linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Richard Guy Briggs <rgb@redhat.com>
To: linux-audit@redhat.com, linux-kernel@vger.kernel.org,
	netdev@vger.kernel.org, selinux@tycho.nsa.gov,
	linux-security-module@vger.kernel.org
Cc: Richard Guy Briggs <rgb@redhat.com>,
	davem@davemloft.net, jamal@mojatatu.com, eparis@redhat.com,
	sgrubb@redhat.com
Subject: [PATCH 0/6][v2] audit: implement multicast socket for journald
Date: Tue, 22 Apr 2014 21:31:52 -0400	[thread overview]
Message-ID: <cover.1398215388.git.rgb@redhat.com> (raw)
In-Reply-To: <20140422.161904.1187535812839850973.davem@davemloft.net>

This is a patch set Eric Paris and I have been working on to add a restricted
capability read-only netlink multicast socket to kernel audit to enable
userspace clients such as systemd/journald to receive audit logs, in addition
to the bidirectional auditd userspace client.

Currently, auditd has the CAP_AUDIT_CONTROL and CAP_AUDIT_WRITE capabilities
(but uses CAP_NET_ADMIN).  The CAP_AUDIT_READ capability will be added for use
by read-only AUDIT_NLGRP_READLOG multicast group clients to the kaudit
subsystem.  This will remove the dependence on CAP_NET_ADMIN for the multicast
read-only socket.


Patches 1-3 provide a way for per-protocol bind functions to
signal an error and to be able to clean up after themselves.

The first netfilter cleanup patch has already been accepted by a netfilter
maintainer, though I don't see it upstream yet, so it is included for
completeness.

The second patch adds the per-protocol bind function return code to signal to
the netlink code that no further processing should be done and to undo the work
already done.
V1: This rev fixes a bug introduced by flattening the code in the last posting.
*V2: This rev moves the per-protocol bind call above the socket exposure call
and refactors out the unbind procedure.

The third provides a way per protocol to undo bind actions on DROP.


Patches 4-6 implement the audit multicast socket with capability checking.

The fourth patch adds the bind function capability check to multicast join
requests for audit.

The fifth patch adds the audit log read multicast group.  An assumption has
been made that systemd/journald reside in the initial network namespace.  This
could be changed to check the actual network namespace of systemd/journald
should this assumption no longer be true since audit now supports all network
namespaces.  This version of the patch now directly sends the broadcast when
the packet is ready rather than waiting until it passes the queue.

The sixth checks if any clients actually exist before sending.


Since the net tree is busier than the audit tree, conflicts are more likely and
the audit patches depend on the net patches, it is proposed to have the net
tree carry this entire patchset for 3.16.  Are the net maintainers ok with this?


https://bugzilla.redhat.com/show_bug.cgi?id=887992 

First posted:   https://www.redhat.com/archives/linux-audit/2013-January/msg00008.html
                https://lkml.org/lkml/2013/1/27/279

Please find source for a test program at: 
	http://people.redhat.com/rbriggs/audit-multicast-listen/


Richard Guy Briggs (6):
  netlink: simplify nfnetlink_bind
  netlink: have netlink per-protocol bind function return an error
    code.
  netlink: implement unbind to netlink_setsockopt
    NETLINK_DROP_MEMBERSHIP
  audit: add netlink audit protocol bind to check capabilities on
    multicast join
  audit: add netlink multicast group for log read
  audit: send multicast messages only if there are listeners

 include/linux/netlink.h             |    3 +-
 include/uapi/linux/audit.h          |    8 ++++
 include/uapi/linux/capability.h     |    7 +++-
 kernel/audit.c                      |   64 ++++++++++++++++++++++++++++++--
 net/netfilter/nfnetlink.c           |   10 ++---
 net/netlink/af_netlink.c            |   70 +++++++++++++++++++++++++----------
 net/netlink/af_netlink.h            |    6 ++-
 security/selinux/include/classmap.h |    2 +-
 8 files changed, 135 insertions(+), 35 deletions(-)


  parent reply	other threads:[~2014-04-23  1:32 UTC|newest]

Thread overview: 50+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2014-03-21 16:39 [PATCH] netlink: have netlink per-protocol bind function return an error code Richard Guy Briggs
2014-03-23  4:50 ` David Miller
2014-03-24 14:38   ` Richard Guy Briggs
2014-03-24 18:34     ` Richard Guy Briggs
2014-03-24 18:35       ` [PATCH][v3] " Richard Guy Briggs
2014-03-24 19:37         ` [PATCH][v4] " Richard Guy Briggs
2014-03-24 20:59       ` [PATCH][v5] " Richard Guy Briggs
2014-03-26 19:52         ` David Miller
2014-03-26 20:09           ` v6 superceded it [was: Re: [PATCH][v5] netlink: have netlink per-protocol bind function return an error code.] Richard Guy Briggs
2014-03-25 12:50       ` [PATCH][v6] netlink: have netlink per-protocol bind function return an error code Richard Guy Briggs
2014-03-26 20:46         ` David Miller
2014-03-26 23:13         ` Patrick McHardy
2014-03-25 13:11       ` unbind [was: Re: [PATCH] netlink: have netlink per-protocol bind function return] " Richard Guy Briggs
2014-04-01 14:14       ` [PATCH 0/3] netlink: per-protocol bind fixup/enhancement set Richard Guy Briggs
2014-04-01 14:14         ` [PATCH 1/3] netlink: simplify nfnetlink_bind Richard Guy Briggs
2014-04-01 14:14         ` [PATCH 2/3][v7] netlink: have netlink per-protocol bind function return an error code Richard Guy Briggs
2014-04-01 14:14         ` [PATCH 3/3] netlink: implement unbind to netlink_setsockopt NETLINK_DROP_MEMBERSHIP Richard Guy Briggs
2014-04-01 21:33         ` [PATCH 0/3] netlink: per-protocol bind fixup/enhancement set David Miller
2014-04-01 22:12           ` Richard Guy Briggs
2014-04-01 22:21             ` David Miller
2014-04-18 17:34       ` [PATCH 0/6] audit: implement multicast socket for journald Richard Guy Briggs
2014-04-18 17:34         ` [PATCH 1/6] netlink: simplify nfnetlink_bind Richard Guy Briggs
2014-04-18 17:34         ` [PATCH 2/6] netlink: have netlink per-protocol bind function return an error code Richard Guy Briggs
2014-04-22 20:19           ` David Miller
2014-04-23  1:30             ` Richard Guy Briggs
2014-04-23  1:31             ` Richard Guy Briggs [this message]
2014-04-23  1:31               ` [PATCH 1/6][v2] netlink: simplify nfnetlink_bind Richard Guy Briggs
2014-04-23  1:31               ` [PATCH 2/6][v2] netlink: have netlink per-protocol bind function return an error code Richard Guy Briggs
2014-04-23  1:31               ` [PATCH 3/6][v2] netlink: implement unbind to netlink_setsockopt NETLINK_DROP_MEMBERSHIP Richard Guy Briggs
2014-04-23  1:31               ` [PATCH 4/6][v2] audit: add netlink audit protocol bind to check capabilities on multicast join Richard Guy Briggs
2014-04-23  1:31               ` [PATCH 5/6][v2] audit: add netlink multicast group for log read Richard Guy Briggs
2014-04-23  1:31               ` [PATCH 6/6][v2] audit: send multicast messages only if there are listeners Richard Guy Briggs
2014-04-23  1:43               ` [PATCH 0/6][v2] audit: implement multicast socket for journald David Miller
2014-04-23  1:49                 ` Richard Guy Briggs
2014-04-23  3:55                   ` David Miller
2014-04-23  2:25               ` Steve Grubb
2014-04-23  3:57                 ` Eric Paris
2014-04-23 13:40                   ` Daniel J Walsh
2014-04-23 14:42                     ` Eric Paris
2014-04-23 15:36                       ` Daniel J Walsh
2014-04-23 15:37                         ` Eric Paris
2014-04-23 15:52                           ` Daniel J Walsh
2014-04-24 13:22                             ` Eric Paris
2014-04-24 14:59                               ` Daniel J Walsh
2014-04-24 15:03                                 ` Eric Paris
2014-04-24 16:03                                   ` Daniel J Walsh
2014-04-18 17:34         ` [PATCH 3/6] netlink: implement unbind to netlink_setsockopt NETLINK_DROP_MEMBERSHIP Richard Guy Briggs
2014-04-18 17:34         ` [PATCH 4/6] audit: add netlink audit protocol bind to check capabilities on multicast join Richard Guy Briggs
2014-04-18 17:34         ` [PATCH 5/6] audit: add netlink multicast group for log read Richard Guy Briggs
2014-04-18 17:34         ` [PATCH 6/6] audit: send multicast messages only if there are listeners Richard Guy Briggs

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=cover.1398215388.git.rgb@redhat.com \
    --to=rgb@redhat.com \
    --cc=davem@davemloft.net \
    --cc=eparis@redhat.com \
    --cc=jamal@mojatatu.com \
    --cc=linux-audit@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=selinux@tycho.nsa.gov \
    --cc=sgrubb@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).