audit: log AUDIT_TIME_* records only from rules

BugLink: https://bugs.launchpad.net/bugs/1969110
[ Upstream commit 272ceeaea355214b301530e262a0df8600bfca95 ]

AUDIT_TIME_* events are generated when there are syscall rules present
that are not related to time keeping.  This will produce noisy log
entries that could flood the logs and hide events we really care about.

Rather than immediately produce the AUDIT_TIME_* records, store the data
in the context and log it at syscall exit time respecting the filter
rules.

Note: This eats the audit_buffer, unlike any others in show_special().

Please see https://bugzilla.redhat.com/show_bug.cgi?id=1991919

Fixes: 7e8eda734d30 ("ntp: Audit NTP parameters adjustment")
Fixes: 2d87a0674bd6 ("timekeeping: Audit clock adjustments")
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
[PM: fixed style/whitespace issues]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 3a10df7315163d60bbe24356ef9049acdb162d61)
Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>

diff --git a/kernel/audit.h b/kernel/audit.h
index 3ef647b7e3944596c166ea403c54609ebf629dca..8e9b9a5edb819164de2b8f36abf7594b3bf036cb 100644 (file)
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -195,6 +195,10 @@ struct audit_context {
                struct {
                        char                    *name;
                } module;
+               struct {
+                       struct audit_ntp_data   ntp_data;
+                       struct timespec64       tk_injoffset;
+               } time;
        };
        int fds[2];
        struct audit_proctitle proctitle;

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 317030566fe8f0a8c221ef1421f6f184173853ad..d37ef7c76f35c21f7dca51ddbc9fd6139137934d 100644 (file)
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1213,6 +1213,53 @@ static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name)
                         from_kuid(&init_user_ns, name->fcap.rootid));
 }
 
+static void audit_log_time(struct audit_context *context, struct audit_buffer **ab)
+{
+       const struct audit_ntp_data *ntp = &context->time.ntp_data;
+       const struct timespec64 *tk = &context->time.tk_injoffset;
+       static const char * const ntp_name[] = {
+               "offset",
+               "freq",
+               "status",
+               "tai",
+               "tick",
+               "adjust",
+       };
+       int type;
+
+       if (context->type == AUDIT_TIME_ADJNTPVAL) {
+               for (type = 0; type < AUDIT_NTP_NVALS; type++) {
+                       if (ntp->vals[type].newval != ntp->vals[type].oldval) {
+                               if (!*ab) {
+                                       *ab = audit_log_start(context,
+                                                       GFP_KERNEL,
+                                                       AUDIT_TIME_ADJNTPVAL);
+                                       if (!*ab)
+                                               return;
+                               }
+                               audit_log_format(*ab, "op=%s old=%lli new=%lli",
+                                                ntp_name[type],
+                                                ntp->vals[type].oldval,
+                                                ntp->vals[type].newval);
+                               audit_log_end(*ab);
+                               *ab = NULL;
+                       }
+               }
+       }
+       if (tk->tv_sec != 0 || tk->tv_nsec != 0) {
+               if (!*ab) {
+                       *ab = audit_log_start(context, GFP_KERNEL,
+                                             AUDIT_TIME_INJOFFSET);
+                       if (!*ab)
+                               return;
+               }
+               audit_log_format(*ab, "sec=%lli nsec=%li",
+                                (long long)tk->tv_sec, tk->tv_nsec);
+               audit_log_end(*ab);
+               *ab = NULL;
+       }
+}
+
 static void show_special(struct audit_context *context, int *call_panic)
 {
        struct audit_buffer *ab;
@@ -1311,6 +1358,11 @@ static void show_special(struct audit_context *context, int *call_panic)
                        audit_log_format(ab, "(null)");
 
                break;
+       case AUDIT_TIME_ADJNTPVAL:
+       case AUDIT_TIME_INJOFFSET:
+               /* this call deviates from the rest, eating the buffer */
+               audit_log_time(context, &ab);
+               break;
        }
        audit_log_end(ab);
 }
@@ -2603,31 +2655,26 @@ void __audit_fanotify(unsigned int response)
 
 void __audit_tk_injoffset(struct timespec64 offset)
 {
-       audit_log(audit_context(), GFP_KERNEL, AUDIT_TIME_INJOFFSET,
-                 "sec=%lli nsec=%li",
-                 (long long)offset.tv_sec, offset.tv_nsec);
-}
-
-static void audit_log_ntp_val(const struct audit_ntp_data *ad,
-                             const char *op, enum audit_ntp_type type)
-{
-       const struct audit_ntp_val *val = &ad->vals[type];
-
-       if (val->newval == val->oldval)
-               return;
+       struct audit_context *context = audit_context();
 
-       audit_log(audit_context(), GFP_KERNEL, AUDIT_TIME_ADJNTPVAL,
-                 "op=%s old=%lli new=%lli", op, val->oldval, val->newval);
+       /* only set type if not already set by NTP */
+       if (!context->type)
+               context->type = AUDIT_TIME_INJOFFSET;
+       memcpy(&context->time.tk_injoffset, &offset, sizeof(offset));
 }
 
 void __audit_ntp_log(const struct audit_ntp_data *ad)
 {
-       audit_log_ntp_val(ad, "offset", AUDIT_NTP_OFFSET);
-       audit_log_ntp_val(ad, "freq",   AUDIT_NTP_FREQ);
-       audit_log_ntp_val(ad, "status", AUDIT_NTP_STATUS);
-       audit_log_ntp_val(ad, "tai",    AUDIT_NTP_TAI);
-       audit_log_ntp_val(ad, "tick",   AUDIT_NTP_TICK);
-       audit_log_ntp_val(ad, "adjust", AUDIT_NTP_ADJUST);
+       struct audit_context *context = audit_context();
+       int type;
+
+       for (type = 0; type < AUDIT_NTP_NVALS; type++)
+               if (ad->vals[type].newval != ad->vals[type].oldval) {
+                       /* unconditionally set type, overwriting TK */
+                       context->type = AUDIT_TIME_ADJNTPVAL;
+                       memcpy(&context->time.ntp_data, ad, sizeof(*ad));
+                       break;
+               }
 }
 
 void __audit_log_nfcfg(const char *name, u8 af, unsigned int nentries,