From: Richard Guy Briggs <rgb@redhat.com>
To: linux-kernel@vger.kernel.org, linux-audit@redhat.com
Cc: Richard Guy Briggs <rgb@redhat.com>,
Steven Rostedt <rostedt@goodmis.org>,
Ingo Molnar <mingo@redhat.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Al Viro <viro@zeniv.linux.org.uk>, Eric Paris <eparis@redhat.com>,
Paul Moore <pmoore@redhat.com>, Steve Grubb <sgrubb@redhat.com>
Subject: [PATCH ALT2] audit: don't create PATH records for anonymous parents and their children
Date: Tue, 28 Feb 2017 22:29:09 -0500 [thread overview]
Message-ID: <a11cbe691ee1b3ecfad1615ef5b6dd6ef2c4e2cc.1488337428.git.rgb@redhat.com> (raw)
In-Reply-To: <20170301031549.GT18258@madcap2.tricolour.ca>
Tracefs or debugfs were causing hundreds to thousands of null PATH records to
be associated with the init_module and finit_module SYSCALL records on a few
modules when the following rule was in place for startup:
-a always,exit -F arch=x86_64 -S init_module -F key=mod-load
Don't create those records when the parent is not found in
that task context's audit names_list.
See https://github.com/linux-audit/audit-kernel/issues/8
Test case: https://github.com/linux-audit/audit-testsuite/issues/42
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
---
kernel/auditsc.c | 20 +++++++-------------
1 files changed, 7 insertions(+), 13 deletions(-)
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 4db32e8..83eb3bc 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1889,6 +1889,10 @@ void __audit_inode_child(struct inode *parent,
}
}
+ if (!found_parent)
+ /* Don't track if parent is "anonymous" */
+ return;
+
/* is there a matching child entry? */
list_for_each_entry(n, &context->names_list, list) {
/* can only match entries that have a name */
@@ -1908,14 +1912,6 @@ void __audit_inode_child(struct inode *parent,
}
}
- if (!found_parent) {
- /* create a new, "anonymous" parent record */
- n = audit_alloc_name(context, AUDIT_TYPE_PARENT);
- if (!n)
- return;
- audit_copy_inode(n, NULL, parent);
- }
-
if (!found_child) {
found_child = audit_alloc_name(context, type);
if (!found_child)
@@ -1924,11 +1920,9 @@ void __audit_inode_child(struct inode *parent,
/* Re-use the name belonging to the slot for a matching parent
* directory. All names for this context are relinquished in
* audit_free_names() */
- if (found_parent) {
- found_child->name = found_parent->name;
- found_child->name_len = AUDIT_NAME_FULL;
- found_child->name->refcnt++;
- }
+ found_child->name = found_parent->name;
+ found_child->name_len = AUDIT_NAME_FULL;
+ found_child->name->refcnt++;
}
if (inode)
--
1.7.1
next prev parent reply other threads:[~2017-03-01 3:29 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-03-01 3:15 Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs
2017-03-01 3:24 ` [PATCH ALT1] audit: ignore tracefs and debugfs on inode child Richard Guy Briggs
2017-03-01 3:26 ` [PATCH ALT3] audit: hide PATH records of anonymous parents and their children Richard Guy Briggs
2017-03-01 3:29 ` Richard Guy Briggs [this message]
2017-03-01 3:29 ` [PATCH ALT4] audit: show fstype:pathname for entries with anonymous parents Richard Guy Briggs
2017-03-02 12:58 ` kbuild test robot
2017-03-01 3:37 ` Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs
2017-03-01 4:15 ` Steve Grubb
2017-03-03 21:14 ` Richard Guy Briggs
2017-03-03 22:24 ` [PATCH ALT5] audit: ignore module syscalls on inode child Richard Guy Briggs
2017-03-04 0:22 ` Hundreds of null PATH records for *init_module syscall audit logs Paul Moore
2017-03-06 21:49 ` Richard Guy Briggs
2017-03-06 22:30 ` Jessica Yu
2017-03-07 3:46 ` Richard Guy Briggs
2017-03-09 13:25 ` Steve Grubb
2017-03-09 13:24 ` Steve Grubb
2017-03-04 0:19 ` Paul Moore
2017-03-07 3:39 ` Richard Guy Briggs
2017-03-07 15:41 ` Steven Rostedt
2017-03-07 16:00 ` Richard Guy Briggs
2017-03-07 16:20 ` Steven Rostedt
2017-03-07 17:39 ` Richard Guy Briggs
2017-03-07 18:04 ` Steven Rostedt
2017-03-07 18:34 ` Richard Guy Briggs
2017-03-07 19:09 ` Steven Rostedt
2017-03-07 22:00 ` Richard Guy Briggs
2017-03-09 13:33 ` Steve Grubb
2017-03-07 15:37 ` Steven Rostedt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=a11cbe691ee1b3ecfad1615ef5b6dd6ef2c4e2cc.1488337428.git.rgb@redhat.com \
--to=rgb@redhat.com \
--cc=eparis@redhat.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-audit@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=pmoore@redhat.com \
--cc=rostedt@goodmis.org \
--cc=sgrubb@redhat.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).