From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0CD70C43460 for ; Tue, 11 May 2021 15:52:50 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id B7C3861919 for ; Tue, 11 May 2021 15:52:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231834AbhEKPxz (ORCPT ); Tue, 11 May 2021 11:53:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39610 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231789AbhEKPxy (ORCPT ); Tue, 11 May 2021 11:53:54 -0400 Received: from mail-ej1-x631.google.com (mail-ej1-x631.google.com [IPv6:2a00:1450:4864:20::631]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8815EC06174A for ; Tue, 11 May 2021 08:52:47 -0700 (PDT) Received: by mail-ej1-x631.google.com with SMTP id u21so30436275ejo.13 for ; Tue, 11 May 2021 08:52:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paul-moore-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=DdK1IEs3eqo+hBsOtkECll5WP9PsnhV8TlKhxE3dq/I=; b=z4q41CDYBsfG99gUIBz4qoWmhaIzt02/3aja4FahQ/wKfLjDrFDC6KlAYcrXiOhPPc N7laQrcSrnLDR+jl4iNd9aQG0S/HLrBx+SV336S4TclJ/eFPPc+Ky07zmeM1lDVI0O0Q v8ZjHcRTdQ49FYjhLeGFPEGX2RonjkA4z3Wbvrf3ORdfY9rE6RxM8sZbJpPtqIIzsM8U CE+AtsAiFERUXzAR5d8GoMJyHKiD5Fd6K0NqoVCikDoi7D8ZVaj4z19giOLGIAAcCjXV soe8yi1JKQQdwEkeOKgwUaavAvRbmBpNv+KjkQ0+dUmTtV4hN6yJU53ct0HcPGaZlU9Y AAGQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=DdK1IEs3eqo+hBsOtkECll5WP9PsnhV8TlKhxE3dq/I=; b=uXtm1320WatDGGoRQIORp9XyEfu/x77WS+rYng500eIZ6nHdun+pQNVivlSbBKihDP oq4vIPUmYeFYsrhcGC+xjhkh3y5ghgj2TvoLCvbRnS0lU6SHYAPZxv+eR9Hlt7g250GH 18u/XXd9cDeXs9SNBqmQhISIlaXnf8+sUwRhDDLTj2TodXCMzoOWosU0DwEnUhyD58Qc zlIfmtJUvYpH/2FkNirxIBlQ8FViGrmofoVRBAbFYgwb4K639++2BFqCiEN05K11rICa N896Q0ofosM/9z6kUBEnJvyhM8d9ij6M2WVbskQaEV6w9Fz+VeBjzyXBdA1cCWSeCu24 459g== X-Gm-Message-State: AOAM5324qT73OI1llDPDWiheg4K93u/SoNfyoDWX1UZTSb1xL1om3FW1 Fj9lNqVI/m7KKiU30ulCZwH2qmQVK4hrGWz5xhJN X-Google-Smtp-Source: ABdhPJwXdR3PN2nJSGasJfpB5PTCWMNGLNeCcSzPHvc0Lz9sPMStjkc5n2qXBaDNEi5247vUklIg6wzBDktOSIM58ro= X-Received: by 2002:a17:907:10d8:: with SMTP id rv24mr32304965ejb.542.1620748366074; Tue, 11 May 2021 08:52:46 -0700 (PDT) MIME-Version: 1.0 References: <604ceafd516b0785fea120f552d6336054d196af.1620414949.git.rgb@redhat.com> <7ee601c2-4009-b354-1899-3c8f582bf6ae@schaufler-ca.com> <20210508015443.GA447005@madcap2.tricolour.ca> <242f107a-3b74-c1c2-abd6-b3f369170023@schaufler-ca.com> <195ac224-00fa-b1be-40c8-97e823796262@schaufler-ca.com> In-Reply-To: From: Paul Moore Date: Tue, 11 May 2021 11:52:35 -0400 Message-ID: Subject: Re: [PATCH V1] audit: log xattr args not covered by syscall record To: Casey Schaufler Cc: Richard Guy Briggs , linux-api@vger.kernel.org, LKML , Linux-Audit Mailing List , linux-fsdevel@vger.kernel.org, Eric Paris Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org On Tue, May 11, 2021 at 10:00 AM Casey Schaufler w= rote: > On 5/10/2021 6:28 PM, Paul Moore wrote: > > On Mon, May 10, 2021 at 8:37 PM Casey Schaufler wrote: > >> On 5/10/2021 4:52 PM, Paul Moore wrote: > >>> On Mon, May 10, 2021 at 12:30 PM Casey Schaufler wrote: > >>>> On 5/7/2021 6:54 PM, Richard Guy Briggs wrote: > >>>>> On 2021-05-07 14:03, Casey Schaufler wrote: > >>>>>> On 5/7/2021 12:55 PM, Richard Guy Briggs wrote: > >>>>>>> The *setxattr syscalls take 5 arguments. The SYSCALL record only= lists > >>>>>>> four arguments and only lists pointers of string values. The xat= tr name > >>>>>>> string, value string and flags (5th arg) are needed by audit give= n the > >>>>>>> syscall's main purpose. > >>>>>>> > >>>>>>> Add the auxiliary record AUDIT_XATTR (1336) to record the details= not > >>>>>>> available in the SYSCALL record including the name string, value = string > >>>>>>> and flags. > >>>>>>> > >>>>>>> Notes about field names: > >>>>>>> - name is too generic, use xattr precedent from ima > >>>>>>> - val is already generic value field name > >>>>>>> - flags used by mmap, xflags new name > >>>>>>> > >>>>>>> Sample event with new record: > >>>>>>> type=3DPROCTITLE msg=3Daudit(05/07/2021 12:58:42.176:189) : proct= itle=3Dfilecap /tmp/ls dac_override > >>>>>>> type=3DPATH msg=3Daudit(05/07/2021 12:58:42.176:189) : item=3D0 n= ame=3D(null) inode=3D25 dev=3D00:1e mode=3Dfile,755 ouid=3Droot ogid=3Droot= rdev=3D00:00 obj=3Dunconfined_u:object_r:user_tmp_t:s0 nametype=3DNORMAL c= ap_fp=3Dnone cap_fi=3Dnone cap_fe=3D0 cap_fver=3D0 cap_frootid=3D0 > >>>>>>> type=3DCWD msg=3Daudit(05/07/2021 12:58:42.176:189) : cwd=3D/root > >>>>>>> type=3DXATTR msg=3Daudit(05/07/2021 12:58:42.176:189) : xattr=3D"= security.capability" val=3D01 xflags=3D0x0 > >>>>>> Would it be sensible to break out the namespace from the attribute= ? > >>>>>> > >>>>>> attrspace=3D"security" attrname=3D"capability" > >>>>> Do xattrs always follow this nomenclature? Or only the ones we car= e > >>>>> about? > >>>> Xattrs always have a namespace (man 7 xattr) of "user", "trusted", > >>>> "system" or "security". It's possible that additional namespaces wil= l > >>>> be created in the future, although it seems unlikely given that only > >>>> "security" is widely used today. > >>> Why should audit care about separating the name into two distinct > >>> fields, e.g. "attrspace" and "attrname", instead of just a single > >>> "xattr" field with a value that follows the "namespace.attribute" > >>> format that is commonly seen by userspace? > >> I asked if it would be sensible. I don't much care myself. > > I was *asking* a question - why would we want separate fields? I > > guess I thought there might be some reason for asking if it was > > sensible; if not, I think I'd rather see it as a single field. > > I thought that it might make searching records easier, but I'm > not the expert on that. One might filter on attrspace=3Dsecurity then > look at the attrname values. But that bikeshed can be either color. Yeah, understood. My concern was that the xattr name (minus the namespace) by itself isn't really useful; similar argument with just the namespace. If you are going to do a string match filter it really shouldn't matter too much either way. --=20 paul moore www.paul-moore.com