audit: add support for fcaps v3

V3 namespaced file capabilities were introduced in
commit 8db6c34f1dbc ("Introduce v3 namespaced file capabilities")

Add support for these by adding the "frootid" field to the existing
fcaps fields in the NAME and BPRM_FCAPS records.

Please see github issue
https://github.com/linux-audit/audit-kernel/issues/103

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Acked-by: Serge Hallyn <serge@hallyn.com>
[PM: comment tweak to fit an 80 char line width]
Signed-off-by: Paul Moore <paul@paul-moore.com>

diff --git a/include/linux/capability.h b/include/linux/capability.h
index f640dcbc880c0c291cdbd2a5780f4fd21be4b7b3..b769330e93807f17cf4eb43cbaa81f4cd2b0babf 100644 (file)
--- a/include/linux/capability.h
+++ b/include/linux/capability.h
@@ -14,7 +14,7 @@
 #define _LINUX_CAPABILITY_H
 
 #include <uapi/linux/capability.h>
-
+#include <linux/uidgid.h>
 
 #define _KERNEL_CAPABILITY_VERSION _LINUX_CAPABILITY_VERSION_3
 #define _KERNEL_CAPABILITY_U32S    _LINUX_CAPABILITY_U32S_3
@@ -25,11 +25,12 @@ typedef struct kernel_cap_struct {
        __u32 cap[_KERNEL_CAPABILITY_U32S];
 } kernel_cap_t;
 
-/* exact same as vfs_cap_data but in cpu endian and always filled completely */
+/* same as vfs_ns_cap_data but in cpu endian and always filled completely */
 struct cpu_vfs_cap_data {
        __u32 magic_etc;
        kernel_cap_t permitted;
        kernel_cap_t inheritable;
+       kuid_t rootid;
 };
 
 #define _USER_CAP_HEADER_SIZE  (sizeof(struct __user_cap_header_struct))

diff --git a/kernel/audit.c b/kernel/audit.c
index 2a32f304223d1aeb05ea26025edafbce36628bac..3f3f1888cac78885c9603e0caa69fba08aab33df 100644 (file)
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -2084,8 +2084,9 @@ static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name)
 {
        audit_log_cap(ab, "cap_fp", &name->fcap.permitted);
        audit_log_cap(ab, "cap_fi", &name->fcap.inheritable);
-       audit_log_format(ab, " cap_fe=%d cap_fver=%x",
-                        name->fcap.fE, name->fcap_ver);
+       audit_log_format(ab, " cap_fe=%d cap_fver=%x cap_frootid=%d",
+                        name->fcap.fE, name->fcap_ver,
+                        from_kuid(&init_user_ns, name->fcap.rootid));
 }
 
 static inline int audit_copy_fcaps(struct audit_names *name,
@@ -2104,6 +2105,7 @@ static inline int audit_copy_fcaps(struct audit_names *name,
        name->fcap.permitted = caps.permitted;
        name->fcap.inheritable = caps.inheritable;
        name->fcap.fE = !!(caps.magic_etc & VFS_CAP_FLAGS_EFFECTIVE);
+       name->fcap.rootid = caps.rootid;
        name->fcap_ver = (caps.magic_etc & VFS_CAP_REVISION_MASK) >>
                                VFS_CAP_REVISION_SHIFT;
 

diff --git a/kernel/audit.h b/kernel/audit.h
index 6ffb70575082044596afb52026e91eaef7ae4bce..deefdbe61a4767be3f2d7bd98248ac367dba12f4 100644 (file)
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -69,6 +69,7 @@ struct audit_cap_data {
                kernel_cap_t    effective;      /* effective set of process */
        };
        kernel_cap_t            ambient;
+       kuid_t                  rootid;
 };
 
 /* When fs/namei.c:getname() is called, we store the pointer in name and bump

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 572d247957fb41a2b7157f6cfdec6efcf79f9f7f..c16beb25fd0abbde3083997652c7e5ef63f9c392 100644 (file)
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1358,6 +1358,9 @@ static void audit_log_exit(void)
                        audit_log_cap(ab, "pi", &axs->new_pcap.inheritable);
                        audit_log_cap(ab, "pe", &axs->new_pcap.effective);
                        audit_log_cap(ab, "pa", &axs->new_pcap.ambient);
+                       audit_log_format(ab, " frootid=%d",
+                                        from_kuid(&init_user_ns,
+                                                  axs->fcap.rootid));
                        break; }
 
                }
@@ -2271,6 +2274,7 @@ int __audit_log_bprm_fcaps(struct linux_binprm *bprm,
        ax->fcap.permitted = vcaps.permitted;
        ax->fcap.inheritable = vcaps.inheritable;
        ax->fcap.fE = !!(vcaps.magic_etc & VFS_CAP_FLAGS_EFFECTIVE);
+       ax->fcap.rootid = vcaps.rootid;
        ax->fcap_ver = (vcaps.magic_etc & VFS_CAP_REVISION_MASK) >> VFS_CAP_REVISION_SHIFT;
 
        ax->old_pcap.permitted   = old->cap_permitted;

diff --git a/security/commoncap.c b/security/commoncap.c
index 232db019f0519f6af292eb5db97d300856eb1bd9..c097f3568001040e441e9ad12af920c27922b71c 100644 (file)
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -643,6 +643,8 @@ int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data
        cpu_caps->permitted.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;
        cpu_caps->inheritable.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;
 
+       cpu_caps->rootid = rootkuid;
+
        return 0;
 }