From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.0 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DDE0AC46460 for ; Thu, 30 May 2019 20:45:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id ABAFC26184 for ; Thu, 30 May 2019 20:45:49 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=paul-moore-com.20150623.gappssmtp.com header.i=@paul-moore-com.20150623.gappssmtp.com header.b="xlyV3ThJ" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726682AbfE3Upm (ORCPT ); Thu, 30 May 2019 16:45:42 -0400 Received: from mail-lf1-f67.google.com ([209.85.167.67]:43467 "EHLO mail-lf1-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726674AbfE3Upm (ORCPT ); Thu, 30 May 2019 16:45:42 -0400 Received: by mail-lf1-f67.google.com with SMTP id u27so6078608lfg.10 for ; Thu, 30 May 2019 13:45:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paul-moore-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=EhDqOLrNL+Ls6g+jJlH1kHSTN+6mKWoVpwhK7g7g/0o=; b=xlyV3ThJjdhKcZhreP5PbaxjF4yCg2iuc+K7UzQP6tLJWwrREj0I5yVvPo3B3jh7iK jh1rsg4jyI3plqbkkIs9e7MgP53igOczr5L4MydDQ87MWflfgTeiR7tPUVxTFoKpmcm4 6sepnRi8IUd5YcXQYTYWT9BEkanR1k/eUovXIZ4CYEx4LttHAIlePcabZEyckUcOfwA+ ld4cKn0kM4Vfx29ADhSIicvea8BSndd/KrqWITOd8GFDTydQiWEJoSMQKugjZoDNrglv RFE65J9Z1q+k0M/9D9082A8PAYYyDpKeO4/3eIRTiQyhsN5cVxluVIS5g72M/cFmB4vp uEtw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=EhDqOLrNL+Ls6g+jJlH1kHSTN+6mKWoVpwhK7g7g/0o=; b=bwY4wnfDPPVC/heUstmPC2BSmElVfnbY74iXyAja6CM/XgtUUY+RUCg9TDrB4mp7DT Ae0FLBCjPYyK9B/BFlJod1HaM2BCirqb6T1Jt+KhlJLiy4yHKHU7RwydbbIcC1CpVM1W YD0Cql7Lj1Q7+W4Zj9zQI4MKkexetgANVQj91UUbJDcePbgSyoDQ1JWstg9orxUUP1ri irKDRcCeH9y8hXF9QWZmMvVujurFuMbuoLczLodwimGin3Bn5ABf60tTIF61IQqCzujC tktLqiJ9ahTu5WmUynggnmg0Y+69MTEz8qSgaXwvpZKsxr4MNh15ae8XktV63EPEgsAK rRww== X-Gm-Message-State: APjAAAUwWCPQQc7MhmeunqL1RL3tA5SXniLRCLY5pBXLtBuY5mvKW+ez V6Q47XBO9v9hbvUZ9EHY4QrMcKOoUwEiyInnkAku X-Google-Smtp-Source: APXvYqxCLcpJGQ9X7hllnM/E88Y7wiOxHiqGV+F77SwcvQq/KmkEMFzXAp+UwedDTn7SR4CSxAW2AxSMb9dduBaWcmQ= X-Received: by 2002:ac2:410a:: with SMTP id b10mr3157662lfi.175.1559249140261; Thu, 30 May 2019 13:45:40 -0700 (PDT) MIME-Version: 1.0 References: <0785ee2644804f3ec6af1243cc0dcf89709c1fd4.1554732921.git.rgb@redhat.com> <20190530141951.iofimovrndap4npq@madcap2.tricolour.ca> <20190530203702.fibsrazabbiifjvf@madcap2.tricolour.ca> In-Reply-To: <20190530203702.fibsrazabbiifjvf@madcap2.tricolour.ca> From: Paul Moore Date: Thu, 30 May 2019 16:45:28 -0400 Message-ID: Subject: Re: [PATCH ghak90 V6 08/10] audit: add containerid filtering To: Richard Guy Briggs Cc: containers@lists.linux-foundation.org, linux-api@vger.kernel.org, Linux-Audit Mailing List , linux-fsdevel@vger.kernel.org, LKML , netdev@vger.kernel.org, netfilter-devel@vger.kernel.org, sgrubb@redhat.com, omosnace@redhat.com, dhowells@redhat.com, simo@redhat.com, Eric Paris , Serge Hallyn , ebiederm@xmission.com, nhorman@tuxdriver.com Content-Type: text/plain; charset="UTF-8" Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org On Thu, May 30, 2019 at 4:37 PM Richard Guy Briggs wrote: > On 2019-05-30 10:34, Paul Moore wrote: > > On Thu, May 30, 2019 at 10:20 AM Richard Guy Briggs wrote: > > > > > > On 2019-05-29 18:16, Paul Moore wrote: > > > > On Mon, Apr 8, 2019 at 11:41 PM Richard Guy Briggs wrote: > > > > > > > > > > Implement audit container identifier filtering using the AUDIT_CONTID > > > > > field name to send an 8-character string representing a u64 since the > > > > > value field is only u32. > > > > > > > > > > Sending it as two u32 was considered, but gathering and comparing two > > > > > fields was more complex. > > > > > > > > > > The feature indicator is AUDIT_FEATURE_BITMAP_CONTAINERID. > > > > > > > > > > Please see the github audit kernel issue for the contid filter feature: > > > > > https://github.com/linux-audit/audit-kernel/issues/91 > > > > > Please see the github audit userspace issue for filter additions: > > > > > https://github.com/linux-audit/audit-userspace/issues/40 > > > > > Please see the github audit testsuiite issue for the test case: > > > > > https://github.com/linux-audit/audit-testsuite/issues/64 > > > > > Please see the github audit wiki for the feature overview: > > > > > https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID > > > > > Signed-off-by: Richard Guy Briggs > > > > > Acked-by: Serge Hallyn > > > > > Acked-by: Neil Horman > > > > > Reviewed-by: Ondrej Mosnacek > > > > > --- > > > > > include/linux/audit.h | 1 + > > > > > include/uapi/linux/audit.h | 5 ++++- > > > > > kernel/audit.h | 1 + > > > > > kernel/auditfilter.c | 47 ++++++++++++++++++++++++++++++++++++++++++++++ > > > > > kernel/auditsc.c | 4 ++++ > > > > > 5 files changed, 57 insertions(+), 1 deletion(-) > > > > > > > > ... > > > > > > > > > diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c > > > > > index 63f8b3f26fab..407b5bb3b4c6 100644 > > > > > --- a/kernel/auditfilter.c > > > > > +++ b/kernel/auditfilter.c > > > > > @@ -1206,6 +1224,31 @@ int audit_comparator(u32 left, u32 op, u32 right) > > > > > } > > > > > } > > > > > > > > > > +int audit_comparator64(u64 left, u32 op, u64 right) > > > > > +{ > > > > > + switch (op) { > > > > > + case Audit_equal: > > > > > + return (left == right); > > > > > + case Audit_not_equal: > > > > > + return (left != right); > > > > > + case Audit_lt: > > > > > + return (left < right); > > > > > + case Audit_le: > > > > > + return (left <= right); > > > > > + case Audit_gt: > > > > > + return (left > right); > > > > > + case Audit_ge: > > > > > + return (left >= right); > > > > > + case Audit_bitmask: > > > > > + return (left & right); > > > > > + case Audit_bittest: > > > > > + return ((left & right) == right); > > > > > + default: > > > > > + BUG(); > > > > > > > > A little birdy mentioned the BUG() here as a potential issue and while > > > > I had ignored it in earlier patches because this is likely a > > > > cut-n-paste from another audit comparator function, I took a closer > > > > look this time. It appears as though we will never have an invalid op > > > > value as audit_data_to_entry()/audit_to_op() ensure that the op value > > > > is a a known good value. Removing the BUG() from all the audit > > > > comparators is a separate issue, but I think it would be good to > > > > remove it from this newly added comparator; keeping it so that we > > > > return "0" in the default case seems reasoanble. > > > > > > Fair enough. That BUG(); can be removed. > > > > Please send a fixup patch for this. > > The fixup patch is trivial. Yes, I know. > The rebase to v5.2-rc1 audit/next had merge > conflicts with four recent patchsets. It may be simpler to submit a new > patchset and look at a diff of the two sets. I'm testing the rebase > now. Great thanks. Although you might want to hold off a bit on posting the next revision until we sort out the discussion which is happening in patch 02/10; unfortunately I fear we may need to change some of the logic. -- paul moore www.paul-moore.com