From: Ondrej Mosnacek <omosnace@redhat.com>
To: linux-audit@redhat.com
Cc: Paul Moore <paul@paul-moore.com>,
Richard Guy Briggs <rgb@redhat.com>,
Steve Grubb <sgrubb@redhat.com>,
Miroslav Lichvar <mlichvar@redhat.com>,
John Stultz <john.stultz@linaro.org>,
Thomas Gleixner <tglx@linutronix.de>,
Stephen Boyd <sboyd@kernel.org>,
linux-kernel@vger.kernel.org,
Ondrej Mosnacek <omosnace@redhat.com>
Subject: [RFC PATCH ghak10 v6 0/2] audit: Log changes that can affect the system clock
Date: Thu, 7 Mar 2019 13:32:52 +0100 [thread overview]
Message-ID: <20190307123254.348-1-omosnace@redhat.com> (raw)
This patchset implements auditing of (syscall-triggered) changes that
can modify or indirectly affect the system clock. Some of these
changes can already be detected by simply logging relevant syscalls,
but this has some disadvantages:
a) It is usually not possible to find out from the syscall records
the amount by which the time was shifted.
b) Syscalls like adjtimex(2) or clock_adjtime(2) can be used also
for read-only operations, which might flood the audit log with
false positives. (Note that these patches don't solve this
problem yet due to the limitations of current record filtering
capabilities.)
The main motivation is to provide better reliability of timestamps
on the system as mandated by the FPT_STM.1 security functional
requirement from Common Criteria. This requirement apparently demands
that it is possible to reconstruct from audit trail the old and new
values of the time when it is adjusted (see [1]).
The current version of the patchset logs the following changes:
- direct setting of system time to a given value
- direct injection of timekeeping offset
- adjustment of timekeeping's TAI offset
- NTP value adjustments:
- time_offset
- time_freq
- time_status
- time_adjust
- tick_usec
Changes to the following NTP values are not logged, as they are not
important for security:
- time_maxerror
- time_esterror
- time_constant
Audit kernel GitHub issue: https://github.com/linux-audit/audit-kernel/issues/10
Audit kernel RFE page: https://github.com/linux-audit/audit-kernel/wiki/RFE-More-detailed-auditing-of-changes-to-system-clock
Testing: Passed audit-testuite; functional tests TBD
Changes in v6:
- Reorganized the patches to group changes by record type, not
kernel subsytem, as suggested in earlier discussions
- Added checks to ignore no-change events (new value == old value)
- Added TIME_INJOFFSET logging also to do_settimeofday64() to cover
syscalls such as settimeofday(2), stime(2), clock_settime(2)
- Created an RFE page on audit-kernel GitHub
TODO:
- tests for audit-testsuite
v5: https://www.redhat.com/archives/linux-audit/2018-August/msg00039.html
Changes in v5:
- Dropped logging of some less important changes and update commit messages
- No longer mark the patchset as RFC
v4: https://www.redhat.com/archives/linux-audit/2018-August/msg00023.html
Changes in v4:
- Squashed first two patches into one
- Renamed ADJNTPVAL's "type" field to "op" to align with audit record
conventions
- Minor commit message editing
- Cc timekeeping/NTP people for feedback
v3: https://www.redhat.com/archives/linux-audit/2018-July/msg00001.html
Changes in v3:
- Switched to separate records for each variable
- Both old and new value is now reported for each change
- Injecting offset is reported via a separate record (since this
offset consists of two values and is added directly to the clock,
i.e. it doesn't make sense to log old and new value)
- Added example records produced by chronyd -q (see the commit message
of the last patch)
v2: https://www.redhat.com/archives/linux-audit/2018-June/msg00114.html
Changes in v2:
- The audit_adjtime() function has been modified to only log those
fields that contain values that are actually used, resulting in more
compact records.
- The audit_adjtime() call has been moved to do_adjtimex() in
timekeeping.c
- Added an additional patch (for review) that simplifies the detection
if the syscall is read-only.
v1: https://www.redhat.com/archives/linux-audit/2018-June/msg00095.html
[1] https://www.niap-ccevs.org/MMO/PP/pp_ca_v2.1.pdf -- section 5.1,
table 4
Ondrej Mosnacek (2):
timekeeping: Audit clock adjustments
ntp: Audit NTP parameters adjustment
include/linux/audit.h | 29 +++++++++++++++++++++++++++++
include/uapi/linux/audit.h | 2 ++
kernel/auditsc.c | 15 +++++++++++++++
kernel/time/ntp.c | 38 ++++++++++++++++++++++++++++++--------
kernel/time/timekeeping.c | 6 ++++++
5 files changed, 82 insertions(+), 8 deletions(-)
--
2.20.1
next reply other threads:[~2019-03-07 12:33 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-07 12:32 Ondrej Mosnacek [this message]
2019-03-07 12:32 ` [RFC PATCH ghak10 v6 1/2] timekeeping: Audit clock adjustments Ondrej Mosnacek
2019-03-08 17:57 ` Steve Grubb
2019-03-27 23:26 ` John Stultz
2019-04-01 9:15 ` Ondrej Mosnacek
2019-03-27 23:37 ` Thomas Gleixner
2019-03-28 0:10 ` Thomas Gleixner
2019-03-28 0:24 ` Thomas Gleixner
2019-04-01 9:16 ` Ondrej Mosnacek
2019-04-02 9:06 ` Thomas Gleixner
2019-03-07 12:32 ` [RFC PATCH ghak10 v6 2/2] ntp: Audit NTP parameters adjustment Ondrej Mosnacek
2019-03-08 17:59 ` Steve Grubb
2019-03-27 23:29 ` John Stultz
2019-03-28 0:02 ` Thomas Gleixner
2019-04-01 9:13 ` Ondrej Mosnacek
2019-04-02 9:03 ` Thomas Gleixner
2019-04-02 15:02 ` Ondrej Mosnacek
2019-03-08 20:25 ` [RFC PATCH ghak10 v6 0/2] audit: Log changes that can affect the system clock Richard Guy Briggs
2019-03-11 11:48 ` Ondrej Mosnacek
2019-03-25 14:50 ` Paul Moore
2019-03-27 23:00 ` Paul Moore
2019-04-01 9:21 ` Ondrej Mosnacek
2019-03-27 23:36 ` John Stultz
2019-03-28 0:03 ` Thomas Gleixner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190307123254.348-1-omosnace@redhat.com \
--to=omosnace@redhat.com \
--cc=john.stultz@linaro.org \
--cc=linux-audit@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mlichvar@redhat.com \
--cc=paul@paul-moore.com \
--cc=rgb@redhat.com \
--cc=sboyd@kernel.org \
--cc=sgrubb@redhat.com \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).