iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

audit: issue CWD record to accompany LSM_AUDIT_DATA_* records

Browse Source 
The LSM_AUDIT_DATA_* records for PATH, FILE, IOCTL_OP, DENTRY and INODE
are incomplete without the task context of the AUDIT Current Working
Directory record.  Add it.

This record addition can't use audit_dummy_context to determine whether
or not to store the record information since the LSM_AUDIT_DATA_*
records are initiated by various LSMs independent of any audit rules.
context->in_syscall is used to determine if it was called in user
context like audit_getname.

Please see the upstream issue
https://github.com/linux-audit/audit-kernel/issues/96

Adapted from Vladis Dronov's v2 patch.

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Richard Guy Briggs 2020-07-03 12:56:19 -04:00 committed by Paul Moore
parent 68df2ed544
commit d7481b24b8
3 changed files with 28 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
include/linux/audit.h
View File

@ -292,7 +292,7 @@ extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1,
extern void __audit_syscall_exit(int ret_success, long ret_value);
extern struct filename *__audit_reusename(const __user char *uptr);
extern void __audit_getname(struct filename *name);
extern void __audit_getcwd(void);
extern void __audit_inode(struct filename *name, const struct dentry *dentry,
unsigned int flags);
extern void __audit_file(const struct file *);
@ -351,6 +351,11 @@ static inline void audit_getname(struct filename *name)
if (unlikely(!audit_dummy_context()))
__audit_getname(name);
}
static inline void audit_getcwd(void)
{
if (unlikely(audit_context()))
__audit_getcwd();
}
static inline void audit_inode(struct filename *name,
const struct dentry *dentry,
unsigned int aflags) {
@ -579,6 +584,8 @@ static inline struct filename *audit_reusename(const __user char *name)
}
static inline void audit_getname(struct filename *name)
{ }
static inline void audit_getcwd(void)
{ }
static inline void audit_inode(struct filename *name,
const struct dentry *dentry,
unsigned int aflags)

17
kernel/auditsc.c
View File

@ -1891,6 +1891,20 @@ __audit_reusename(const __user char *uptr)
return NULL;
}
inline void _audit_getcwd(struct audit_context *context)
{
if (!context->pwd.dentry)
get_fs_pwd(current->fs, &context->pwd);
}
void __audit_getcwd(void)
{
struct audit_context *context = audit_context();
if (context->in_syscall)
_audit_getcwd(context);
}
/**
* __audit_getname - add a name to the list
* @name: name to add
@ -1915,8 +1929,7 @@ void __audit_getname(struct filename *name)
name->aname = n;
name->refcnt++;
if (!context->pwd.dentry)
get_fs_pwd(current->fs, &context->pwd);
_audit_getcwd(context);
}
static inline int audit_copy_fcaps(struct audit_names *name,

5
security/lsm_audit.c
View File

@ -241,6 +241,7 @@ static void dump_common_audit_data(struct audit_buffer *ab,
audit_log_untrustedstring(ab, inode->i_sb->s_id);
audit_log_format(ab, " ino=%lu", inode->i_ino);
}
audit_getcwd();
break;
}
case LSM_AUDIT_DATA_FILE: {
@ -254,6 +255,7 @@ static void dump_common_audit_data(struct audit_buffer *ab,
audit_log_untrustedstring(ab, inode->i_sb->s_id);
audit_log_format(ab, " ino=%lu", inode->i_ino);
}
audit_getcwd();
break;
}
case LSM_AUDIT_DATA_IOCTL_OP: {
@ -269,6 +271,7 @@ static void dump_common_audit_data(struct audit_buffer *ab,
}
audit_log_format(ab, " ioctlcmd=0x%hx", a->u.op->cmd);
audit_getcwd();
break;
}
case LSM_AUDIT_DATA_DENTRY: {
@ -283,6 +286,7 @@ static void dump_common_audit_data(struct audit_buffer *ab,
audit_log_untrustedstring(ab, inode->i_sb->s_id);
audit_log_format(ab, " ino=%lu", inode->i_ino);
}
audit_getcwd();
break;
}
case LSM_AUDIT_DATA_INODE: {
@ -300,6 +304,7 @@ static void dump_common_audit_data(struct audit_buffer *ab,
audit_log_format(ab, " dev=");
audit_log_untrustedstring(ab, inode->i_sb->s_id);
audit_log_format(ab, " ino=%lu", inode->i_ino);
audit_getcwd();
break;
}
case LSM_AUDIT_DATA_TASK: {