[PATCH 0/2] add support for more fields to the exclude filter

[PATCH 0/2] add support for more fields to the exclude filter

[Richard Guy Briggs]

When support for avoiding in-band signals to indicate an unset loginuid
was added to the kernel, userspace was neglected, so add them here as a
prerequisite to enable their use in the exclude filter:
	See upstream kernel commits:
	780a7654cee8d61819512385e778e4827db4bfbc
	041d7b98ffe59c59fdd639931dea7d74f9aa9a59

The rest to support additional fields for the exclude filter is in the
second patch.

	RFE: add additional fields for use in audit filter exclude rules
	https://github.com/linux-audit/audit-kernel/issues/5

Richard Guy Briggs (2):
  add support for loginuid_set using macro AUDIT_LOGINUID_SET
  exclude filter: add support for user filter fields

 docs/auditctl.8 |    2 +-
 lib/fieldtab.h  |    2 ++
 lib/libaudit.c  |   21 ++++++++++++++++++---
 3 files changed, 21 insertions(+), 4 deletions(-)

[PATCH 1/2] add support for loginuid_set using macro AUDIT_LOGINUID_SET

[Richard Guy Briggs]

See upstream kernel commits:
	780a7654cee8d61819512385e778e4827db4bfbc
	041d7b98ffe59c59fdd639931dea7d74f9aa9a59

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
---
 lib/fieldtab.h |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/lib/fieldtab.h b/lib/fieldtab.h
index bf48c95..107157d 100644
--- a/lib/fieldtab.h
+++ b/lib/fieldtab.h
@@ -31,6 +31,8 @@ _S(AUDIT_SGID,         "sgid"         )
 _S(AUDIT_FSGID,        "fsgid"        )
 _S(AUDIT_LOGINUID,     "auid"         )
 _S(AUDIT_LOGINUID,     "loginuid"     )
+_S(AUDIT_LOGINUID_SET, "auid_set"     )
+_S(AUDIT_LOGINUID_SET, "loginuid_set" )
 _S(AUDIT_PERS,         "pers"         )
 _S(AUDIT_ARCH,         "arch"         )
 _S(AUDIT_MSGTYPE,      "msgtype"      )
-- 
1.7.1

[PATCH 2/2] exclude filter: add support for user filter fields

[Richard Guy Briggs]

RFE: add additional fields for use in audit filter exclude rules
https://github.com/linux-audit/audit-kernel/issues/5

Enable the exclude filter to additionally filter on PID, UID, GID, AUID,
LOGINUID_SET, SUBJ_*.

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
---
 docs/auditctl.8 |    2 +-
 lib/libaudit.c  |   21 ++++++++++++++++++---
 2 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/docs/auditctl.8 b/docs/auditctl.8
index ceb6c40..540ff70 100644
--- a/docs/auditctl.8
+++ b/docs/auditctl.8
@@ -76,7 +76,7 @@ Add a rule to the syscall exit list. This list is used upon exit from a system c
 Add a rule to the user message filter list. This list is used by the kernel to filter events originating in user space before relaying them to the audit daemon. It should be noted that the only fields that are valid are: uid, auid, gid, pid, subj_user, subj_role, subj_type, subj_sen, subj_clr, and msgtype. All other fields will be treated as non-matching. It should be understood that any event originating from user space from a process that has CAP_AUDIT_WRITE will be recorded into the audit trail. This means that the most likely use for this filter is with rules that have an action of never since nothing has to be done to allow events to be recorded.
 .TP
 .B exclude
-Add a rule to the event type exclusion filter list. This list is used to filter events that you do not want to see. For example, if you do not want to see any avc messages, you would using this list to record that. The message type that you do not wish to see is given with the msgtype field. 
+Add a rule to the event type exclusion filter list. This list is used to filter events that you do not want to see. For example, if you do not want to see any avc messages, you would using this list to record that.  Events can be excluded by process ID, user ID, group ID, login user ID, login user ID set, message type or subject context.
 .RE
 
 The following describes the valid \fIactions\fP for the rule:
diff --git a/lib/libaudit.c b/lib/libaudit.c
index 184bc65..cff2cd8 100644
--- a/lib/libaudit.c
+++ b/lib/libaudit.c
@@ -1393,9 +1393,24 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair,
 	if ((field = audit_name_to_field(f)) < 0) 
 		return -2;
 
-	/* Exclude filter can be used only with MSGTYPE field */
-	if (flags == AUDIT_FILTER_EXCLUDE && field != AUDIT_MSGTYPE)
-		return -12; 
+	/* Exclude filter can be used only with MSGTYPE and cred fields */
+	if (flags == AUDIT_FILTER_EXCLUDE)
+		switch(field) {
+ 			case AUDIT_PID:
+ 			case AUDIT_UID:
+ 			case AUDIT_GID:
+ 			case AUDIT_LOGINUID:
+ 			case AUDIT_LOGINUID_SET:
+ 			case AUDIT_MSGTYPE:
+ 			case AUDIT_SUBJ_USER:
+ 			case AUDIT_SUBJ_ROLE:
+ 			case AUDIT_SUBJ_TYPE:
+ 			case AUDIT_SUBJ_SEN:
+ 			case AUDIT_SUBJ_CLR:
+				break;
+			default:
+				return -12; 
+		}
 
 	rule->fields[rule->field_count] = field;
 	rule->fieldflags[rule->field_count] = op;
-- 
1.7.1