UBUNTU: SAUCE: Audit: Add a new record for multiple object LSM

 attributes

Create a new audit record type to contain the object information
when there are multiple security modules that require such data.
This record is emitted before the other records for the event, but
is linked with the same timestamp and serial number.

Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Cc: linux-audit@redhat.com
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Andrea Righi <andrea.righi@canonical.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 59473eeb079153a4cd3d4a0304f7c801f15607a6..55c73ceb12b9bbc8f69e1ecc59a4c9cd9eed911e 100644 (file)
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -189,6 +189,8 @@ extern void             audit_log_lost(const char *message);
 extern void audit_log_lsm(struct lsmblob *blob, bool exiting);
 extern int audit_log_task_context(struct audit_buffer *ab,
                                  struct lsmblob *blob);
+extern int audit_log_object_context(struct audit_buffer *ab,
+                                   struct lsmblob *blob);
 extern void audit_log_task_info(struct audit_buffer *ab);
 
 extern int                 audit_update_lsm_rules(void);

diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
index 4432a8bed8e09d140d201bb6587121ce5dec838d..4efed1abcd547a676cfa992576fd98c622b01c65 100644 (file)
--- a/include/uapi/linux/audit.h
+++ b/include/uapi/linux/audit.h
@@ -140,6 +140,7 @@
 #define AUDIT_MAC_CALIPSO_ADD  1418    /* NetLabel: add CALIPSO DOI entry */
 #define AUDIT_MAC_CALIPSO_DEL  1419    /* NetLabel: del CALIPSO DOI entry */
 #define AUDIT_MAC_TASK_CONTEXTS        1420    /* Multiple LSM contexts */
+#define AUDIT_MAC_OBJ_CONTEXTS 1421    /* Multiple LSM object contexts */
 
 #define AUDIT_FIRST_KERN_ANOM_MSG   1700
 #define AUDIT_LAST_KERN_ANOM_MSG    1799

diff --git a/kernel/audit.c b/kernel/audit.c
index a5e92aa2fa9188ae73c08c8ee20f571bb414ee99..63c6633aff2f98b1a4bd03ce6916823888ece9cb 100644 (file)
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -2196,6 +2196,59 @@ int audit_log_task_context(struct audit_buffer *ab, struct lsmblob *blob)
 }
 EXPORT_SYMBOL(audit_log_task_context);
 
+int audit_log_object_context(struct audit_buffer *ab,
+                                   struct lsmblob *blob)
+{
+       int i;
+       int error;
+       bool sep = false;
+       struct lsmcontext lsmdata;
+       struct audit_buffer *lsmab = NULL;
+       struct audit_context *context = NULL;
+
+       /*
+        * If there is more than one security module that has a
+        * object "context" it's necessary to put the object data
+        * into a separate record to maintain compatibility.
+        */
+       if (lsm_multiple_contexts()) {
+               audit_log_format(ab, " obj=?");
+               context = ab->ctx;
+               if (context)
+                       lsmab = audit_log_start(context, GFP_KERNEL,
+                                               AUDIT_MAC_OBJ_CONTEXTS);
+       }
+
+       for (i = 0; i < LSMBLOB_ENTRIES; i++) {
+               if (blob->secid[i] == 0)
+                       continue;
+               error = security_secid_to_secctx(blob, &lsmdata, i);
+               if (error && error != -EINVAL) {
+                       audit_panic("error in audit_log_object_context");
+                       return error;
+               }
+
+               if (context) {
+                       audit_log_format(lsmab, "%sobj_%s=%s",
+                                        sep ? " " : "",
+                                        security_lsm_slot_name(i),
+                                        lsmdata.context);
+                       sep = true;
+               } else
+                       audit_log_format(ab, " obj=%s", lsmdata.context);
+
+               security_release_secctx(&lsmdata);
+               if (!context)
+                       break;
+       }
+
+       if (context)
+               audit_log_end(lsmab);
+
+       return 0;
+}
+EXPORT_SYMBOL(audit_log_object_context);
+
 void audit_log_d_path_exe(struct audit_buffer *ab,
                          struct mm_struct *mm)
 {

diff --git a/kernel/audit.h b/kernel/audit.h
index 68ba39f8b68b1c5280bc8b90cd59efefcbd3b6c3..3ef647b7e3944596c166ea403c54609ebf629dca 100644 (file)
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -81,7 +81,7 @@ struct audit_names {
        kuid_t                  uid;
        kgid_t                  gid;
        dev_t                   rdev;
-       u32                     osid;
+       struct lsmblob          oblob;
        struct audit_cap_data   fcap;
        unsigned int            fcap_ver;
        unsigned char           type;           /* record type */
@@ -155,7 +155,7 @@ struct audit_context {
                        kuid_t                  uid;
                        kgid_t                  gid;
                        umode_t                 mode;
-                       u32                     osid;
+                       struct lsmblob          oblob;
                        int                     has_perm;
                        uid_t                   perm_uid;
                        gid_t                   perm_gid;

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index f2458670c70d0b405da24ecb3523ac9cea24b08f..317030566fe8f0a8c221ef1421f6f184173853ad 100644 (file)
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -692,14 +692,6 @@ static int audit_filter_rules(struct task_struct *tsk,
                        if (f->lsm_isset) {
                                /* Find files that match */
                                if (name) {
-                                       /*
-                                        * lsmblob_init sets all values in the
-                                        * lsmblob to sid. This is temporary
-                                        * until name->osid is converted to a
-                                        * lsmblob, which happens later in
-                                        * this patch set.
-                                        */
-                                       lsmblob_init(&blob, name->osid);
                                        result = security_audit_rule_match(
                                                                &blob,
                                                                f->type,
@@ -707,7 +699,6 @@ static int audit_filter_rules(struct task_struct *tsk,
                                                                f->lsm_rules);
                                } else if (ctx) {
                                        list_for_each_entry(n, &ctx->names_list, list) {
-                                               lsmblob_init(&blob, name->osid);
                                                if (security_audit_rule_match(
                                                                &blob,
                                                                f->type,
@@ -721,8 +712,7 @@ static int audit_filter_rules(struct task_struct *tsk,
                                /* Find ipc objects that match */
                                if (!ctx || ctx->type != AUDIT_IPC)
                                        break;
-                               lsmblob_init(&blob, ctx->ipc.osid);
-                               if (security_audit_rule_match(&blob,
+                               if (security_audit_rule_match(&ctx->ipc.oblob,
                                                              f->type, f->op,
                                                              f->lsm_rules))
                                        ++result;
@@ -1005,7 +995,6 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid,
                                 struct lsmblob *blob, char *comm)
 {
        struct audit_buffer *ab;
-       struct lsmcontext lsmctx;
        int rc = 0;
 
        ab = audit_log_start(context, GFP_KERNEL, AUDIT_OBJ_PID);
@@ -1015,15 +1004,7 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid,
        audit_log_format(ab, "opid=%d oauid=%d ouid=%d oses=%d", pid,
                         from_kuid(&init_user_ns, auid),
                         from_kuid(&init_user_ns, uid), sessionid);
-       if (lsmblob_is_set(blob)) {
-               if (security_secid_to_secctx(blob, &lsmctx, LSMBLOB_FIRST)) {
-                       audit_log_format(ab, " obj=(none)");
-                       rc = 1;
-               } else {
-                       audit_log_format(ab, " obj=%s", lsmctx.context);
-                       security_release_secctx(&lsmctx);
-               }
-       }
+       rc = audit_log_object_context(ab, blob);
        audit_log_format(ab, " ocomm=");
        audit_log_untrustedstring(ab, comm);
        audit_log_end(ab);
@@ -1251,26 +1232,14 @@ static void show_special(struct audit_context *context, int *call_panic)
                                context->socketcall.args[i]);
                break; }
        case AUDIT_IPC: {
-               u32 osid = context->ipc.osid;
+               struct lsmblob *oblob = &context->ipc.oblob;
 
                audit_log_format(ab, "ouid=%u ogid=%u mode=%#ho",
                                 from_kuid(&init_user_ns, context->ipc.uid),
                                 from_kgid(&init_user_ns, context->ipc.gid),
                                 context->ipc.mode);
-               if (osid) {
-                       struct lsmcontext lsmcxt;
-                       struct lsmblob blob;
-
-                       lsmblob_init(&blob, osid);
-                       if (security_secid_to_secctx(&blob, &lsmcxt,
-                                                    LSMBLOB_FIRST)) {
-                               audit_log_format(ab, " osid=%u", osid);
-                               *call_panic = 1;
-                       } else {
-                               audit_log_format(ab, " obj=%s", lsmcxt.context);
-                               security_release_secctx(&lsmcxt);
-                       }
-               }
+               if (audit_log_object_context(ab, oblob))
+                       *call_panic = 1;
                if (context->ipc.has_perm) {
                        audit_log_end(ab);
                        ab = audit_log_start(context, GFP_KERNEL,
@@ -1415,20 +1384,8 @@ static void audit_log_name(struct audit_context *context, struct audit_names *n,
                                 from_kgid(&init_user_ns, n->gid),
                                 MAJOR(n->rdev),
                                 MINOR(n->rdev));
-       if (n->osid != 0) {
-               struct lsmblob blob;
-               struct lsmcontext lsmctx;
-
-               lsmblob_init(&blob, n->osid);
-               if (security_secid_to_secctx(&blob, &lsmctx, LSMBLOB_FIRST)) {
-                       audit_log_format(ab, " osid=%u", n->osid);
-                       if (call_panic)
-                               *call_panic = 2;
-               } else {
-                       audit_log_format(ab, " obj=%s", lsmctx.context);
-                       security_release_secctx(&lsmctx);
-               }
-       }
+       if (audit_log_object_context(ab, &n->oblob) && call_panic)
+               *call_panic = 2;
 
        /* log the audit_names record type */
        switch (n->type) {
@@ -2022,17 +1979,13 @@ static void audit_copy_inode(struct audit_names *name,
                             const struct dentry *dentry,
                             struct inode *inode, unsigned int flags)
 {
-       struct lsmblob blob;
-
        name->ino   = inode->i_ino;
        name->dev   = inode->i_sb->s_dev;
        name->mode  = inode->i_mode;
        name->uid   = inode->i_uid;
        name->gid   = inode->i_gid;
        name->rdev  = inode->i_rdev;
-       security_inode_getsecid(inode, &blob);
-       /* scaffolding until osid is updated */
-       name->osid = blob.secid[0];
+       security_inode_getsecid(inode, &name->oblob);
        if (flags & AUDIT_INODE_NOEVAL) {
                name->fcap_ver = -1;
                return;
@@ -2400,16 +2353,11 @@ void __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
 void __audit_ipc_obj(struct kern_ipc_perm *ipcp)
 {
        struct audit_context *context = audit_context();
-       struct lsmblob blob;
        context->ipc.uid = ipcp->uid;
        context->ipc.gid = ipcp->gid;
        context->ipc.mode = ipcp->mode;
        context->ipc.has_perm = 0;
-       security_ipc_getsecid(ipcp, &blob);
-       /* context->ipc.osid will be changed to a lsmblob later in
-        * the patch series. This will allow auditing of all the object
-        * labels associated with the ipc object. */
-       context->ipc.osid = lsmblob_value(&blob);
+       security_ipc_getsecid(ipcp, &context->ipc.oblob);
        context->type = AUDIT_IPC;
 }