netfilter-devel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH ghak25 v2 0/9] Address NETFILTER_CFG issues
@ 2020-01-06 18:54 Richard Guy Briggs
  2020-01-06 18:54 ` [PATCH ghak25 v2 1/9] netfilter: normalize x_table function declarations Richard Guy Briggs
                   ` (9 more replies)
  0 siblings, 10 replies; 32+ messages in thread
From: Richard Guy Briggs @ 2020-01-06 18:54 UTC (permalink / raw)
  To: Linux-Audit Mailing List, LKML, netfilter-devel
  Cc: Paul Moore, sgrubb, omosnace, fw, twoerner, eparis, ebiederm,
	tgraf, Richard Guy Briggs

There were questions about the presence and cause of unsolicited syscall events
in the logs containing NETFILTER_CFG records and sometimes unaccompanied
NETFILTER_CFG records.

During testing at least the following list of events trigger NETFILTER_CFG
records and the syscalls related (There may be more events that will trigger
this message type.):
	init_module, finit_module: modprobe
	setsockopt: iptables-restore, ip6tables-restore, ebtables-restore
	unshare: (h?)ostnamed
	clone: libvirtd

The syscall events unsolicited by any audit rule were found to be caused by a
missing !audit_dummy_context() check before creating a NETFILTER_CFG
record and issuing the record immediately rather than saving the
information to create the record at syscall exit.
Check !audit_dummy_context() before creating the NETFILTER_CFG record.

The vast majority of unaccompanied records are caused by the fedora default
rule: "-a never,task" and the occasional early startup one is I believe caused
by the iptables filter table module hard linked into the kernel rather than a
loadable module. The !audit_dummy_context() check above should avoid them.

A couple of other factors should help eliminate unaccompanied records
which include commit cb74ed278f80 ("audit: always enable syscall
auditing when supported and audit is enabled") which makes sure that
when audit is enabled, so automatically is syscall auditing, and ghak66
which addressed initializing audit before PID 1.

Ebtables module initialization to register tables doesn't generate records
because it was never hooked in to audit.  Recommend adding audit hooks to log
this.

Table unregistration was never logged, which is now covered.

Seemingly duplicate records are not actually exact duplicates that are caused
by netfilter table initialization in different network namespaces from the same
syscall.  Recommend adding the network namespace ID (proc inode and dev)
to the record to make this obvious (address later with ghak79 after nsid
patches).

See: https://github.com/linux-audit/audit-kernel/issues/25
See: https://github.com/linux-audit/audit-kernel/issues/35
See: https://github.com/linux-audit/audit-kernel/issues/43
See: https://github.com/linux-audit/audit-kernel/issues/44

Changelog:
v2
- Rebase (audit/next 5.5-rc1) to get audit_context access and ebt_register_table ret code
- Split x_tables and ebtables updates
- Check audit_dummy_context
- Store struct audit_nfcfg params in audit_context, abstract to audit_nf_cfg() call
- Restore back to "table, family, entries" from "family, table, entries"
- Log unregistration of tables
- Add "op=" at the end of the AUDIT_NETFILTER_CFG record
- Defer nsid patch (ghak79) to once nsid patchset upstreamed (ghak32)
- Add ghak refs
- Ditch NETFILTER_CFGSOLO record

Richard Guy Briggs (9):
  netfilter: normalize x_table function declarations
  netfilter: normalize ebtables function declarations
  netfilter: normalize ebtables function declarations II
  audit: record nfcfg params
  netfilter: x_tables audit only on syscall rule
  netfilter: ebtables audit only on syscall rule
  netfilter: ebtables audit table registration
  netfilter: add audit operation field
  netfilter: audit table unregister actions

 include/linux/audit.h           |  11 ++++
 kernel/auditsc.c                |  18 +++++
 net/bridge/netfilter/ebtables.c | 142 ++++++++++++++++++++--------------------
 net/netfilter/x_tables.c        |  56 +++++++---------
 4 files changed, 124 insertions(+), 103 deletions(-)

-- 
1.8.3.1


^ permalink raw reply	[flat|nested] 32+ messages in thread

end of thread, other threads:[~2020-02-18 22:47 UTC | newest]

Thread overview: 32+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-01-06 18:54 [PATCH ghak25 v2 0/9] Address NETFILTER_CFG issues Richard Guy Briggs
2020-01-06 18:54 ` [PATCH ghak25 v2 1/9] netfilter: normalize x_table function declarations Richard Guy Briggs
2020-01-06 20:23   ` Florian Westphal
2020-01-08 16:47   ` Nicolas Dichtel
2020-01-16 21:29     ` Richard Guy Briggs
2020-01-31  3:17   ` Paul Moore
2020-02-10 19:13     ` Richard Guy Briggs
2020-01-06 18:54 ` [PATCH ghak25 v2 2/9] netfilter: normalize ebtables " Richard Guy Briggs
2020-01-06 20:30   ` Florian Westphal
2020-01-31  3:17   ` Paul Moore
2020-01-06 18:54 ` [PATCH ghak25 v2 3/9] netfilter: normalize ebtables function declarations II Richard Guy Briggs
2020-01-06 20:31   ` Florian Westphal
2020-01-31  3:17   ` Paul Moore
2020-01-06 18:54 ` [PATCH ghak25 v2 4/9] audit: record nfcfg params Richard Guy Briggs
2020-01-31  3:18   ` Paul Moore
2020-02-18 22:47     ` Richard Guy Briggs
2020-01-06 18:54 ` [PATCH ghak25 v2 5/9] netfilter: x_tables audit only on syscall rule Richard Guy Briggs
2020-01-06 18:54 ` [PATCH ghak25 v2 6/9] netfilter: ebtables " Richard Guy Briggs
2020-01-06 18:54 ` [PATCH ghak25 v2 7/9] netfilter: ebtables audit table registration Richard Guy Briggs
2020-01-31  3:18   ` Paul Moore
2020-02-18 22:35     ` Richard Guy Briggs
2020-01-06 18:54 ` [PATCH ghak25 v2 8/9] netfilter: add audit operation field Richard Guy Briggs
2020-01-06 20:23   ` Florian Westphal
2020-01-31  3:18     ` Paul Moore
2020-02-13 12:14     ` Richard Guy Briggs
2020-02-13 12:34       ` Florian Westphal
2020-02-13 14:29         ` Richard Guy Briggs
2020-01-06 18:54 ` [PATCH ghak25 v2 9/9] netfilter: audit table unregister actions Richard Guy Briggs
2020-01-31  3:18   ` Paul Moore
2020-01-16 15:05 ` [PATCH ghak25 v2 0/9] Address NETFILTER_CFG issues Pablo Neira Ayuso
2020-01-16 19:07   ` Paul Moore
2020-01-16 21:20     ` Richard Guy Briggs

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).