Skip to content

Commit 2532386

Browse files
eparisAl Viro
eparis
authored and
Al Viro
committed
Audit: collect sessionid in netlink messages
Previously I added sessionid output to all audit messages where it was available but we still didn't know the sessionid of the sender of netlink messages. This patch adds that information to netlink messages so we can audit who sent netlink messages. Signed-off-by: Eric Paris <eparis@redhat.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
1 parent 436c405 commit 2532386

17 files changed

+132
-87
lines changed

‎drivers/char/tty_audit.c

+1-6
Original file line numberDiff line numberDiff line change
@@ -151,14 +151,9 @@ void tty_audit_fork(struct signal_struct *sig)
151151
/**
152152
* tty_audit_push_task - Flush task's pending audit data
153153
*/
154-
void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid)
154+
void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid, u32 sessionid)
155155
{
156156
struct tty_audit_buf *buf;
157-
/* FIXME I think this is correct. Check against netlink once that is
158-
* I really need to read this code more closely. But that's for
159-
* another patch.
160-
*/
161-
unsigned int sessionid = audit_get_sessionid(tsk);
162157

163158
spin_lock_irq(&tsk->sighand->siglock);
164159
buf = tsk->signal->tty_audit_buf;

‎include/linux/audit.h

+2-1
Original file line numberDiff line numberDiff line change
@@ -569,7 +569,8 @@ extern int audit_update_lsm_rules(void);
569569
extern int audit_filter_user(struct netlink_skb_parms *cb, int type);
570570
extern int audit_filter_type(int type);
571571
extern int audit_receive_filter(int type, int pid, int uid, int seq,
572-
void *data, size_t datasz, uid_t loginuid, u32 sid);
572+
void *data, size_t datasz, uid_t loginuid,
573+
u32 sessionid, u32 sid);
573574
extern int audit_enabled;
574575
#else
575576
#define audit_log(c,g,t,f,...) do { ; } while (0)

‎include/linux/netlink.h

+1
Original file line numberDiff line numberDiff line change
@@ -166,6 +166,7 @@ struct netlink_skb_parms
166166
__u32 dst_group;
167167
kernel_cap_t eff_cap;
168168
__u32 loginuid; /* Login (audit) uid */
169+
__u32 sessionid; /* Session id (audit) */
169170
__u32 sid; /* SELinux security id */
170171
};
171172

‎include/linux/tty.h

+2-2
Original file line numberDiff line numberDiff line change
@@ -351,7 +351,7 @@ extern void tty_audit_add_data(struct tty_struct *tty, unsigned char *data,
351351
extern void tty_audit_exit(void);
352352
extern void tty_audit_fork(struct signal_struct *sig);
353353
extern void tty_audit_push(struct tty_struct *tty);
354-
extern void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid);
354+
extern void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid, u32 sessionid);
355355
extern void tty_audit_opening(void);
356356
#else
357357
static inline void tty_audit_add_data(struct tty_struct *tty,
@@ -367,7 +367,7 @@ static inline void tty_audit_fork(struct signal_struct *sig)
367367
static inline void tty_audit_push(struct tty_struct *tty)
368368
{
369369
}
370-
static inline void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid)
370+
static inline void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid, u32 sessionid)
371371
{
372372
}
373373
static inline void tty_audit_opening(void)

‎include/net/netlabel.h

+1
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,7 @@ struct cipso_v4_doi;
103103
struct netlbl_audit {
104104
u32 secid;
105105
uid_t loginuid;
106+
u32 sessionid;
106107
};
107108

108109
/*

‎include/net/xfrm.h

+12-11
Original file line numberDiff line numberDiff line change
@@ -597,8 +597,9 @@ struct xfrm_spi_skb_cb {
597597
/* Audit Information */
598598
struct xfrm_audit
599599
{
600-
u32 loginuid;
601600
u32 secid;
601+
uid_t loginuid;
602+
u32 sessionid;
602603
};
603604

604605
#ifdef CONFIG_AUDITSYSCALL
@@ -616,13 +617,13 @@ static inline struct audit_buffer *xfrm_audit_start(const char *op)
616617
return audit_buf;
617618
}
618619

619-
static inline void xfrm_audit_helper_usrinfo(u32 auid, u32 secid,
620+
static inline void xfrm_audit_helper_usrinfo(uid_t auid, u32 ses, u32 secid,
620621
struct audit_buffer *audit_buf)
621622
{
622623
char *secctx;
623624
u32 secctx_len;
624625

625-
audit_log_format(audit_buf, " auid=%u", auid);
626+
audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses);
626627
if (secid != 0 &&
627628
security_secid_to_secctx(secid, &secctx, &secctx_len) == 0) {
628629
audit_log_format(audit_buf, " subj=%s", secctx);
@@ -632,13 +633,13 @@ static inline void xfrm_audit_helper_usrinfo(u32 auid, u32 secid,
632633
}
633634

634635
extern void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
635-
u32 auid, u32 secid);
636+
u32 auid, u32 ses, u32 secid);
636637
extern void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
637-
u32 auid, u32 secid);
638+
u32 auid, u32 ses, u32 secid);
638639
extern void xfrm_audit_state_add(struct xfrm_state *x, int result,
639-
u32 auid, u32 secid);
640+
u32 auid, u32 ses, u32 secid);
640641
extern void xfrm_audit_state_delete(struct xfrm_state *x, int result,
641-
u32 auid, u32 secid);
642+
u32 auid, u32 ses, u32 secid);
642643
extern void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
643644
struct sk_buff *skb);
644645
extern void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family);
@@ -647,10 +648,10 @@ extern void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
647648
extern void xfrm_audit_state_icvfail(struct xfrm_state *x,
648649
struct sk_buff *skb, u8 proto);
649650
#else
650-
#define xfrm_audit_policy_add(x, r, a, s) do { ; } while (0)
651-
#define xfrm_audit_policy_delete(x, r, a, s) do { ; } while (0)
652-
#define xfrm_audit_state_add(x, r, a, s) do { ; } while (0)
653-
#define xfrm_audit_state_delete(x, r, a, s) do { ; } while (0)
651+
#define xfrm_audit_policy_add(x, r, a, se, s) do { ; } while (0)
652+
#define xfrm_audit_policy_delete(x, r, a, se, s) do { ; } while (0)
653+
#define xfrm_audit_state_add(x, r, a, se, s) do { ; } while (0)
654+
#define xfrm_audit_state_delete(x, r, a, se, s) do { ; } while (0)
654655
#define xfrm_audit_state_replay_overflow(x, s) do { ; } while (0)
655656
#define xfrm_audit_state_notfound_simple(s, f) do { ; } while (0)
656657
#define xfrm_audit_state_notfound(s, f, sp, sq) do { ; } while (0)

‎kernel/audit.c

+40-32
Original file line numberDiff line numberDiff line change
@@ -252,14 +252,15 @@ void audit_log_lost(const char *message)
252252
}
253253

254254
static int audit_log_config_change(char *function_name, int new, int old,
255-
uid_t loginuid, u32 sid, int allow_changes)
255+
uid_t loginuid, u32 sessionid, u32 sid,
256+
int allow_changes)
256257
{
257258
struct audit_buffer *ab;
258259
int rc = 0;
259260

260261
ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
261-
audit_log_format(ab, "%s=%d old=%d by auid=%u", function_name, new,
262-
old, loginuid);
262+
audit_log_format(ab, "%s=%d old=%d auid=%u ses=%u", function_name, new,
263+
old, loginuid, sessionid);
263264
if (sid) {
264265
char *ctx = NULL;
265266
u32 len;
@@ -279,7 +280,8 @@ static int audit_log_config_change(char *function_name, int new, int old,
279280
}
280281

281282
static int audit_do_config_change(char *function_name, int *to_change,
282-
int new, uid_t loginuid, u32 sid)
283+
int new, uid_t loginuid, u32 sessionid,
284+
u32 sid)
283285
{
284286
int allow_changes, rc = 0, old = *to_change;
285287

@@ -290,8 +292,8 @@ static int audit_do_config_change(char *function_name, int *to_change,
290292
allow_changes = 1;
291293

292294
if (audit_enabled != AUDIT_OFF) {
293-
rc = audit_log_config_change(function_name, new, old,
294-
loginuid, sid, allow_changes);
295+
rc = audit_log_config_change(function_name, new, old, loginuid,
296+
sessionid, sid, allow_changes);
295297
if (rc)
296298
allow_changes = 0;
297299
}
@@ -305,42 +307,44 @@ static int audit_do_config_change(char *function_name, int *to_change,
305307
return rc;
306308
}
307309

308-
static int audit_set_rate_limit(int limit, uid_t loginuid, u32 sid)
310+
static int audit_set_rate_limit(int limit, uid_t loginuid, u32 sessionid,
311+
u32 sid)
309312
{
310313
return audit_do_config_change("audit_rate_limit", &audit_rate_limit,
311-
limit, loginuid, sid);
314+
limit, loginuid, sessionid, sid);
312315
}
313316

314-
static int audit_set_backlog_limit(int limit, uid_t loginuid, u32 sid)
317+
static int audit_set_backlog_limit(int limit, uid_t loginuid, u32 sessionid,
318+
u32 sid)
315319
{
316320
return audit_do_config_change("audit_backlog_limit", &audit_backlog_limit,
317-
limit, loginuid, sid);
321+
limit, loginuid, sessionid, sid);
318322
}
319323

320-
static int audit_set_enabled(int state, uid_t loginuid, u32 sid)
324+
static int audit_set_enabled(int state, uid_t loginuid, u32 sessionid, u32 sid)
321325
{
322326
int rc;
323327
if (state < AUDIT_OFF || state > AUDIT_LOCKED)
324328
return -EINVAL;
325329

326330
rc = audit_do_config_change("audit_enabled", &audit_enabled, state,
327-
loginuid, sid);
331+
loginuid, sessionid, sid);
328332

329333
if (!rc)
330334
audit_ever_enabled |= !!state;
331335

332336
return rc;
333337
}
334338

335-
static int audit_set_failure(int state, uid_t loginuid, u32 sid)
339+
static int audit_set_failure(int state, uid_t loginuid, u32 sessionid, u32 sid)
336340
{
337341
if (state != AUDIT_FAIL_SILENT
338342
&& state != AUDIT_FAIL_PRINTK
339343
&& state != AUDIT_FAIL_PANIC)
340344
return -EINVAL;
341345

342346
return audit_do_config_change("audit_failure", &audit_failure, state,
343-
loginuid, sid);
347+
loginuid, sessionid, sid);
344348
}
345349

346350
static int kauditd_thread(void *dummy)
@@ -385,7 +389,7 @@ static int kauditd_thread(void *dummy)
385389
return 0;
386390
}
387391

388-
static int audit_prepare_user_tty(pid_t pid, uid_t loginuid)
392+
static int audit_prepare_user_tty(pid_t pid, uid_t loginuid, u32 sessionid)
389393
{
390394
struct task_struct *tsk;
391395
int err;
@@ -404,7 +408,7 @@ static int audit_prepare_user_tty(pid_t pid, uid_t loginuid)
404408
if (err)
405409
goto out;
406410

407-
tty_audit_push_task(tsk, loginuid);
411+
tty_audit_push_task(tsk, loginuid, sessionid);
408412
out:
409413
read_unlock(&tasklist_lock);
410414
return err;
@@ -534,7 +538,8 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
534538
}
535539

536540
static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type,
537-
u32 pid, u32 uid, uid_t auid, u32 sid)
541+
u32 pid, u32 uid, uid_t auid, u32 ses,
542+
u32 sid)
538543
{
539544
int rc = 0;
540545
char *ctx = NULL;
@@ -546,8 +551,8 @@ static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type,
546551
}
547552

548553
*ab = audit_log_start(NULL, GFP_KERNEL, msg_type);
549-
audit_log_format(*ab, "user pid=%d uid=%u auid=%u",
550-
pid, uid, auid);
554+
audit_log_format(*ab, "user pid=%d uid=%u auid=%u ses=%u",
555+
pid, uid, auid, ses);
551556
if (sid) {
552557
rc = security_secid_to_secctx(sid, &ctx, &len);
553558
if (rc)
@@ -570,6 +575,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
570575
struct audit_buffer *ab;
571576
u16 msg_type = nlh->nlmsg_type;
572577
uid_t loginuid; /* loginuid of sender */
578+
u32 sessionid;
573579
struct audit_sig_info *sig_data;
574580
char *ctx = NULL;
575581
u32 len;
@@ -591,6 +597,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
591597
pid = NETLINK_CREDS(skb)->pid;
592598
uid = NETLINK_CREDS(skb)->uid;
593599
loginuid = NETLINK_CB(skb).loginuid;
600+
sessionid = NETLINK_CB(skb).sessionid;
594601
sid = NETLINK_CB(skb).sid;
595602
seq = nlh->nlmsg_seq;
596603
data = NLMSG_DATA(nlh);
@@ -613,12 +620,12 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
613620
status_get = (struct audit_status *)data;
614621
if (status_get->mask & AUDIT_STATUS_ENABLED) {
615622
err = audit_set_enabled(status_get->enabled,
616-
loginuid, sid);
623+
loginuid, sessionid, sid);
617624
if (err < 0) return err;
618625
}
619626
if (status_get->mask & AUDIT_STATUS_FAILURE) {
620627
err = audit_set_failure(status_get->failure,
621-
loginuid, sid);
628+
loginuid, sessionid, sid);
622629
if (err < 0) return err;
623630
}
624631
if (status_get->mask & AUDIT_STATUS_PID) {
@@ -627,17 +634,17 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
627634
if (audit_enabled != AUDIT_OFF)
628635
audit_log_config_change("audit_pid", new_pid,
629636
audit_pid, loginuid,
630-
sid, 1);
637+
sessionid, sid, 1);
631638

632639
audit_pid = new_pid;
633640
audit_nlk_pid = NETLINK_CB(skb).pid;
634641
}
635642
if (status_get->mask & AUDIT_STATUS_RATE_LIMIT)
636643
err = audit_set_rate_limit(status_get->rate_limit,
637-
loginuid, sid);
644+
loginuid, sessionid, sid);
638645
if (status_get->mask & AUDIT_STATUS_BACKLOG_LIMIT)
639646
err = audit_set_backlog_limit(status_get->backlog_limit,
640-
loginuid, sid);
647+
loginuid, sessionid, sid);
641648
break;
642649
case AUDIT_USER:
643650
case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
@@ -649,12 +656,13 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
649656
if (err == 1) {
650657
err = 0;
651658
if (msg_type == AUDIT_USER_TTY) {
652-
err = audit_prepare_user_tty(pid, loginuid);
659+
err = audit_prepare_user_tty(pid, loginuid,
660+
sessionid);
653661
if (err)
654662
break;
655663
}
656664
audit_log_common_recv_msg(&ab, msg_type, pid, uid,
657-
loginuid, sid);
665+
loginuid, sessionid, sid);
658666

659667
if (msg_type != AUDIT_USER_TTY)
660668
audit_log_format(ab, " msg='%.1024s'",
@@ -677,7 +685,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
677685
return -EINVAL;
678686
if (audit_enabled == AUDIT_LOCKED) {
679687
audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid,
680-
uid, loginuid, sid);
688+
uid, loginuid, sessionid, sid);
681689

682690
audit_log_format(ab, " audit_enabled=%d res=0",
683691
audit_enabled);
@@ -688,15 +696,15 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
688696
case AUDIT_LIST:
689697
err = audit_receive_filter(nlh->nlmsg_type, NETLINK_CB(skb).pid,
690698
uid, seq, data, nlmsg_len(nlh),
691-
loginuid, sid);
699+
loginuid, sessionid, sid);
692700
break;
693701
case AUDIT_ADD_RULE:
694702
case AUDIT_DEL_RULE:
695703
if (nlmsg_len(nlh) < sizeof(struct audit_rule_data))
696704
return -EINVAL;
697705
if (audit_enabled == AUDIT_LOCKED) {
698706
audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid,
699-
uid, loginuid, sid);
707+
uid, loginuid, sessionid, sid);
700708

701709
audit_log_format(ab, " audit_enabled=%d res=0",
702710
audit_enabled);
@@ -707,13 +715,13 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
707715
case AUDIT_LIST_RULES:
708716
err = audit_receive_filter(nlh->nlmsg_type, NETLINK_CB(skb).pid,
709717
uid, seq, data, nlmsg_len(nlh),
710-
loginuid, sid);
718+
loginuid, sessionid, sid);
711719
break;
712720
case AUDIT_TRIM:
713721
audit_trim_trees();
714722

715723
audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid,
716-
uid, loginuid, sid);
724+
uid, loginuid, sessionid, sid);
717725

718726
audit_log_format(ab, " op=trim res=1");
719727
audit_log_end(ab);
@@ -745,7 +753,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
745753
err = audit_tag_tree(old, new);
746754

747755
audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid,
748-
uid, loginuid, sid);
756+
uid, loginuid, sessionid, sid);
749757

750758
audit_log_format(ab, " op=make_equiv old=");
751759
audit_log_untrustedstring(ab, old);

0 commit comments

Comments
 (0)