From: "Christian Göttsche" <cgzones@googlemail.com>
To: selinux@vger.kernel.org
Subject: [PATCH SYSTEMD 1/7] selinux: add function name to audit data
Date: Thu, 5 Aug 2021 16:24:39 +0200 [thread overview]
Message-ID: <20210805142445.61725-2-cgzones@googlemail.com> (raw)
In-Reply-To: <20210805142445.61725-1-cgzones@googlemail.com>
Include the systemd C function name in the audit message to improve the
debug ability on denials.
Similar like kernel denial messages include the syscall name.
---
src/core/selinux-access.c | 18 ++++++++++++------
src/core/selinux-access.h | 10 +++++++---
2 files changed, 19 insertions(+), 9 deletions(-)
diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c
index d077d5dea7..e8e73a5951 100644
--- a/src/core/selinux-access.c
+++ b/src/core/selinux-access.c
@@ -31,6 +31,7 @@ struct audit_info {
sd_bus_creds *creds;
const char *path;
const char *cmdline;
+ const char *function;
};
/*
@@ -58,10 +59,11 @@ static int audit_callback(
xsprintf(gid_buf, GID_FMT, gid);
snprintf(msgbuf, msgbufsize,
- "auid=%s uid=%s gid=%s%s%s%s%s%s%s",
+ "auid=%s uid=%s gid=%s%s%s%s%s%s%s%s%s%s",
login_uid_buf, uid_buf, gid_buf,
audit->path ? " path=\"" : "", strempty(audit->path), audit->path ? "\"" : "",
- audit->cmdline ? " cmdline=\"" : "", strempty(audit->cmdline), audit->cmdline ? "\"" : "");
+ audit->cmdline ? " cmdline=\"" : "", strempty(audit->cmdline), audit->cmdline ? "\"" : "",
+ audit->function ? " function=\"" : "", strempty(audit->function), audit->function ? "\"" : "");
return 0;
}
@@ -179,7 +181,8 @@ int mac_selinux_generic_access_check(
sd_bus_message *message,
const char *path,
const char *permission,
- sd_bus_error *error) {
+ sd_bus_error *error,
+ const char *func) {
_cleanup_(sd_bus_creds_unrefp) sd_bus_creds *creds = NULL;
const char *tclass, *scon;
@@ -192,6 +195,7 @@ int mac_selinux_generic_access_check(
assert(message);
assert(permission);
assert(error);
+ assert(func);
r = access_init(error);
if (r <= 0)
@@ -263,6 +267,7 @@ int mac_selinux_generic_access_check(
.creds = creds,
.path = path,
.cmdline = cl,
+ .function = func,
};
r = selinux_check_access(scon, fcon, tclass, permission, &audit_info);
@@ -274,8 +279,8 @@ int mac_selinux_generic_access_check(
}
log_full_errno_zerook(LOG_DEBUG, r,
- "SELinux access check scon=%s tcon=%s tclass=%s perm=%s state=%s path=%s cmdline=%s: %m",
- scon, fcon, tclass, permission, enforce ? "enforcing" : "permissive", path, cl);
+ "SELinux access check scon=%s tcon=%s tclass=%s perm=%s state=%s func=%s path=%s cmdline=%s: %m",
+ scon, fcon, tclass, permission, enforce ? "enforcing" : "permissive", func, path, cl);
return enforce ? r : 0;
}
@@ -285,7 +290,8 @@ int mac_selinux_generic_access_check(
sd_bus_message *message,
const char *path,
const char *permission,
- sd_bus_error *error) {
+ sd_bus_error *error,
+ const char *func) {
return 0;
}
diff --git a/src/core/selinux-access.h b/src/core/selinux-access.h
index c6bfb32544..8931e998d0 100644
--- a/src/core/selinux-access.h
+++ b/src/core/selinux-access.h
@@ -5,10 +5,14 @@
#include "manager.h"
-int mac_selinux_generic_access_check(sd_bus_message *message, const char *path, const char *permission, sd_bus_error *error);
+int mac_selinux_generic_access_check(sd_bus_message *message,
+ const char *path,
+ const char *permission,
+ sd_bus_error *error,
+ const char *func);
#define mac_selinux_access_check(message, permission, error) \
- mac_selinux_generic_access_check((message), NULL, (permission), (error))
+ mac_selinux_generic_access_check((message), NULL, (permission), (error), __func__)
#define mac_selinux_unit_access_check(unit, message, permission, error) \
- mac_selinux_generic_access_check((message), unit_label_path(unit), (permission), (error))
+ mac_selinux_generic_access_check((message), unit_label_path(unit), (permission), (error), __func__)
--
2.32.0
next prev parent reply other threads:[~2021-08-05 14:26 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-05 14:24 [PATCH SYSTEMD 0/7] Re-add SELinux checks for unit install operations Christian Göttsche
2021-08-05 14:24 ` Christian Göttsche [this message]
2021-08-05 14:24 ` [PATCH SYSTEMD 2/7] selinux: improve debug log format Christian Göttsche
2021-08-05 14:24 ` [PATCH SYSTEMD 3/7] selinux: mark _mac_selinux_generic_access_check with leading underscore Christian Göttsche
2021-08-05 14:24 ` [PATCH SYSTEMD 4/7] core: add support for MAC checks on unit install operations Christian Göttsche
2021-08-05 14:24 ` [PATCH SYSTEMD 5/7] core: implement the sd-bus generic callback for SELinux Christian Göttsche
2021-08-05 14:24 ` [PATCH SYSTEMD 6/7] core: avoid bypasses in D-BUS SELinux filter Christian Göttsche
2021-08-05 14:24 ` [PATCH SYSTEMD 7/7] core: tweak job_type_to_access_method SELinux permissions Christian Göttsche
2021-08-05 15:08 ` [PATCH SYSTEMD 0/7] Re-add SELinux checks for unit install operations Dominick Grift
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210805142445.61725-2-cgzones@googlemail.com \
--to=cgzones@googlemail.com \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.