* [PATCH ghak96] audit: set cwd in audit context for file-related LSM audit records @ 2020-04-02 14:13 Vladis Dronov 2020-04-02 15:38 ` Casey Schaufler 0 siblings, 1 reply; 5+ messages in thread From: Vladis Dronov @ 2020-04-02 14:13 UTC (permalink / raw) To: Paul Moore, Eric Paris, linux-audit, James Morris, Serge E . Hallyn, linux-security-module, linux-kernel Set a current working directory in an audit context for the following record types in dump_common_audit_data(): LSM_AUDIT_DATA_PATH, LSM_AUDIT_DATA_FILE, LSM_AUDIT_DATA_IOCTL_OP, LSM_AUDIT_DATA_DENTRY, LSM_AUDIT_DATA_INODE so a separate CWD record is emitted later. Link: https://github.com/linux-audit/audit-kernel/issues/96 Signed-off-by: Vladis Dronov <vdronov@redhat.com> --- out-of-commit-message-note: Hello, Honestly, I'm not sure about "if (!context->in_syscall)" check in __audit_getcwd(). It was copied from __audit_getname() and I do not quite understand why it is there and if __audit_getcwd() needs it. If you have an idea on this, could you please, tell? include/linux/audit.h | 9 ++++++++- kernel/auditsc.c | 17 +++++++++++++++++ security/lsm_audit.c | 5 +++++ 3 files changed, 30 insertions(+), 1 deletion(-) diff --git a/include/linux/audit.h b/include/linux/audit.h index f9ceae57ca8d..b4306abc5891 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -268,7 +268,7 @@ extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1, extern void __audit_syscall_exit(int ret_success, long ret_value); extern struct filename *__audit_reusename(const __user char *uptr); extern void __audit_getname(struct filename *name); - +extern void __audit_getcwd(void); extern void __audit_inode(struct filename *name, const struct dentry *dentry, unsigned int flags); extern void __audit_file(const struct file *); @@ -327,6 +327,11 @@ static inline void audit_getname(struct filename *name) if (unlikely(!audit_dummy_context())) __audit_getname(name); } +static inline void audit_getcwd(void) +{ + if (unlikely(!audit_dummy_context())) + __audit_getcwd(); +} static inline void audit_inode(struct filename *name, const struct dentry *dentry, unsigned int aflags) { @@ -545,6 +550,8 @@ static inline struct filename *audit_reusename(const __user char *name) } static inline void audit_getname(struct filename *name) { } +static inline void audit_getcwd(void) +{ } static inline void __audit_inode(struct filename *name, const struct dentry *dentry, unsigned int flags) diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 814406a35db1..16316032ef9f 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1890,6 +1890,23 @@ void __audit_getname(struct filename *name) get_fs_pwd(current->fs, &context->pwd); } +/** + * __audit_getcwd - set a current working directory + * + * Set a current working directory of an audited process for this context. + * Called from security/lsm_audit.c:dump_common_audit_data(). + */ +void __audit_getcwd(void) +{ + struct audit_context *context = audit_context(); + + if (!context->in_syscall) + return; + + if (!context->pwd.dentry) + get_fs_pwd(current->fs, &context->pwd); +} + static inline int audit_copy_fcaps(struct audit_names *name, const struct dentry *dentry) { diff --git a/security/lsm_audit.c b/security/lsm_audit.c index 2d2bf49016f4..7c555621c2bd 100644 --- a/security/lsm_audit.c +++ b/security/lsm_audit.c @@ -241,6 +241,7 @@ static void dump_common_audit_data(struct audit_buffer *ab, audit_log_untrustedstring(ab, inode->i_sb->s_id); audit_log_format(ab, " ino=%lu", inode->i_ino); } + audit_getcwd(); break; } case LSM_AUDIT_DATA_FILE: { @@ -254,6 +255,7 @@ static void dump_common_audit_data(struct audit_buffer *ab, audit_log_untrustedstring(ab, inode->i_sb->s_id); audit_log_format(ab, " ino=%lu", inode->i_ino); } + audit_getcwd(); break; } case LSM_AUDIT_DATA_IOCTL_OP: { @@ -269,6 +271,7 @@ static void dump_common_audit_data(struct audit_buffer *ab, } audit_log_format(ab, " ioctlcmd=0x%hx", a->u.op->cmd); + audit_getcwd(); break; } case LSM_AUDIT_DATA_DENTRY: { @@ -283,6 +286,7 @@ static void dump_common_audit_data(struct audit_buffer *ab, audit_log_untrustedstring(ab, inode->i_sb->s_id); audit_log_format(ab, " ino=%lu", inode->i_ino); } + audit_getcwd(); break; } case LSM_AUDIT_DATA_INODE: { @@ -300,6 +304,7 @@ static void dump_common_audit_data(struct audit_buffer *ab, audit_log_format(ab, " dev="); audit_log_untrustedstring(ab, inode->i_sb->s_id); audit_log_format(ab, " ino=%lu", inode->i_ino); + audit_getcwd(); break; } case LSM_AUDIT_DATA_TASK: { -- 2.20.1 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH ghak96] audit: set cwd in audit context for file-related LSM audit records 2020-04-02 14:13 [PATCH ghak96] audit: set cwd in audit context for file-related LSM audit records Vladis Dronov @ 2020-04-02 15:38 ` Casey Schaufler 2020-04-02 16:31 ` Vladis Dronov 0 siblings, 1 reply; 5+ messages in thread From: Casey Schaufler @ 2020-04-02 15:38 UTC (permalink / raw) To: Vladis Dronov, Paul Moore, Eric Paris, linux-audit, James Morris, Serge E . Hallyn, linux-security-module, linux-kernel On 4/2/2020 7:13 AM, Vladis Dronov wrote: > Set a current working directory in an audit context for the following record > types in dump_common_audit_data(): LSM_AUDIT_DATA_PATH, LSM_AUDIT_DATA_FILE, > LSM_AUDIT_DATA_IOCTL_OP, LSM_AUDIT_DATA_DENTRY, LSM_AUDIT_DATA_INODE so a > separate CWD record is emitted later. > > Link: https://github.com/linux-audit/audit-kernel/issues/96 I don't have a problem with the patch, but it sure would be nice if you explained why these events "could use a CWD record". > Signed-off-by: Vladis Dronov <vdronov@redhat.com> > --- > out-of-commit-message-note: > > Hello, > Honestly, I'm not sure about "if (!context->in_syscall)" check in > __audit_getcwd(). It was copied from __audit_getname() and I do > not quite understand why it is there and if __audit_getcwd() needs > it. If you have an idea on this, could you please, tell? > > include/linux/audit.h | 9 ++++++++- > kernel/auditsc.c | 17 +++++++++++++++++ > security/lsm_audit.c | 5 +++++ > 3 files changed, 30 insertions(+), 1 deletion(-) > > diff --git a/include/linux/audit.h b/include/linux/audit.h > index f9ceae57ca8d..b4306abc5891 100644 > --- a/include/linux/audit.h > +++ b/include/linux/audit.h > @@ -268,7 +268,7 @@ extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1, > extern void __audit_syscall_exit(int ret_success, long ret_value); > extern struct filename *__audit_reusename(const __user char *uptr); > extern void __audit_getname(struct filename *name); > - > +extern void __audit_getcwd(void); > extern void __audit_inode(struct filename *name, const struct dentry *dentry, > unsigned int flags); > extern void __audit_file(const struct file *); > @@ -327,6 +327,11 @@ static inline void audit_getname(struct filename *name) > if (unlikely(!audit_dummy_context())) > __audit_getname(name); > } > +static inline void audit_getcwd(void) > +{ > + if (unlikely(!audit_dummy_context())) > + __audit_getcwd(); > +} > static inline void audit_inode(struct filename *name, > const struct dentry *dentry, > unsigned int aflags) { > @@ -545,6 +550,8 @@ static inline struct filename *audit_reusename(const __user char *name) > } > static inline void audit_getname(struct filename *name) > { } > +static inline void audit_getcwd(void) > +{ } > static inline void __audit_inode(struct filename *name, > const struct dentry *dentry, > unsigned int flags) > diff --git a/kernel/auditsc.c b/kernel/auditsc.c > index 814406a35db1..16316032ef9f 100644 > --- a/kernel/auditsc.c > +++ b/kernel/auditsc.c > @@ -1890,6 +1890,23 @@ void __audit_getname(struct filename *name) > get_fs_pwd(current->fs, &context->pwd); > } > > +/** > + * __audit_getcwd - set a current working directory > + * > + * Set a current working directory of an audited process for this context. > + * Called from security/lsm_audit.c:dump_common_audit_data(). > + */ > +void __audit_getcwd(void) > +{ > + struct audit_context *context = audit_context(); > + > + if (!context->in_syscall) > + return; > + > + if (!context->pwd.dentry) > + get_fs_pwd(current->fs, &context->pwd); > +} > + > static inline int audit_copy_fcaps(struct audit_names *name, > const struct dentry *dentry) > { > diff --git a/security/lsm_audit.c b/security/lsm_audit.c > index 2d2bf49016f4..7c555621c2bd 100644 > --- a/security/lsm_audit.c > +++ b/security/lsm_audit.c > @@ -241,6 +241,7 @@ static void dump_common_audit_data(struct audit_buffer *ab, > audit_log_untrustedstring(ab, inode->i_sb->s_id); > audit_log_format(ab, " ino=%lu", inode->i_ino); > } > + audit_getcwd(); > break; > } > case LSM_AUDIT_DATA_FILE: { > @@ -254,6 +255,7 @@ static void dump_common_audit_data(struct audit_buffer *ab, > audit_log_untrustedstring(ab, inode->i_sb->s_id); > audit_log_format(ab, " ino=%lu", inode->i_ino); > } > + audit_getcwd(); > break; > } > case LSM_AUDIT_DATA_IOCTL_OP: { > @@ -269,6 +271,7 @@ static void dump_common_audit_data(struct audit_buffer *ab, > } > > audit_log_format(ab, " ioctlcmd=0x%hx", a->u.op->cmd); > + audit_getcwd(); > break; > } > case LSM_AUDIT_DATA_DENTRY: { > @@ -283,6 +286,7 @@ static void dump_common_audit_data(struct audit_buffer *ab, > audit_log_untrustedstring(ab, inode->i_sb->s_id); > audit_log_format(ab, " ino=%lu", inode->i_ino); > } > + audit_getcwd(); > break; > } > case LSM_AUDIT_DATA_INODE: { > @@ -300,6 +304,7 @@ static void dump_common_audit_data(struct audit_buffer *ab, > audit_log_format(ab, " dev="); > audit_log_untrustedstring(ab, inode->i_sb->s_id); > audit_log_format(ab, " ino=%lu", inode->i_ino); > + audit_getcwd(); > break; > } > case LSM_AUDIT_DATA_TASK: { ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH ghak96] audit: set cwd in audit context for file-related LSM audit records 2020-04-02 15:38 ` Casey Schaufler @ 2020-04-02 16:31 ` Vladis Dronov 2020-04-09 21:50 ` Richard Guy Briggs 0 siblings, 1 reply; 5+ messages in thread From: Vladis Dronov @ 2020-04-02 16:31 UTC (permalink / raw) To: Casey Schaufler, Richard Guy Briggs Cc: Paul Moore, Eric Paris, linux-audit, James Morris, Serge E . Hallyn, linux-security-module, linux-kernel Hello, Casey, all, ----- Original Message ----- > From: "Casey Schaufler" <casey@schaufler-ca.com> > Subject: Re: [PATCH ghak96] audit: set cwd in audit context for file-related LSM audit records > > On 4/2/2020 7:13 AM, Vladis Dronov wrote: > > Set a current working directory in an audit context for the following > > record > > types in dump_common_audit_data(): LSM_AUDIT_DATA_PATH, > > LSM_AUDIT_DATA_FILE, > > LSM_AUDIT_DATA_IOCTL_OP, LSM_AUDIT_DATA_DENTRY, LSM_AUDIT_DATA_INODE so a > > separate CWD record is emitted later. > > > > Link: https://github.com/linux-audit/audit-kernel/issues/96 > > I don't have a problem with the patch, but it sure would be nice > if you explained why these events "could use a CWD record". (adding Richard Guy Briggs <rgb@redhat.com> which I should have been done earlier) I would agree, adding "cwd=" field in the LSM record itself is simpler to me. Unfortunately, all I can say for now is "The intent was a separate CWD record, that is already defined" requirement from the ghak#96 issue. Richard, could you, please, clarify since you've posted this requirement in the ghak#96's description? > > Signed-off-by: Vladis Dronov <vdronov@redhat.com> > > --- > > out-of-commit-message-note: > > > > Hello, > > Honestly, I'm not sure about "if (!context->in_syscall)" check in > > __audit_getcwd(). It was copied from __audit_getname() and I do > > not quite understand why it is there and if __audit_getcwd() needs > > it. If you have an idea on this, could you please, tell? > > > > include/linux/audit.h | 9 ++++++++- > > kernel/auditsc.c | 17 +++++++++++++++++ > > security/lsm_audit.c | 5 +++++ > > 3 files changed, 30 insertions(+), 1 deletion(-) > > > > diff --git a/include/linux/audit.h b/include/linux/audit.h > > index f9ceae57ca8d..b4306abc5891 100644 > > --- a/include/linux/audit.h > > +++ b/include/linux/audit.h > > @@ -268,7 +268,7 @@ extern void __audit_syscall_entry(int major, unsigned > > long a0, unsigned long a1, > > extern void __audit_syscall_exit(int ret_success, long ret_value); > > extern struct filename *__audit_reusename(const __user char *uptr); > > extern void __audit_getname(struct filename *name); > > - > > +extern void __audit_getcwd(void); > > extern void __audit_inode(struct filename *name, const struct dentry > > *dentry, > > unsigned int flags); > > extern void __audit_file(const struct file *); > > @@ -327,6 +327,11 @@ static inline void audit_getname(struct filename > > *name) > > if (unlikely(!audit_dummy_context())) > > __audit_getname(name); > > } > > +static inline void audit_getcwd(void) > > +{ > > + if (unlikely(!audit_dummy_context())) > > + __audit_getcwd(); > > +} > > static inline void audit_inode(struct filename *name, > > const struct dentry *dentry, > > unsigned int aflags) { > > @@ -545,6 +550,8 @@ static inline struct filename *audit_reusename(const > > __user char *name) > > } > > static inline void audit_getname(struct filename *name) > > { } > > +static inline void audit_getcwd(void) > > +{ } > > static inline void __audit_inode(struct filename *name, > > const struct dentry *dentry, > > unsigned int flags) > > diff --git a/kernel/auditsc.c b/kernel/auditsc.c > > index 814406a35db1..16316032ef9f 100644 > > --- a/kernel/auditsc.c > > +++ b/kernel/auditsc.c > > @@ -1890,6 +1890,23 @@ void __audit_getname(struct filename *name) > > get_fs_pwd(current->fs, &context->pwd); > > } > > > > +/** > > + * __audit_getcwd - set a current working directory > > + * > > + * Set a current working directory of an audited process for this context. > > + * Called from security/lsm_audit.c:dump_common_audit_data(). > > + */ > > +void __audit_getcwd(void) > > +{ > > + struct audit_context *context = audit_context(); > > + > > + if (!context->in_syscall) > > + return; > > + > > + if (!context->pwd.dentry) > > + get_fs_pwd(current->fs, &context->pwd); > > +} > > + > > static inline int audit_copy_fcaps(struct audit_names *name, > > const struct dentry *dentry) > > { > > diff --git a/security/lsm_audit.c b/security/lsm_audit.c > > index 2d2bf49016f4..7c555621c2bd 100644 > > --- a/security/lsm_audit.c > > +++ b/security/lsm_audit.c > > @@ -241,6 +241,7 @@ static void dump_common_audit_data(struct audit_buffer > > *ab, > > audit_log_untrustedstring(ab, inode->i_sb->s_id); > > audit_log_format(ab, " ino=%lu", inode->i_ino); > > } > > + audit_getcwd(); > > break; > > } > > case LSM_AUDIT_DATA_FILE: { > > @@ -254,6 +255,7 @@ static void dump_common_audit_data(struct audit_buffer > > *ab, > > audit_log_untrustedstring(ab, inode->i_sb->s_id); > > audit_log_format(ab, " ino=%lu", inode->i_ino); > > } > > + audit_getcwd(); > > break; > > } > > case LSM_AUDIT_DATA_IOCTL_OP: { > > @@ -269,6 +271,7 @@ static void dump_common_audit_data(struct audit_buffer > > *ab, > > } > > > > audit_log_format(ab, " ioctlcmd=0x%hx", a->u.op->cmd); > > + audit_getcwd(); > > break; > > } > > case LSM_AUDIT_DATA_DENTRY: { > > @@ -283,6 +286,7 @@ static void dump_common_audit_data(struct audit_buffer > > *ab, > > audit_log_untrustedstring(ab, inode->i_sb->s_id); > > audit_log_format(ab, " ino=%lu", inode->i_ino); > > } > > + audit_getcwd(); > > break; > > } > > case LSM_AUDIT_DATA_INODE: { > > @@ -300,6 +304,7 @@ static void dump_common_audit_data(struct audit_buffer > > *ab, > > audit_log_format(ab, " dev="); > > audit_log_untrustedstring(ab, inode->i_sb->s_id); > > audit_log_format(ab, " ino=%lu", inode->i_ino); > > + audit_getcwd(); > > break; > > } > > case LSM_AUDIT_DATA_TASK: { Best regards, Vladis Dronov | Red Hat, Inc. | The Core Kernel | Senior Software Engineer ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH ghak96] audit: set cwd in audit context for file-related LSM audit records 2020-04-02 16:31 ` Vladis Dronov @ 2020-04-09 21:50 ` Richard Guy Briggs 2020-04-17 22:21 ` Paul Moore 0 siblings, 1 reply; 5+ messages in thread From: Richard Guy Briggs @ 2020-04-09 21:50 UTC (permalink / raw) To: Vladis Dronov Cc: Casey Schaufler, Paul Moore, Eric Paris, linux-audit, James Morris, Serge E . Hallyn, linux-security-module, linux-kernel On 2020-04-02 12:31, Vladis Dronov wrote: > Hello, Casey, all, > > ----- Original Message ----- > > From: "Casey Schaufler" <casey@schaufler-ca.com> > > Subject: Re: [PATCH ghak96] audit: set cwd in audit context for file-related LSM audit records > > > > On 4/2/2020 7:13 AM, Vladis Dronov wrote: > > > Set a current working directory in an audit context for the following > > > record > > > types in dump_common_audit_data(): LSM_AUDIT_DATA_PATH, > > > LSM_AUDIT_DATA_FILE, > > > LSM_AUDIT_DATA_IOCTL_OP, LSM_AUDIT_DATA_DENTRY, LSM_AUDIT_DATA_INODE so a > > > separate CWD record is emitted later. > > > > > > Link: https://github.com/linux-audit/audit-kernel/issues/96 > > > > I don't have a problem with the patch, but it sure would be nice > > if you explained why these events "could use a CWD record". > > (adding Richard Guy Briggs <rgb@redhat.com> which I should have been done earlier) > > I would agree, adding "cwd=" field in the LSM record itself is simpler to me. We already have a CWD record to record this information. It usually accompanies an AUDIT_PATH record, but the intent is that it accompanies any event that has filesystem pathnames in path= or name= fields in records to help understand the command's context relative to the filesystem. > Unfortunately, all I can say for now is "The intent was a separate CWD record, > that is already defined" requirement from the ghak#96 issue. > > Richard, could you, please, clarify since you've posted this requirement in > the ghak#96's description? > > > > Signed-off-by: Vladis Dronov <vdronov@redhat.com> > > > --- > > > out-of-commit-message-note: > > > > > > Hello, > > > Honestly, I'm not sure about "if (!context->in_syscall)" check in > > > __audit_getcwd(). It was copied from __audit_getname() and I do > > > not quite understand why it is there and if __audit_getcwd() needs > > > it. If you have an idea on this, could you please, tell? > > > > > > include/linux/audit.h | 9 ++++++++- > > > kernel/auditsc.c | 17 +++++++++++++++++ > > > security/lsm_audit.c | 5 +++++ > > > 3 files changed, 30 insertions(+), 1 deletion(-) > > > > > > diff --git a/include/linux/audit.h b/include/linux/audit.h > > > index f9ceae57ca8d..b4306abc5891 100644 > > > --- a/include/linux/audit.h > > > +++ b/include/linux/audit.h > > > @@ -268,7 +268,7 @@ extern void __audit_syscall_entry(int major, unsigned > > > long a0, unsigned long a1, > > > extern void __audit_syscall_exit(int ret_success, long ret_value); > > > extern struct filename *__audit_reusename(const __user char *uptr); > > > extern void __audit_getname(struct filename *name); > > > - > > > +extern void __audit_getcwd(void); > > > extern void __audit_inode(struct filename *name, const struct dentry > > > *dentry, > > > unsigned int flags); > > > extern void __audit_file(const struct file *); > > > @@ -327,6 +327,11 @@ static inline void audit_getname(struct filename > > > *name) > > > if (unlikely(!audit_dummy_context())) > > > __audit_getname(name); > > > } > > > +static inline void audit_getcwd(void) > > > +{ > > > + if (unlikely(!audit_dummy_context())) > > > + __audit_getcwd(); > > > +} > > > static inline void audit_inode(struct filename *name, > > > const struct dentry *dentry, > > > unsigned int aflags) { > > > @@ -545,6 +550,8 @@ static inline struct filename *audit_reusename(const > > > __user char *name) > > > } > > > static inline void audit_getname(struct filename *name) > > > { } > > > +static inline void audit_getcwd(void) > > > +{ } > > > static inline void __audit_inode(struct filename *name, > > > const struct dentry *dentry, > > > unsigned int flags) > > > diff --git a/kernel/auditsc.c b/kernel/auditsc.c > > > index 814406a35db1..16316032ef9f 100644 > > > --- a/kernel/auditsc.c > > > +++ b/kernel/auditsc.c > > > @@ -1890,6 +1890,23 @@ void __audit_getname(struct filename *name) > > > get_fs_pwd(current->fs, &context->pwd); > > > } > > > > > > +/** > > > + * __audit_getcwd - set a current working directory > > > + * > > > + * Set a current working directory of an audited process for this context. > > > + * Called from security/lsm_audit.c:dump_common_audit_data(). > > > + */ > > > +void __audit_getcwd(void) > > > +{ > > > + struct audit_context *context = audit_context(); > > > + > > > + if (!context->in_syscall) > > > + return; > > > + > > > + if (!context->pwd.dentry) > > > + get_fs_pwd(current->fs, &context->pwd); > > > +} > > > + > > > static inline int audit_copy_fcaps(struct audit_names *name, > > > const struct dentry *dentry) > > > { > > > diff --git a/security/lsm_audit.c b/security/lsm_audit.c > > > index 2d2bf49016f4..7c555621c2bd 100644 > > > --- a/security/lsm_audit.c > > > +++ b/security/lsm_audit.c > > > @@ -241,6 +241,7 @@ static void dump_common_audit_data(struct audit_buffer > > > *ab, > > > audit_log_untrustedstring(ab, inode->i_sb->s_id); > > > audit_log_format(ab, " ino=%lu", inode->i_ino); > > > } > > > + audit_getcwd(); > > > break; > > > } > > > case LSM_AUDIT_DATA_FILE: { > > > @@ -254,6 +255,7 @@ static void dump_common_audit_data(struct audit_buffer > > > *ab, > > > audit_log_untrustedstring(ab, inode->i_sb->s_id); > > > audit_log_format(ab, " ino=%lu", inode->i_ino); > > > } > > > + audit_getcwd(); > > > break; > > > } > > > case LSM_AUDIT_DATA_IOCTL_OP: { > > > @@ -269,6 +271,7 @@ static void dump_common_audit_data(struct audit_buffer > > > *ab, > > > } > > > > > > audit_log_format(ab, " ioctlcmd=0x%hx", a->u.op->cmd); > > > + audit_getcwd(); > > > break; > > > } > > > case LSM_AUDIT_DATA_DENTRY: { > > > @@ -283,6 +286,7 @@ static void dump_common_audit_data(struct audit_buffer > > > *ab, > > > audit_log_untrustedstring(ab, inode->i_sb->s_id); > > > audit_log_format(ab, " ino=%lu", inode->i_ino); > > > } > > > + audit_getcwd(); > > > break; > > > } > > > case LSM_AUDIT_DATA_INODE: { > > > @@ -300,6 +304,7 @@ static void dump_common_audit_data(struct audit_buffer > > > *ab, > > > audit_log_format(ab, " dev="); > > > audit_log_untrustedstring(ab, inode->i_sb->s_id); > > > audit_log_format(ab, " ino=%lu", inode->i_ino); > > > + audit_getcwd(); > > > break; > > > } > > > case LSM_AUDIT_DATA_TASK: { > > Best regards, > Vladis Dronov | Red Hat, Inc. | The Core Kernel | Senior Software Engineer - RGB -- Richard Guy Briggs <rgb@redhat.com> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635 ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH ghak96] audit: set cwd in audit context for file-related LSM audit records 2020-04-09 21:50 ` Richard Guy Briggs @ 2020-04-17 22:21 ` Paul Moore 0 siblings, 0 replies; 5+ messages in thread From: Paul Moore @ 2020-04-17 22:21 UTC (permalink / raw) To: Richard Guy Briggs Cc: Vladis Dronov, Casey Schaufler, Eric Paris, linux-audit, James Morris, Serge E . Hallyn, linux-security-module, linux-kernel On Thu, Apr 9, 2020 at 5:51 PM Richard Guy Briggs <rgb@redhat.com> wrote: > On 2020-04-02 12:31, Vladis Dronov wrote: > > Hello, Casey, all, > > > > ----- Original Message ----- > > > From: "Casey Schaufler" <casey@schaufler-ca.com> > > > Subject: Re: [PATCH ghak96] audit: set cwd in audit context for file-related LSM audit records > > > > > > On 4/2/2020 7:13 AM, Vladis Dronov wrote: > > > > Set a current working directory in an audit context for the following > > > > record > > > > types in dump_common_audit_data(): LSM_AUDIT_DATA_PATH, > > > > LSM_AUDIT_DATA_FILE, > > > > LSM_AUDIT_DATA_IOCTL_OP, LSM_AUDIT_DATA_DENTRY, LSM_AUDIT_DATA_INODE so a > > > > separate CWD record is emitted later. > > > > > > > > Link: https://github.com/linux-audit/audit-kernel/issues/96 > > > > > > I don't have a problem with the patch, but it sure would be nice > > > if you explained why these events "could use a CWD record". > > > > (adding Richard Guy Briggs <rgb@redhat.com> which I should have been done earlier) > > > > I would agree, adding "cwd=" field in the LSM record itself is simpler to me. > > We already have a CWD record to record this information. It usually > accompanies an AUDIT_PATH record, but the intent is that it accompanies > any event that has filesystem pathnames in path= or name= fields in > records to help understand the command's context relative to the > filesystem. Yes, I think the right thing to do here is simply generate a CWD record in these cases. -- paul moore www.paul-moore.com ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2020-04-17 22:22 UTC | newest] Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2020-04-02 14:13 [PATCH ghak96] audit: set cwd in audit context for file-related LSM audit records Vladis Dronov 2020-04-02 15:38 ` Casey Schaufler 2020-04-02 16:31 ` Vladis Dronov 2020-04-09 21:50 ` Richard Guy Briggs 2020-04-17 22:21 ` Paul Moore
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).