Re: [PATCH] add uid and comm to OBJ_PID records

[Linda Knippers <linda.knippers@hp.com>]

Eric Paris wrote:
> Add uid and comm collection to OBJ_PID records.  This information was
> ask for by RHEL users who wanted a better idea where signals were ending
> up.
> 
> Signed-off-by: Eric Paris <eparis@redhat.com>
> 
> ---
> 
> #kill a program running as a different user in a different domain 
> type=OBJ_PID msg=audit(12/10/2007 15:36:54.328:67) : opid=3018
> obj=root:system_r:httpd_t:s0-s0:c0.c1023 uid=test comm=loop

Is uid sufficient or do you need auid, gid, euid, suid, fsuid, egid,...
as well?  The subject has exe as well as comm.  Should the obj record
also have both?

-- ljk
> type=SYSCALL msg=audit(12/10/2007 15:36:54.328:67) : arch=x86_64
> syscall=kill success=yes exit=0 a0=bca a1=f a2=0 a3=0 items=0 ppid=2189
> pid=2194 auid=root uid=root gid=root euid=root suid=root fsuid=root
> egid=root sgid=root fsgid=root tty=pts0 comm=bash exe=/bin/bash
> subj=root:system_r:unconfined_t:s0-s0:c0.c1023 key=(null)
> 
> ## custom program which fork() 2 children, puts them in a grp and
kills the grp.
> type=OBJ_PID msg=audit(12/10/2007 15:29:59.969:38) : opid=2976
obj=root:system_r:unconfined_t:s0-s0:c0.c1023 uid=root comm=tmp
> type=OBJ_PID msg=audit(12/10/2007 15:29:59.969:38) : opid=2975
obj=root:system_r:unconfined_t:s0-s0:c0.c1023 uid=root comm=tmp
> type=SYSCALL msg=audit(12/10/2007 15:29:59.969:38) : arch=x86_64
syscall=kill success=yes exit=0 a0=fffff461 a1=9 a2=0 a3=0 items=0
ppid=2194 pid=2974 auid=root uid=root gid=root euid=root suid=root
fsuid=root egid=root sgid=root fsgid=root tty=pts0 comm=tmp exe=/tmp/tmp
subj=root:system_r:unconfined_t:s0-s0:c0.c1023 key=(null)

>  kernel/auditsc.c |   21 ++++++++++++++++++---
>  1 files changed, 18 insertions(+), 3 deletions(-)
> 
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index bce9ecd..dcedbb0 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -176,7 +176,9 @@ struct audit_aux_data_fd_pair {
>  struct audit_aux_data_pids {
>  	struct audit_aux_data	d;
>  	pid_t			target_pid[AUDIT_AUX_PIDS];
> +	pid_t			target_uid[AUDIT_AUX_PIDS];
>  	u32			target_sid[AUDIT_AUX_PIDS];
> +	char 			target_comm[AUDIT_AUX_PIDS][TASK_COMM_LEN];
>  	int			pid_count;
>  };
>  
> @@ -215,7 +217,9 @@ struct audit_context {
>  	int		    arch;
>  
>  	pid_t		    target_pid;
> +	pid_t		    target_uid;
>  	u32		    target_sid;
> +	char		    target_comm[TASK_COMM_LEN];
>  
>  	struct audit_tree_refs *trees, *first_trees;
>  	int tree_count;
> @@ -922,7 +926,7 @@ static void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk
>  }
>  
>  static int audit_log_pid_context(struct audit_context *context, pid_t pid,
> -				 u32 sid)
> +				 u32 sid, pid_t uid, char *comm)
>  {
>  	struct audit_buffer *ab;
>  	char *s = NULL;
> @@ -938,6 +942,8 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid,
>  		rc = 1;
>  	} else
>  		audit_log_format(ab, "opid=%d  obj=%s", pid, s);
> +	audit_log_format(ab, " uid=%d comm=", uid);
> +	audit_log_untrustedstring(ab, comm);
>  	audit_log_end(ab);
>  	kfree(s);
>  
> @@ -1168,13 +1174,16 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
>  
>  		for (i = 0; i < axs->pid_count; i++)
>  			if (audit_log_pid_context(context, axs->target_pid[i],
> -						  axs->target_sid[i]))
> +						  axs->target_sid[i],
> +						  axs->target_uid[i],
> +						  axs->target_comm[i]))
>  				call_panic = 1;
>  	}
>  
>  	if (context->target_pid &&
>  	    audit_log_pid_context(context, context->target_pid,
> -				  context->target_sid))
> +				  context->target_sid, context->target_uid,
> +				  context->target_comm))
>  			call_panic = 1;
>  
>  	if (context->pwd && context->pwdmnt) {
> @@ -2194,6 +2203,8 @@ void __audit_ptrace(struct task_struct *t)
>  
>  	context->target_pid = t->pid;
>  	selinux_get_task_sid(t, &context->target_sid);
> +	memcpy(context->target_comm, t->comm, TASK_COMM_LEN);
> +	context->target_uid = t->uid;
>  }
>  
>  /**
> @@ -2231,6 +2242,8 @@ int __audit_signal_info(int sig, struct task_struct *t)
>  	if (!ctx->target_pid) {
>  		ctx->target_pid = t->tgid;
>  		selinux_get_task_sid(t, &ctx->target_sid);
> +		memcpy(ctx->target_comm, t->comm, TASK_COMM_LEN);
> +		ctx->target_uid = t->uid;
>  		return 0;
>  	}
>  
> @@ -2248,6 +2261,8 @@ int __audit_signal_info(int sig, struct task_struct *t)
>  
>  	axp->target_pid[axp->pid_count] = t->tgid;
>  	selinux_get_task_sid(t, &axp->target_sid[axp->pid_count]);
> +	memcpy(axp->target_comm[axp->pid_count], t->comm, TASK_COMM_LEN);
> +	axp->target_uid[axp->pid_count] = t->uid;
>  	axp->pid_count++;
>  
>  	return 0;
> 
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit