From: Richard Guy Briggs <rgb@redhat.com> To: containers@lists.linux-foundation.org, linux-api@vger.kernel.org, Linux-Audit Mailing List <linux-audit@redhat.com>, linux-fsdevel@vger.kernel.org, LKML <linux-kernel@vger.kernel.org>, netdev@vger.kernel.org, netfilter-devel@vger.kernel.org Cc: Paul Moore <paul@paul-moore.com>, sgrubb@redhat.com, omosnace@redhat.com, dhowells@redhat.com, simo@redhat.com, eparis@parisplace.org, serge@hallyn.com, ebiederm@xmission.com, nhorman@tuxdriver.com, dwalsh@redhat.com, mpatel@redhat.com, Richard Guy Briggs <rgb@redhat.com> Subject: [PATCH ghak90 V7 09/21] audit: add support for non-syscall auxiliary records Date: Wed, 18 Sep 2019 21:22:26 -0400 [thread overview] Message-ID: <d2b596026e4746e8bb72769d73bb524eee05141f.1568834524.git.rgb@redhat.com> (raw) In-Reply-To: <cover.1568834524.git.rgb@redhat.com> In-Reply-To: <cover.1568834524.git.rgb@redhat.com> Standalone audit records have the timestamp and serial number generated on the fly and as such are unique, making them standalone. This new function audit_alloc_local() generates a local audit context that will be used only for a standalone record and its auxiliary record(s). The context is discarded immediately after the local associated records are produced. Signed-off-by: Richard Guy Briggs <rgb@redhat.com> Acked-by: Serge Hallyn <serge@hallyn.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Reviewed-by: Ondrej Mosnacek <omosnace@redhat.com> --- include/linux/audit.h | 8 ++++++++ kernel/audit.h | 1 + kernel/auditsc.c | 35 ++++++++++++++++++++++++++++++----- 3 files changed, 39 insertions(+), 5 deletions(-) diff --git a/include/linux/audit.h b/include/linux/audit.h index 7b640c4da4ee..e849058cb662 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -329,6 +329,8 @@ static inline int audit_signal_info(int sig, struct task_struct *t) /* These are defined in auditsc.c */ /* Public API */ +extern struct audit_context *audit_alloc_local(gfp_t gfpflags); +extern void audit_free_context(struct audit_context *context); extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1, unsigned long a2, unsigned long a3); extern void __audit_syscall_exit(int ret_success, long ret_value); @@ -591,6 +593,12 @@ static inline void audit_ntp_log(const struct audit_ntp_data *ad) extern int audit_n_rules; extern int audit_signals; #else /* CONFIG_AUDITSYSCALL */ +static inline struct audit_context *audit_alloc_local(gfp_t gfpflags) +{ + return NULL; +} +static inline void audit_free_context(struct audit_context *context) +{ } static inline void audit_syscall_entry(int major, unsigned long a0, unsigned long a1, unsigned long a2, unsigned long a3) diff --git a/kernel/audit.h b/kernel/audit.h index c9a118716ced..1bba13bdffd0 100644 --- a/kernel/audit.h +++ b/kernel/audit.h @@ -98,6 +98,7 @@ struct audit_proctitle { struct audit_context { int dummy; /* must be the first element */ int in_syscall; /* 1 if task is in a syscall */ + bool local; /* local context needed */ enum audit_state state, current_state; unsigned int serial; /* serial number for record */ int major; /* syscall number */ diff --git a/kernel/auditsc.c b/kernel/auditsc.c index ac438fcff807..3138c88887c7 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -890,11 +890,13 @@ static inline void audit_free_aux(struct audit_context *context) } } -static inline struct audit_context *audit_alloc_context(enum audit_state state) +static inline struct audit_context *audit_alloc_context(enum audit_state state, + gfp_t gfpflags) { struct audit_context *context; - context = kzalloc(sizeof(*context), GFP_KERNEL); + /* We can be called in atomic context via audit_tg() */ + context = kzalloc(sizeof(*context), gfpflags); if (!context) return NULL; context->state = state; @@ -930,7 +932,8 @@ int audit_alloc_syscall(struct task_struct *tsk) return 0; } - if (!(context = audit_alloc_context(state))) { + context = audit_alloc_context(state, GFP_KERNEL); + if (!context) { kfree(key); audit_log_lost("out of memory in audit_alloc_syscall"); return -ENOMEM; @@ -942,8 +945,29 @@ int audit_alloc_syscall(struct task_struct *tsk) return 0; } -static inline void audit_free_context(struct audit_context *context) +struct audit_context *audit_alloc_local(gfp_t gfpflags) { + struct audit_context *context = NULL; + + if (!audit_ever_enabled) + goto out; /* Return if not auditing. */ + context = audit_alloc_context(AUDIT_RECORD_CONTEXT, gfpflags); + if (!context) { + audit_log_lost("out of memory in audit_alloc_local"); + goto out; + } + context->serial = audit_serial(); + ktime_get_coarse_real_ts64(&context->ctime); + context->local = true; +out: + return context; +} +EXPORT_SYMBOL(audit_alloc_local); + +void audit_free_context(struct audit_context *context) +{ + if (!context) + return; audit_free_module(context); audit_free_names(context); unroll_tree_refs(context, NULL, 0); @@ -954,6 +978,7 @@ static inline void audit_free_context(struct audit_context *context) audit_proctitle_free(context); kfree(context); } +EXPORT_SYMBOL(audit_free_context); static int audit_log_pid_context(struct audit_context *context, pid_t pid, kuid_t auid, kuid_t uid, unsigned int sessionid, @@ -2182,7 +2207,7 @@ void __audit_inode_child(struct inode *parent, int auditsc_get_stamp(struct audit_context *ctx, struct timespec64 *t, unsigned int *serial) { - if (!ctx->in_syscall) + if (!ctx->in_syscall && !ctx->local) return 0; if (!ctx->serial) ctx->serial = audit_serial(); -- 1.8.3.1
WARNING: multiple messages have this Message-ID (diff)
From: Richard Guy Briggs <rgb@redhat.com> To: containers@lists.linux-foundation.org, linux-api@vger.kernel.org, Linux-Audit Mailing List <linux-audit@redhat.com>, linux-fsdevel@vger.kernel.org, LKML <linux-kernel@vger.kernel.org>, netdev@vger.kernel.org, netfilter-devel@vger.kernel.org Cc: nhorman@tuxdriver.com, Richard Guy Briggs <rgb@redhat.com>, dhowells@redhat.com, ebiederm@xmission.com, simo@redhat.com, eparis@parisplace.org, mpatel@redhat.com, serge@hallyn.com Subject: [PATCH ghak90 V7 09/21] audit: add support for non-syscall auxiliary records Date: Wed, 18 Sep 2019 21:22:26 -0400 [thread overview] Message-ID: <d2b596026e4746e8bb72769d73bb524eee05141f.1568834524.git.rgb@redhat.com> (raw) In-Reply-To: <cover.1568834524.git.rgb@redhat.com> In-Reply-To: <cover.1568834524.git.rgb@redhat.com> Standalone audit records have the timestamp and serial number generated on the fly and as such are unique, making them standalone. This new function audit_alloc_local() generates a local audit context that will be used only for a standalone record and its auxiliary record(s). The context is discarded immediately after the local associated records are produced. Signed-off-by: Richard Guy Briggs <rgb@redhat.com> Acked-by: Serge Hallyn <serge@hallyn.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Reviewed-by: Ondrej Mosnacek <omosnace@redhat.com> --- include/linux/audit.h | 8 ++++++++ kernel/audit.h | 1 + kernel/auditsc.c | 35 ++++++++++++++++++++++++++++++----- 3 files changed, 39 insertions(+), 5 deletions(-) diff --git a/include/linux/audit.h b/include/linux/audit.h index 7b640c4da4ee..e849058cb662 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -329,6 +329,8 @@ static inline int audit_signal_info(int sig, struct task_struct *t) /* These are defined in auditsc.c */ /* Public API */ +extern struct audit_context *audit_alloc_local(gfp_t gfpflags); +extern void audit_free_context(struct audit_context *context); extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1, unsigned long a2, unsigned long a3); extern void __audit_syscall_exit(int ret_success, long ret_value); @@ -591,6 +593,12 @@ static inline void audit_ntp_log(const struct audit_ntp_data *ad) extern int audit_n_rules; extern int audit_signals; #else /* CONFIG_AUDITSYSCALL */ +static inline struct audit_context *audit_alloc_local(gfp_t gfpflags) +{ + return NULL; +} +static inline void audit_free_context(struct audit_context *context) +{ } static inline void audit_syscall_entry(int major, unsigned long a0, unsigned long a1, unsigned long a2, unsigned long a3) diff --git a/kernel/audit.h b/kernel/audit.h index c9a118716ced..1bba13bdffd0 100644 --- a/kernel/audit.h +++ b/kernel/audit.h @@ -98,6 +98,7 @@ struct audit_proctitle { struct audit_context { int dummy; /* must be the first element */ int in_syscall; /* 1 if task is in a syscall */ + bool local; /* local context needed */ enum audit_state state, current_state; unsigned int serial; /* serial number for record */ int major; /* syscall number */ diff --git a/kernel/auditsc.c b/kernel/auditsc.c index ac438fcff807..3138c88887c7 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -890,11 +890,13 @@ static inline void audit_free_aux(struct audit_context *context) } } -static inline struct audit_context *audit_alloc_context(enum audit_state state) +static inline struct audit_context *audit_alloc_context(enum audit_state state, + gfp_t gfpflags) { struct audit_context *context; - context = kzalloc(sizeof(*context), GFP_KERNEL); + /* We can be called in atomic context via audit_tg() */ + context = kzalloc(sizeof(*context), gfpflags); if (!context) return NULL; context->state = state; @@ -930,7 +932,8 @@ int audit_alloc_syscall(struct task_struct *tsk) return 0; } - if (!(context = audit_alloc_context(state))) { + context = audit_alloc_context(state, GFP_KERNEL); + if (!context) { kfree(key); audit_log_lost("out of memory in audit_alloc_syscall"); return -ENOMEM; @@ -942,8 +945,29 @@ int audit_alloc_syscall(struct task_struct *tsk) return 0; } -static inline void audit_free_context(struct audit_context *context) +struct audit_context *audit_alloc_local(gfp_t gfpflags) { + struct audit_context *context = NULL; + + if (!audit_ever_enabled) + goto out; /* Return if not auditing. */ + context = audit_alloc_context(AUDIT_RECORD_CONTEXT, gfpflags); + if (!context) { + audit_log_lost("out of memory in audit_alloc_local"); + goto out; + } + context->serial = audit_serial(); + ktime_get_coarse_real_ts64(&context->ctime); + context->local = true; +out: + return context; +} +EXPORT_SYMBOL(audit_alloc_local); + +void audit_free_context(struct audit_context *context) +{ + if (!context) + return; audit_free_module(context); audit_free_names(context); unroll_tree_refs(context, NULL, 0); @@ -954,6 +978,7 @@ static inline void audit_free_context(struct audit_context *context) audit_proctitle_free(context); kfree(context); } +EXPORT_SYMBOL(audit_free_context); static int audit_log_pid_context(struct audit_context *context, pid_t pid, kuid_t auid, kuid_t uid, unsigned int sessionid, @@ -2182,7 +2207,7 @@ void __audit_inode_child(struct inode *parent, int auditsc_get_stamp(struct audit_context *ctx, struct timespec64 *t, unsigned int *serial) { - if (!ctx->in_syscall) + if (!ctx->in_syscall && !ctx->local) return 0; if (!ctx->serial) ctx->serial = audit_serial(); -- 1.8.3.1
next prev parent reply other threads:[~2019-09-19 1:25 UTC|newest] Thread overview: 98+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-09-19 1:22 [PATCH ghak90 V7 00/21] audit: implement container identifier Richard Guy Briggs 2019-09-19 1:22 ` Richard Guy Briggs 2019-09-19 1:22 ` [PATCH ghak90 V7 01/21] audit: collect audit task parameters Richard Guy Briggs 2019-09-19 1:22 ` [PATCH ghak90 V7 02/21] audit: add container id Richard Guy Briggs 2019-09-19 1:22 ` [PATCH ghak90 V7 03/21] audit: read container ID of a process Richard Guy Briggs 2019-09-19 1:22 ` [PATCH ghak90 V7 04/21] audit: convert to contid list to check for orch/engine ownership Richard Guy Briggs 2019-09-26 14:46 ` Neil Horman 2019-10-25 20:00 ` Richard Guy Briggs 2019-10-25 20:00 ` Richard Guy Briggs 2019-10-28 12:20 ` Neil Horman 2019-10-11 0:38 ` Paul Moore 2019-10-25 21:00 ` Richard Guy Briggs 2019-11-08 18:26 ` Paul Moore 2019-09-19 1:22 ` [PATCH ghak90 V7 05/21] audit: log drop of contid on exit of last task Richard Guy Briggs 2019-10-11 0:38 ` Paul Moore 2019-10-11 0:38 ` Paul Moore 2019-10-25 19:43 ` Richard Guy Briggs 2019-10-25 19:43 ` Richard Guy Briggs 2019-09-19 1:22 ` [PATCH ghak90 V7 06/21] audit: contid limit of 32k imposed to avoid DoS Richard Guy Briggs 2019-09-27 12:51 ` Neil Horman 2019-10-11 0:38 ` Paul Moore 2019-10-11 0:38 ` Paul Moore 2019-10-24 21:23 ` Richard Guy Briggs 2019-10-24 21:23 ` Richard Guy Briggs 2019-11-08 17:49 ` Paul Moore 2019-12-17 18:45 ` Richard Guy Briggs 2019-12-17 19:25 ` Steve Grubb 2019-12-17 19:56 ` Richard Guy Briggs 2019-12-17 19:56 ` Richard Guy Briggs 2019-10-25 20:15 ` Richard Guy Briggs 2019-09-19 1:22 ` [PATCH ghak90 V7 07/21] audit: log container info of syscalls Richard Guy Briggs 2019-09-19 1:22 ` [PATCH ghak90 V7 08/21] audit: add contid support for signalling the audit daemon Richard Guy Briggs 2019-10-11 0:39 ` Paul Moore 2019-10-11 0:39 ` Paul Moore 2019-10-25 19:20 ` Richard Guy Briggs 2019-11-08 17:41 ` Paul Moore 2019-09-19 1:22 ` Richard Guy Briggs [this message] 2019-09-19 1:22 ` [PATCH ghak90 V7 09/21] audit: add support for non-syscall auxiliary records Richard Guy Briggs 2019-09-19 1:22 ` [PATCH ghak90 V7 10/21] audit: add containerid support for user records Richard Guy Briggs 2019-09-19 1:22 ` [PATCH ghak90 V7 11/21] audit: add containerid filtering Richard Guy Briggs 2019-09-19 1:22 ` Richard Guy Briggs 2019-09-19 1:22 ` [PATCH ghak90 V7 12/21] audit: add support for containerid to network namespaces Richard Guy Briggs 2019-09-19 1:22 ` Richard Guy Briggs 2019-10-11 0:39 ` Paul Moore 2019-10-11 0:39 ` Paul Moore 2019-09-19 1:22 ` [PATCH ghak90 V7 13/21] audit: NETFILTER_PKT: record each container ID associated with a netNS Richard Guy Briggs 2019-09-19 1:22 ` Richard Guy Briggs 2019-10-11 0:39 ` Paul Moore 2019-09-19 1:22 ` [PATCH ghak90 V7 14/21] audit: contid check descendancy and nesting Richard Guy Briggs 2019-10-11 0:40 ` Paul Moore 2019-10-11 0:40 ` Paul Moore 2019-10-24 22:08 ` Richard Guy Briggs 2019-10-24 22:08 ` Richard Guy Briggs 2019-10-30 20:32 ` Paul Moore 2019-09-19 1:22 ` [PATCH ghak90 V7 15/21] sched: pull task_is_descendant into kernel/sched/core.c Richard Guy Briggs 2019-09-19 1:22 ` Richard Guy Briggs 2019-10-11 0:40 ` Paul Moore 2019-09-19 1:22 ` [PATCH ghak90 V7 16/21] audit: add support for contid set/get by netlink Richard Guy Briggs 2019-10-11 0:40 ` Paul Moore 2019-10-11 0:40 ` Paul Moore 2019-09-19 1:22 ` [PATCH ghak90 V7 17/21] audit: add support for loginuid/sessionid " Richard Guy Briggs 2019-09-19 1:22 ` Richard Guy Briggs 2019-10-11 0:40 ` Paul Moore 2019-09-19 1:22 ` [PATCH ghak90 V7 18/21] audit: track container nesting Richard Guy Briggs 2019-10-11 0:40 ` Paul Moore 2019-10-11 0:40 ` Paul Moore 2019-09-19 1:22 ` [PATCH ghak90 V7 19/21] audit: check cont depth Richard Guy Briggs 2019-09-19 1:22 ` [PATCH ghak90 V7 20/21] audit: add capcontid to set contid outside init_user_ns Richard Guy Briggs 2019-10-19 1:39 ` Richard Guy Briggs 2019-10-19 1:39 ` Richard Guy Briggs 2019-10-21 19:53 ` Paul Moore 2019-10-21 21:38 ` Richard Guy Briggs 2019-10-21 21:38 ` Richard Guy Briggs 2019-10-21 21:43 ` Paul Moore 2019-10-21 23:57 ` Richard Guy Briggs 2019-10-21 23:57 ` Richard Guy Briggs 2019-10-22 0:31 ` Paul Moore 2019-10-22 12:13 ` Neil Horman 2019-10-22 14:04 ` Paul Moore 2019-10-22 20:06 ` Richard Guy Briggs 2019-10-22 20:06 ` Richard Guy Briggs 2019-10-22 14:27 ` Richard Guy Briggs 2019-10-22 14:27 ` Richard Guy Briggs 2019-10-22 14:34 ` Paul Moore 2019-10-24 21:00 ` Richard Guy Briggs 2019-10-30 20:27 ` Paul Moore 2019-10-30 22:03 ` Richard Guy Briggs 2019-10-30 22:03 ` Richard Guy Briggs 2019-10-31 13:59 ` Paul Moore 2019-10-31 14:50 ` Steve Grubb 2019-10-31 23:37 ` Paul Moore 2019-11-01 1:02 ` Duncan Roe 2019-11-01 15:09 ` Richard Guy Briggs 2019-11-01 15:09 ` Richard Guy Briggs 2019-11-01 15:13 ` Steve Grubb 2019-11-01 15:21 ` Richard Guy Briggs 2019-11-01 16:22 ` Paul Moore 2019-09-19 1:22 ` [PATCH ghak90 V7 21/21] audit: add proc interface for capcontid Richard Guy Briggs
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=d2b596026e4746e8bb72769d73bb524eee05141f.1568834524.git.rgb@redhat.com \ --to=rgb@redhat.com \ --cc=containers@lists.linux-foundation.org \ --cc=dhowells@redhat.com \ --cc=dwalsh@redhat.com \ --cc=ebiederm@xmission.com \ --cc=eparis@parisplace.org \ --cc=linux-api@vger.kernel.org \ --cc=linux-audit@redhat.com \ --cc=linux-fsdevel@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=mpatel@redhat.com \ --cc=netdev@vger.kernel.org \ --cc=netfilter-devel@vger.kernel.org \ --cc=nhorman@tuxdriver.com \ --cc=omosnace@redhat.com \ --cc=paul@paul-moore.com \ --cc=serge@hallyn.com \ --cc=sgrubb@redhat.com \ --cc=simo@redhat.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.