[PATCH] add uid and comm to OBJ_PID records

[PATCH] add uid and comm to OBJ_PID records

[Eric Paris]

Add uid and comm collection to OBJ_PID records.  This information was
ask for by RHEL users who wanted a better idea where signals were ending
up.

Signed-off-by: Eric Paris <eparis@redhat.com>

---

#kill a program running as a different user in a different domain
type=OBJ_PID msg=audit(12/10/2007 15:36:54.328:67) : opid=3018  obj=root:system_r:httpd_t:s0-s0:c0.c1023 uid=test comm=loop 
type=SYSCALL msg=audit(12/10/2007 15:36:54.328:67) : arch=x86_64 syscall=kill success=yes exit=0 a0=bca a1=f a2=0 a3=0 items=0 ppid=2189 pid=2194 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 comm=bash exe=/bin/bash subj=root:system_r:unconfined_t:s0-s0:c0.c1023 key=(null) 

## custom program which fork() 2 children, puts them in a grp and kills the grp.
type=OBJ_PID msg=audit(12/10/2007 15:29:59.969:38) : opid=2976  obj=root:system_r:unconfined_t:s0-s0:c0.c1023 uid=root comm=tmp 
type=OBJ_PID msg=audit(12/10/2007 15:29:59.969:38) : opid=2975  obj=root:system_r:unconfined_t:s0-s0:c0.c1023 uid=root comm=tmp 
type=SYSCALL msg=audit(12/10/2007 15:29:59.969:38) : arch=x86_64 syscall=kill success=yes exit=0 a0=fffff461 a1=9 a2=0 a3=0 items=0 ppid=2194 pid=2974 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 comm=tmp exe=/tmp/tmp subj=root:system_r:unconfined_t:s0-s0:c0.c1023 key=(null)

 kernel/auditsc.c |   21 ++++++++++++++++++---
 1 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index bce9ecd..dcedbb0 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -176,7 +176,9 @@ struct audit_aux_data_fd_pair {
 struct audit_aux_data_pids {
 	struct audit_aux_data	d;
 	pid_t			target_pid[AUDIT_AUX_PIDS];
+	pid_t			target_uid[AUDIT_AUX_PIDS];
 	u32			target_sid[AUDIT_AUX_PIDS];
+	char 			target_comm[AUDIT_AUX_PIDS][TASK_COMM_LEN];
 	int			pid_count;
 };
 
@@ -215,7 +217,9 @@ struct audit_context {
 	int		    arch;
 
 	pid_t		    target_pid;
+	pid_t		    target_uid;
 	u32		    target_sid;
+	char		    target_comm[TASK_COMM_LEN];
 
 	struct audit_tree_refs *trees, *first_trees;
 	int tree_count;
@@ -922,7 +926,7 @@ static void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk
 }
 
 static int audit_log_pid_context(struct audit_context *context, pid_t pid,
-				 u32 sid)
+				 u32 sid, pid_t uid, char *comm)
 {
 	struct audit_buffer *ab;
 	char *s = NULL;
@@ -938,6 +942,8 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid,
 		rc = 1;
 	} else
 		audit_log_format(ab, "opid=%d  obj=%s", pid, s);
+	audit_log_format(ab, " uid=%d comm=", uid);
+	audit_log_untrustedstring(ab, comm);
 	audit_log_end(ab);
 	kfree(s);
 
@@ -1168,13 +1174,16 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
 
 		for (i = 0; i < axs->pid_count; i++)
 			if (audit_log_pid_context(context, axs->target_pid[i],
-						  axs->target_sid[i]))
+						  axs->target_sid[i],
+						  axs->target_uid[i],
+						  axs->target_comm[i]))
 				call_panic = 1;
 	}
 
 	if (context->target_pid &&
 	    audit_log_pid_context(context, context->target_pid,
-				  context->target_sid))
+				  context->target_sid, context->target_uid,
+				  context->target_comm))
 			call_panic = 1;
 
 	if (context->pwd && context->pwdmnt) {
@@ -2194,6 +2203,8 @@ void __audit_ptrace(struct task_struct *t)
 
 	context->target_pid = t->pid;
 	selinux_get_task_sid(t, &context->target_sid);
+	memcpy(context->target_comm, t->comm, TASK_COMM_LEN);
+	context->target_uid = t->uid;
 }
 
 /**
@@ -2231,6 +2242,8 @@ int __audit_signal_info(int sig, struct task_struct *t)
 	if (!ctx->target_pid) {
 		ctx->target_pid = t->tgid;
 		selinux_get_task_sid(t, &ctx->target_sid);
+		memcpy(ctx->target_comm, t->comm, TASK_COMM_LEN);
+		ctx->target_uid = t->uid;
 		return 0;
 	}
 
@@ -2248,6 +2261,8 @@ int __audit_signal_info(int sig, struct task_struct *t)
 
 	axp->target_pid[axp->pid_count] = t->tgid;
 	selinux_get_task_sid(t, &axp->target_sid[axp->pid_count]);
+	memcpy(axp->target_comm[axp->pid_count], t->comm, TASK_COMM_LEN);
+	axp->target_uid[axp->pid_count] = t->uid;
 	axp->pid_count++;
 
 	return 0;

Re: [PATCH] add uid and comm to OBJ_PID records

[Linda Knippers]

Eric Paris wrote:
> Add uid and comm collection to OBJ_PID records.  This information was
> ask for by RHEL users who wanted a better idea where signals were ending
> up.
> 
> Signed-off-by: Eric Paris <eparis@redhat.com>
> 
> ---
> 
> #kill a program running as a different user in a different domain 
> type=OBJ_PID msg=audit(12/10/2007 15:36:54.328:67) : opid=3018
> obj=root:system_r:httpd_t:s0-s0:c0.c1023 uid=test comm=loop

Is uid sufficient or do you need auid, gid, euid, suid, fsuid, egid,...
as well?  The subject has exe as well as comm.  Should the obj record
also have both?

-- ljk
> type=SYSCALL msg=audit(12/10/2007 15:36:54.328:67) : arch=x86_64
> syscall=kill success=yes exit=0 a0=bca a1=f a2=0 a3=0 items=0 ppid=2189
> pid=2194 auid=root uid=root gid=root euid=root suid=root fsuid=root
> egid=root sgid=root fsgid=root tty=pts0 comm=bash exe=/bin/bash
> subj=root:system_r:unconfined_t:s0-s0:c0.c1023 key=(null)
> 
> ## custom program which fork() 2 children, puts them in a grp and
kills the grp.
> type=OBJ_PID msg=audit(12/10/2007 15:29:59.969:38) : opid=2976
obj=root:system_r:unconfined_t:s0-s0:c0.c1023 uid=root comm=tmp
> type=OBJ_PID msg=audit(12/10/2007 15:29:59.969:38) : opid=2975
obj=root:system_r:unconfined_t:s0-s0:c0.c1023 uid=root comm=tmp
> type=SYSCALL msg=audit(12/10/2007 15:29:59.969:38) : arch=x86_64
syscall=kill success=yes exit=0 a0=fffff461 a1=9 a2=0 a3=0 items=0
ppid=2194 pid=2974 auid=root uid=root gid=root euid=root suid=root
fsuid=root egid=root sgid=root fsgid=root tty=pts0 comm=tmp exe=/tmp/tmp
subj=root:system_r:unconfined_t:s0-s0:c0.c1023 key=(null)

>  kernel/auditsc.c |   21 ++++++++++++++++++---
>  1 files changed, 18 insertions(+), 3 deletions(-)
> 
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index bce9ecd..dcedbb0 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -176,7 +176,9 @@ struct audit_aux_data_fd_pair {
>  struct audit_aux_data_pids {
>  	struct audit_aux_data	d;
>  	pid_t			target_pid[AUDIT_AUX_PIDS];
> +	pid_t			target_uid[AUDIT_AUX_PIDS];
>  	u32			target_sid[AUDIT_AUX_PIDS];
> +	char 			target_comm[AUDIT_AUX_PIDS][TASK_COMM_LEN];
>  	int			pid_count;
>  };
>  
> @@ -215,7 +217,9 @@ struct audit_context {
>  	int		    arch;
>  
>  	pid_t		    target_pid;
> +	pid_t		    target_uid;
>  	u32		    target_sid;
> +	char		    target_comm[TASK_COMM_LEN];
>  
>  	struct audit_tree_refs *trees, *first_trees;
>  	int tree_count;
> @@ -922,7 +926,7 @@ static void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk
>  }
>  
>  static int audit_log_pid_context(struct audit_context *context, pid_t pid,
> -				 u32 sid)
> +				 u32 sid, pid_t uid, char *comm)
>  {
>  	struct audit_buffer *ab;
>  	char *s = NULL;
> @@ -938,6 +942,8 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid,
>  		rc = 1;
>  	} else
>  		audit_log_format(ab, "opid=%d  obj=%s", pid, s);
> +	audit_log_format(ab, " uid=%d comm=", uid);
> +	audit_log_untrustedstring(ab, comm);
>  	audit_log_end(ab);
>  	kfree(s);
>  
> @@ -1168,13 +1174,16 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
>  
>  		for (i = 0; i < axs->pid_count; i++)
>  			if (audit_log_pid_context(context, axs->target_pid[i],
> -						  axs->target_sid[i]))
> +						  axs->target_sid[i],
> +						  axs->target_uid[i],
> +						  axs->target_comm[i]))
>  				call_panic = 1;
>  	}
>  
>  	if (context->target_pid &&
>  	    audit_log_pid_context(context, context->target_pid,
> -				  context->target_sid))
> +				  context->target_sid, context->target_uid,
> +				  context->target_comm))
>  			call_panic = 1;
>  
>  	if (context->pwd && context->pwdmnt) {
> @@ -2194,6 +2203,8 @@ void __audit_ptrace(struct task_struct *t)
>  
>  	context->target_pid = t->pid;
>  	selinux_get_task_sid(t, &context->target_sid);
> +	memcpy(context->target_comm, t->comm, TASK_COMM_LEN);
> +	context->target_uid = t->uid;
>  }
>  
>  /**
> @@ -2231,6 +2242,8 @@ int __audit_signal_info(int sig, struct task_struct *t)
>  	if (!ctx->target_pid) {
>  		ctx->target_pid = t->tgid;
>  		selinux_get_task_sid(t, &ctx->target_sid);
> +		memcpy(ctx->target_comm, t->comm, TASK_COMM_LEN);
> +		ctx->target_uid = t->uid;
>  		return 0;
>  	}
>  
> @@ -2248,6 +2261,8 @@ int __audit_signal_info(int sig, struct task_struct *t)
>  
>  	axp->target_pid[axp->pid_count] = t->tgid;
>  	selinux_get_task_sid(t, &axp->target_sid[axp->pid_count]);
> +	memcpy(axp->target_comm[axp->pid_count], t->comm, TASK_COMM_LEN);
> +	axp->target_uid[axp->pid_count] = t->uid;
>  	axp->pid_count++;
>  
>  	return 0;
> 
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

Re: [PATCH] add uid and comm to OBJ_PID records

[Steve Grubb]

On Monday 10 December 2007 15:23:24 Linda Knippers wrote:
> > type=OBJ_PID msg=audit(12/10/2007 15:36:54.328:67) : opid=3018
> > obj=root:system_r:httpd_t:s0-s0:c0.c1023 uid=test comm=loop
>
> Is uid sufficient or do you need auid, gid, euid, suid, fsuid, egid,...
> as well?

I don't think you need fsuid or any of the group credentials for signals. I 
also don't think euid matters for receiving signals. auid could be useful. 

People were mostly asking what process is this about, pid is generally not 
helpful. And they wanted to make sure it was legal for that process to be 
getting a signal. So, you need to see the uid.

> The subject has exe as well as comm.  Should the obj record 
> also have both?

Not 100% sure, but...I don't think we can get at it from the signal path 
without holding a lock. We are trying to get what we can without any 
complication or performance impact.

-Steve