break;
> >          case 'F':
> >  		if (add != AUDIT_FILTER_UNSET)
> >  			flags = add & AUDIT_FILTER_MASK;
> >  		else if (del != AUDIT_FILTER_UNSET)
> >  			flags = del & AUDIT_FILTER_MASK;
> > -		// if the field is arch & there is a -t option...we
> > +		// if the field is arch & there is a -t option...we
> >  		// can allow it
> > -		else if ((optind >= count) || (strstr(optarg, "arch=") == 
> NULL)
> > +		else if ((optind >= count) || (strstr(optarg, "arch=") == NULL 
> &&
> > _audit_uringopadded != 1)
> >  				 || (strcmp(vars[optind], "-t") != 0)) {
> > 
> >  			audit_msg(LOG_ERR, "List must be given before field");
> >  			retval = -1;
> > @@ -989,12 +1078,12 @@ static int setopt(int count, int lineno, char
> > *vars[]) }
> >  		break;
> >  	case 'k':
> > -		if (!(_audit_syscalladded || _audit_permadded ||
> > -		      _audit_exeadded ||
> > +		if (!(_audit_syscalladded || _audit_uringopadded ||
> > +		      _audit_permadded || _audit_exeadded ||
> >  		      _audit_filterfsadded) ||
> >  		    (add==AUDIT_FILTER_UNSET && del==AUDIT_FILTER_UNSET)) {
> >  			audit_msg(LOG_ERR,
> > -		    "key option needs a watch or syscall given prior to it");
> > +		    "key option needs a watch, syscall or uring op given prior 
> to it");
> >  			retval = -1;
> >  			break;
> >  		} else if (!optarg) {
> > @@ -1031,7 +1120,7 @@ process_keys:
> >  			retval = audit_setup_perms(rule_new, optarg);
> >  		break;
> >          case 'q':
> > -		if (_audit_syscalladded) {
> > +		if (_audit_syscalladded || _audit_uringopadded) {
> >  			audit_msg(LOG_ERR,
> >  			   "Syscall auditing requested for make equivalent");
> >  			retval = -1;
> > @@ -1466,7 +1555,7 @@ int main(int argc, char *argv[])
> >  static int handle_request(int status)
> >  {
> >  	if (status == 0) {
> > -		if (_audit_syscalladded) {
> > +		if (_audit_syscalladded || _audit_uringopadded) {
> >  			audit_msg(LOG_ERR, "Error - no list specified");
> >  			return -1;
> >  		}
> > @@ -1478,7 +1567,7 @@ static int handle_request(int status)
> >  		if (add != AUDIT_FILTER_UNSET) {
> >  			// if !task add syscall any if not specified
> >  			if ((add & AUDIT_FILTER_MASK) != AUDIT_FILTER_TASK &&
> > -					_audit_syscalladded != 1) {
> > +					(_audit_syscalladded != 1 && 
> _audit_uringopadded != 1)) {
> >  					audit_rule_syscallbyname_data(
> >  							rule_new, "all");
> >  			}
> > @@ -1502,7 +1591,7 @@ static int handle_request(int status)
> >  		}
> >  		else if (del != AUDIT_FILTER_UNSET) {
> >  			if ((del & AUDIT_FILTER_MASK) != AUDIT_FILTER_TASK &&
> > -					_audit_syscalladded != 1) {
> > +					(_audit_syscalladded != 1 && 
> _audit_uringopadded != 1)) {
> >  					audit_rule_syscallbyname_data(
> >  							rule_new, "all");
> >  			}
> 
> 
> 
> 

- RGB

--
Richard Guy Briggs <rgb@redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit