Re: [PATCH ghak90 (was ghak32) V4 06/10] audit: add containerid support for tty_audit

[Paul Moore <paul@paul-moore.com>]

On Wed, Oct 31, 2018 at 5:17 PM Richard Guy Briggs <rgb@redhat.com> wrote:
&gt; On 2018-10-19 19:17, Paul Moore wrote:
&gt; &gt; On Sun, Aug 5, 2018 at 4:33 AM Richard Guy Briggs
<rgb@redhat.com> wrote:
&gt; &gt; &gt; Add audit container identifier auxiliary record to tty
logging rule
&gt; &gt; &gt; event standalone records.
&gt; &gt; &gt;
&gt; &gt; &gt; Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
&gt; &gt; &gt; Acked-by: Serge Hallyn <serge@hallyn.com>
&gt; &gt; &gt; ---
&gt; &gt; &gt;  drivers/tty/tty_audit.c | 5 ++++-
&gt; &gt; &gt;  1 file changed, 4 insertions(+), 1 deletion(-)
&gt; &gt; &gt;
&gt; &gt; &gt; diff --git a/drivers/tty/tty_audit.c b/drivers/tty/tty_audit.c
&gt; &gt; &gt; index 50f567b..3e21477 100644
&gt; &gt; &gt; --- a/drivers/tty/tty_audit.c
&gt; &gt; &gt; +++ b/drivers/tty/tty_audit.c
&gt; &gt; &gt; @@ -66,8 +66,9 @@ static void tty_audit_log(const char
*description, dev_t dev,
&gt; &gt; &gt;         uid_t uid = from_kuid(&amp;init_user_ns, task_uid(tsk));
&gt; &gt; &gt;         uid_t loginuid = from_kuid(&amp;init_user_ns,
audit_get_loginuid(tsk));
&gt; &gt; &gt;         unsigned int sessionid = audit_get_sessionid(tsk);
&gt; &gt; &gt; +       struct audit_context *context =
audit_alloc_local(GFP_KERNEL);
&gt; &gt; &gt;
&gt; &gt; &gt; -       ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_TTY);
&gt; &gt; &gt; +       ab = audit_log_start(context, GFP_KERNEL, AUDIT_TTY);
&gt; &gt; &gt;         if (ab) {
&gt; &gt; &gt;                 char name[sizeof(tsk-&gt;comm)];
&gt; &gt; &gt;
&gt; &gt; &gt; @@ -80,6 +81,8 @@ static void tty_audit_log(const char
*description, dev_t dev,
&gt; &gt; &gt;                 audit_log_n_hex(ab, data, size);
&gt; &gt; &gt;                 audit_log_end(ab);
&gt; &gt; &gt;         }
&gt; &gt; &gt; +       audit_log_contid(context, "tty", audit_get_contid(tsk));
&gt; &gt; &gt; +       audit_free_context(context);
&gt; &gt; &gt;  }
&gt; &gt;
&gt; &gt; Since I never polished up my task_struct/current fix patch enough to
&gt; &gt; get it past RFC status during this development window (new job, stolen
&gt; &gt; laptop, etc.) *and* it looks like you are going to need at least one
&gt; &gt; more respin of this patchset, go ahead and fix this patch to use
&gt; &gt; current instead of generating a local context.  I'll deal with the
&gt; &gt; merge fallout if/when it happens.
&gt;
&gt; Sure, I will switch it to current in the call to audit_get_contid().
&gt;
&gt; The local context is a distinct issue.  Like USER records, I prefer
&gt; local due to potential record volume, it is already trackable as far as
&gt; Steve is concerned, and if it is to be connected with the syscall
&gt; record, it should be linked to syscall records in a seperate new github
&gt; issue with its own patch.  It accumulates events until the buffer is
&gt; flushed to a record, so the timestamp only represents the flush (usually
&gt; user "CR/enter").

Generally, yes, associating records is a separate issue, but in this
particular case you are changing this record by making it a "local"
record, which as we've discussed before, I view as a necessary evil
and something that must be minimized.  A quick look at the
tty_audit_log() callers shows tty_audit_tiocsti() which is an ioctl
handler (and thus current should be valid and correct), and
tty_audit_buf_push() whose callers all seem have valid and correct
current values; if you find that not to be the case please let me
know.

> > Local contexts are a last resort.  If you ever find yourself writing
> > code that generates a local context, you should first be 100% certain
> > that the event is not the the result of a process initiated action (in
> > which case it should take from the task's context).
>
> Well, I'm 100% certain it is linked to a process, but so are USER
> records that are already being discussed as the exception.  This is
> basically a keystroke logger (that has a flag to omit passwords).

--
paul moore
www.paul-moore.com