From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael C Thompson Subject: [PATCH] -v2 newrole auditing of failures due to user actions Date: Thu, 28 Sep 2006 16:04:00 -0500 Message-ID: <451C38C0.5090904@us.ibm.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="------------070503070608030801090006" Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id k8SL5VeQ014759 for ; Thu, 28 Sep 2006 17:05:31 -0400 Received: from e36.co.us.ibm.com (e36.co.us.ibm.com [32.97.110.154]) by mx1.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id k8SL5UuJ007144 for ; Thu, 28 Sep 2006 17:05:30 -0400 Received: from westrelay02.boulder.ibm.com (westrelay02.boulder.ibm.com [9.17.195.11]) by e36.co.us.ibm.com (8.13.8/8.12.11) with ESMTP id k8SL5PoS026887 for ; Thu, 28 Sep 2006 17:05:25 -0400 Received: from d03av03.boulder.ibm.com (d03av03.boulder.ibm.com [9.17.195.169]) by westrelay02.boulder.ibm.com (8.13.6/8.13.6/NCO v8.1.1) with ESMTP id k8SL47Ua482136 for ; Thu, 28 Sep 2006 15:04:07 -0600 Received: from d03av03.boulder.ibm.com (loopback [127.0.0.1]) by d03av03.boulder.ibm.com (8.12.11.20060308/8.13.3) with ESMTP id k8SL468u028396 for ; Thu, 28 Sep 2006 15:04:07 -0600 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Linux Audit , SE Linux , Stephen Smalley List-Id: linux-audit@redhat.com This is a multi-part message in MIME format. --------------070503070608030801090006 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit This patch introduces two new point in the code where audit records are generated for newrole. Both points are when the attempt to newrole fails. The first point is when the default type could not be determine for the specified role - this is audited because, as sgrubb pointed out, it is currently non-tracked path to probe the policy. The second point is when the desired context to change to is invalid. There record format remains unchanged. Failing to validate the desired context will result in the old and new contexts being recorded intact to the log. For the default type, the old and new contexts have not yet been obtained, so they are recorded in the log as XXX_context=? Changes since version 1 of the patch: * removed wrapping #ifdefs around send_audit_message() * provided a "no-op" style function * removed -D_GNU_SOURCE from the Makefile (as its defined in the code) * fixed the error path of the send_audit_message function The solution that I have for the "no-op" function is not that pretty, but the Makefile is configured with -Werror and a function which doesn't use its parameters causes warnings. Is there a better solution to this problem? Signed-off-by: Michael Thompson ---- --------------070503070608030801090006 Content-Type: text/x-diff; name="newrole_audit_fail.patch" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="newrole_audit_fail.patch" diff -rNau policycoreutils-1.30.29/newrole/Makefile policycoreutils-1.30.29.orig.dev/newrole/Makefile --- policycoreutils-1.30.29/newrole/Makefile 2006-09-14 07:07:26.000000000 -0500 +++ policycoreutils-1.30.29.orig.dev/newrole/Makefile 2006-09-28 15:47:21.000000000 -0500 @@ -27,7 +27,7 @@ LDLIBS += -laudit endif ifeq (${LOG_AUDIT_PRIV},y) - override CFLAGS += -DLOG_AUDIT_PRIV -D_GNU_SOURCE + override CFLAGS += -DLOG_AUDIT_PRIV LDLIBS += -lcap MODE := 4555 else diff -rNau policycoreutils-1.30.29/newrole/newrole.c policycoreutils-1.30.29.orig.dev/newrole/newrole.c --- policycoreutils-1.30.29/newrole/newrole.c 2006-09-14 07:07:26.000000000 -0500 +++ policycoreutils-1.30.29.orig.dev/newrole/newrole.c 2006-09-28 15:56:05.000000000 -0500 @@ -396,6 +396,48 @@ } #endif +#ifdef LOG_AUDIT_PRIV +/* Send audit message */ +static +int send_audit_message(int success, security_context_t old_context, + security_context_t new_context, const char *ttyn) +{ + char *msg = NULL; + int rc; + int audit_fd = audit_open(); + + if (audit_fd < 0) { + fprintf(stderr, _("Error connecting to audit system.\n")); + return -1; + } + if (asprintf(&msg, "newrole: old-context=%s new-context=%s", + old_context ? old_context : "?", + new_context ? new_context : "?") < 0) { + fprintf(stderr, _("Error allocating memory.\n")); + rc = -1; + goto out; + } + rc = audit_log_user_message(audit_fd, AUDIT_USER_ROLE_CHANGE, + msg, NULL, NULL, ttyn, success); + if (rc <= 0) { + fprintf(stderr, _("Error sending audit message.\n")); + rc = -1; + goto out; + } + rc = 0; +out: + free(msg); + close(audit_fd); + return rc; +} +#else +#define send_audit_message(a,b,c,d) no_op() +static inline int no_op() +{ + return 0; +} +#endif + /************************************************************************ * * All code used for both PAM and shadow passwd goes in this section. @@ -536,6 +578,7 @@ if (role_s && !type_s) { if (get_default_type(role_s, &type_s)) { fprintf(stderr, _("Couldn't get default type.\n")); + send_audit_message(0, old_context, new_context, ttyn); exit(-1); } #ifdef CANTSPELLGDB @@ -715,6 +758,7 @@ if (security_check_context(new_context) < 0) { fprintf(stderr, _("%s is not a valid context\n"), new_context); + send_audit_message(0, old_context, new_context, ttyn); exit(-1); } @@ -873,32 +917,8 @@ new_context); exit(-1); } -#ifdef LOG_AUDIT_PRIV - /* Send audit message */ - { - char *msg; - int rc; - int audit_fd = audit_open(); - if (audit_fd < 0) { - fprintf(stderr, - _("Error connecting to audit system.\n")); - exit(-1); - } - if (asprintf(&msg, "newrole: old-context=%s new-context=%s", - old_context, new_context) < 0) { - fprintf(stderr, _("Error allocating memory.\n")); - exit(-1); - } - rc = audit_log_user_message(audit_fd, AUDIT_USER_ROLE_CHANGE, - msg, NULL, NULL, ttyn, 1); - if (rc <= 0) { - fprintf(stderr, _("Error sending audit message.\n")); - exit(-1); - } - free(msg); - close(audit_fd); - } -#endif + if (send_audit_message(1, old_context, new_context, ttyn)) + exit(-1); freecon(old_context); execv(pw->pw_shell, argv + optind - 1); --------------070503070608030801090006 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --------------070503070608030801090006-- From mboxrd@z Thu Jan 1 00:00:00 1970 Message-ID: <451C38C0.5090904@us.ibm.com> Date: Thu, 28 Sep 2006 16:04:00 -0500 From: Michael C Thompson MIME-Version: 1.0 To: Linux Audit , SE Linux , Stephen Smalley Subject: [PATCH] -v2 newrole auditing of failures due to user actions Content-Type: multipart/mixed; boundary="------------070503070608030801090006" Sender: owner-selinux@tycho.nsa.gov List-Id: selinux@tycho.nsa.gov This is a multi-part message in MIME format. --------------070503070608030801090006 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit This patch introduces two new point in the code where audit records are generated for newrole. Both points are when the attempt to newrole fails. The first point is when the default type could not be determine for the specified role - this is audited because, as sgrubb pointed out, it is currently non-tracked path to probe the policy. The second point is when the desired context to change to is invalid. There record format remains unchanged. Failing to validate the desired context will result in the old and new contexts being recorded intact to the log. For the default type, the old and new contexts have not yet been obtained, so they are recorded in the log as XXX_context=? Changes since version 1 of the patch: * removed wrapping #ifdefs around send_audit_message() * provided a "no-op" style function * removed -D_GNU_SOURCE from the Makefile (as its defined in the code) * fixed the error path of the send_audit_message function The solution that I have for the "no-op" function is not that pretty, but the Makefile is configured with -Werror and a function which doesn't use its parameters causes warnings. Is there a better solution to this problem? Signed-off-by: Michael Thompson ---- --------------070503070608030801090006 Content-Type: text/x-diff; name="newrole_audit_fail.patch" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="newrole_audit_fail.patch" diff -rNau policycoreutils-1.30.29/newrole/Makefile policycoreutils-1.30.29.orig.dev/newrole/Makefile --- policycoreutils-1.30.29/newrole/Makefile 2006-09-14 07:07:26.000000000 -0500 +++ policycoreutils-1.30.29.orig.dev/newrole/Makefile 2006-09-28 15:47:21.000000000 -0500 @@ -27,7 +27,7 @@ LDLIBS += -laudit endif ifeq (${LOG_AUDIT_PRIV},y) - override CFLAGS += -DLOG_AUDIT_PRIV -D_GNU_SOURCE + override CFLAGS += -DLOG_AUDIT_PRIV LDLIBS += -lcap MODE := 4555 else diff -rNau policycoreutils-1.30.29/newrole/newrole.c policycoreutils-1.30.29.orig.dev/newrole/newrole.c --- policycoreutils-1.30.29/newrole/newrole.c 2006-09-14 07:07:26.000000000 -0500 +++ policycoreutils-1.30.29.orig.dev/newrole/newrole.c 2006-09-28 15:56:05.000000000 -0500 @@ -396,6 +396,48 @@ } #endif +#ifdef LOG_AUDIT_PRIV +/* Send audit message */ +static +int send_audit_message(int success, security_context_t old_context, + security_context_t new_context, const char *ttyn) +{ + char *msg = NULL; + int rc; + int audit_fd = audit_open(); + + if (audit_fd < 0) { + fprintf(stderr, _("Error connecting to audit system.\n")); + return -1; + } + if (asprintf(&msg, "newrole: old-context=%s new-context=%s", + old_context ? old_context : "?", + new_context ? new_context : "?") < 0) { + fprintf(stderr, _("Error allocating memory.\n")); + rc = -1; + goto out; + } + rc = audit_log_user_message(audit_fd, AUDIT_USER_ROLE_CHANGE, + msg, NULL, NULL, ttyn, success); + if (rc <= 0) { + fprintf(stderr, _("Error sending audit message.\n")); + rc = -1; + goto out; + } + rc = 0; +out: + free(msg); + close(audit_fd); + return rc; +} +#else +#define send_audit_message(a,b,c,d) no_op() +static inline int no_op() +{ + return 0; +} +#endif + /************************************************************************ * * All code used for both PAM and shadow passwd goes in this section. @@ -536,6 +578,7 @@ if (role_s && !type_s) { if (get_default_type(role_s, &type_s)) { fprintf(stderr, _("Couldn't get default type.\n")); + send_audit_message(0, old_context, new_context, ttyn); exit(-1); } #ifdef CANTSPELLGDB @@ -715,6 +758,7 @@ if (security_check_context(new_context) < 0) { fprintf(stderr, _("%s is not a valid context\n"), new_context); + send_audit_message(0, old_context, new_context, ttyn); exit(-1); } @@ -873,32 +917,8 @@ new_context); exit(-1); } -#ifdef LOG_AUDIT_PRIV - /* Send audit message */ - { - char *msg; - int rc; - int audit_fd = audit_open(); - if (audit_fd < 0) { - fprintf(stderr, - _("Error connecting to audit system.\n")); - exit(-1); - } - if (asprintf(&msg, "newrole: old-context=%s new-context=%s", - old_context, new_context) < 0) { - fprintf(stderr, _("Error allocating memory.\n")); - exit(-1); - } - rc = audit_log_user_message(audit_fd, AUDIT_USER_ROLE_CHANGE, - msg, NULL, NULL, ttyn, 1); - if (rc <= 0) { - fprintf(stderr, _("Error sending audit message.\n")); - exit(-1); - } - free(msg); - close(audit_fd); - } -#endif + if (send_audit_message(1, old_context, new_context, ttyn)) + exit(-1); freecon(old_context); execv(pw->pw_shell, argv + optind - 1); --------------070503070608030801090006-- -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.