From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eric Paris Subject: Re: [PATCH] audit: Don't spam logs with SECCOMP_KILL/RET_ERRNO by default Date: Mon, 11 Apr 2016 10:58:06 -0500 Message-ID: <1460390286.3268.36.camel@redhat.com> References: <1460348008-27076-1-git-send-email-andi@firstfloor.org> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: QUOTED-PRINTABLE Return-path: In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org To: Paul Moore , Andi Kleen Cc: linux-kernel@vger.kernel.org, Andi Kleen , linux-audit@redhat.com List-Id: linux-audit@redhat.com Just an FYI originally the idea was to follow the pattern of logging set by core dumps see kernel/auditsc.c::audit_core_dumps(). Which is gated by audit_enable but not anything else. I believe at that time the only option was kill, which meant, much like the core dumper, spam was not a likely result given the initiator is killed. I'm all for a way to shut up unsolicited audit messages, especially seccomp with errno or trap. I think it would be best to default 'KILL' to on and everything else to off. I'm no so sure a sysctl is the right way though. Enabling more forms of 'seccomp audit' should really be a part of the audit policy. (p.s. I think the action should be part of the seccomp message, as right now all we know is that Andi's message isn't KILL since the sig=3D0) -Eric On Mon, 2016-04-11 at 09:30 -0400, Paul Moore wrote: > On Mon, Apr 11, 2016 at 12:13 AM, Andi Kleen > wrote: > >=20 > > From: Andi Kleen > >=20 > > When I run chrome on my opensuse system every time I open > > a new tab the system log is spammed with: > >=20 > > audit[16857]: SECCOMP auid=3D1000 uid=3D1000 gid=3D100 ses=3D1 pid=3D= 16857 > > comm=3D"chrome" exe=3D"/opt/google/chrome/chrome" sig=3D0 arch=3Dc0= 00003e > > syscall=3D273 compat=3D0 ip=3D0x7fe27c11a444 code=3D0x50000 > >=20 > > This happens because chrome uses SECCOMP for its sandbox, > > and for some reason always reaches a SECCOMP_KILL or more likely > > SECCOMP_RET_ERRNO in the rule set. > >=20 > > The seccomp auditing was originally added by Eric with > >=20 > > =C2=A0=C2=A0=C2=A0=C2=A0commit 85e7bac33b8d5edafc4e219c7dfdb3d48e0b= 4e31 > > =C2=A0=C2=A0=C2=A0=C2=A0Author: Eric Paris > > =C2=A0=C2=A0=C2=A0=C2=A0Date:=C2=A0=C2=A0=C2=A0Tue Jan 3 14:23:05 2= 012 -0500 > >=20 > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0seccomp: audit abno= rmal end to a process due to seccomp > >=20 > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0The audit system li= kes to collect information about > > processes that end > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0abnormally (SIGSEGV= ) as this may me useful intrusion > > detection information. > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0This patch adds aud= it support to collect information when > > seccomp > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0forces a task to ex= it because of misbehavior in a similar > > way. > >=20 > > I don't have any other syscall auditing enabled, > > just the standard user space auditing used by the systemd > > and PAM userland. So basic auditing is alwas enabled, > > but no other kernel auditing. > >=20 > > Add a sysctl to enable this unconditional behavior with default > > to off. This replaces an earlier patch that simply checked > > whether syscall auditing was on, but Paul Moore preferred > > this more elaborate approach. > >=20 > > Signed-off-by: Andi Kleen > > --- > > =C2=A0Documentation/sysctl/kernel.txt |=C2=A0=C2=A09 +++++++++ > > =C2=A0include/linux/audit.h=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0|=C2=A0=C2=A04 +++- > > =C2=A0kernel/seccomp.c=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0|=C2=A0=C2=A04 ++++ > > =C2=A0kernel/sysctl.c=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0| 11 +++++++++++ > > =C2=A04 files changed, 27 insertions(+), 1 deletion(-) > Quick response as I'm traveling the next few days and > time/connectivity will be spotty ... thanks for sending an updated > patch, some initial thoughts: >=20 > * My thinking was that the sysctl knob could be a threshold value > such > that setting it to 0x00030000 would only log TRAP and KILL. > * With the sysctl tunable defaulting to no-logging there is no need > to > check for audit_enabled, further, checking for audit_enabled would > prevent logging to dmesg/syslog which I believe is valuable (you may > not). > * A bit nitpicky, but considering the possibility of logging to > dmesg/syslog when auditing is disabled, I think > "seccomp-log-threshold" or similar would be a better sysctl name. >=20 > >=20 > > diff --git a/Documentation/sysctl/kernel.txt > > b/Documentation/sysctl/kernel.txt > > index 57653a4..abc6ef9 100644 > > --- a/Documentation/sysctl/kernel.txt > > +++ b/Documentation/sysctl/kernel.txt > > @@ -21,6 +21,7 @@ show up in /proc/sys/kernel: > > =C2=A0- acct > > =C2=A0- acpi_video_flags > > =C2=A0- auto_msgmni > > +- audit_log_seccomp > > =C2=A0- bootloader_type=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0[ X86 only ] > > =C2=A0- bootloader_version=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0[ X86 only ] > > =C2=A0- callhome=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0[ S390 only ] > > @@ -129,6 +130,14 @@ upon memory add/remove or upon ipc namespace > > creation/removal. > > =C2=A0Echoing "1" into this file enabled msgmni automatic recomputi= ng. > > =C2=A0Echoing "0" turned it off. auto_msgmni default value was 1. > >=20 > > +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > > + > > +audit_log_seccomp > > + > > +When this variable is set to 1 every > > SECCOMP_KILL/SECCOMP_RET_ERRNO > > +results in an audit log. This is generally a bad idea because > > +it leads to a audit message every time Chrome opens a new tab. > > +Defaults to 0. > >=20 > > =C2=A0=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > >=20 > > diff --git a/include/linux/audit.h b/include/linux/audit.h > > index e38e3fc..c7787ba 100644 > > --- a/include/linux/audit.h > > +++ b/include/linux/audit.h > > @@ -315,9 +315,11 @@ static inline void audit_inode_child(struct > > inode *parent, > > =C2=A0} > > =C2=A0void audit_core_dumps(long signr); > >=20 > > +extern int audit_log_seccomp; > > + > > =C2=A0static inline void audit_seccomp(unsigned long syscall, long > > signr, int code) > > =C2=A0{ > > -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if (!audit_enabled) > > +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if (!audit_enabled || !a= udit_log_seccomp) > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0return; > >=20 > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0/* Force a record t= o be reported if a signal was delivered. > > */ > > diff --git a/kernel/seccomp.c b/kernel/seccomp.c > > index e1e5a35..09a8b03 100644 > > --- a/kernel/seccomp.c > > +++ b/kernel/seccomp.c > > @@ -25,6 +25,10 @@ > > =C2=A0#include > > =C2=A0#endif > >=20 > > +#ifdef CONFIG_AUDIT > > +int audit_log_seccomp __read_mostly =3D 0; > > +#endif > > + > > =C2=A0#ifdef CONFIG_SECCOMP_FILTER > > =C2=A0#include > > =C2=A0#include > > diff --git a/kernel/sysctl.c b/kernel/sysctl.c > > index 725587f..0c7611e 100644 > > --- a/kernel/sysctl.c > > +++ b/kernel/sysctl.c > > @@ -65,6 +65,7 @@ > > =C2=A0#include > > =C2=A0#include > > =C2=A0#include > > +#include > >=20 > > =C2=A0#include > > =C2=A0#include > > @@ -529,6 +530,16 @@ static struct ctl_table kern_table[] =3D { > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0.proc_handler=C2=A0=C2=A0=C2=A0=3D proc_doin= tvec, > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0}, > > =C2=A0#endif > > +#ifdef CONFIG_AUDIT > > +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0{ > > +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0.procname=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=3D "audit-log-seccomp", > > +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0.data=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=3D &audit_log_seccomp, > > +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0.maxlen=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=3D sizeof(int), > > +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0.mode=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=3D 0644, > > +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0.proc_handler=C2=A0=C2=A0=C2=A0=3D proc_dointve= c, > > +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0}, > > + > > +#endif > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0{ > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0.procname=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=3D "print-fatal-signals", > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0.data=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=3D &print_fatal_signals, > > -- > > 2.7.4 > >=20 >=20 >=20