From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: [patch 058/209] audit: rework execve audit Date: Fri, 27 Jul 2007 16:57:39 -0400 Message-ID: <200707271657.40399.sgrubb@redhat.com> References: <200707190848.l6J8mFQf023098@imap1.linux-foundation.org> <200707271613.10753.sgrubb@redhat.com> <1185569045.15205.49.camel@lappy> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1185569045.15205.49.camel@lappy> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Peter Zijlstra Cc: linux-audit@redhat.com, aaw@google.com List-Id: linux-audit@redhat.com On Friday 27 July 2007 16:44:05 Peter Zijlstra wrote: > On Fri, 2007-07-27 at 16:13 -0400, Steve Grubb wrote: > > I was testing our rawhide kernel and I'm scrolling these errors: > > How can I reproduce this? (I once figured out how to enable execve > auditing but have since forgotten) I don't know of anything special its a fully updated rawhide machine. I am not running any tests, this is at the prompt in runlevel 3. I have audit=1 as a boot parameter in grub.conf and very simple audit rules for that machine: -D -b 256 -a exit,always -S sethostname -w /etc/selinux/config which is not exotic. > And are you doing more than enabling it? Not really. > That is, does it auto-magically happen, correct...while sitting at the prompt. > > WARNING: at kernel/auditsc.c:859 audit_log_execve_info() (Not tainted) > > > > Call Trace: > > [] audit_log_exit+0x5d7/0x964 > > [] trace_hardirqs_on+0x12e/0x151 > > [] audit_syscall_exit+0x9b/0x300 > > [] syscall_trace_leave+0x2c/0x87 > > [] int_very_careful+0x3a/0x43 > > > > > From: Peter Zijlstra > > > diff -puN kernel/auditsc.c~audit-rework-execve-audit kernel/auditsc.c > > > --- a/kernel/auditsc.c~audit-rework-execve-audit > > > +++ a/kernel/auditsc.c > > > @@ -831,6 +831,55 @@ static int audit_log_pid_context(struct > > > return rc; > > > } > > > > > > +static void audit_log_execve_info(struct audit_buffer *ab, > > > + struct audit_aux_data_execve *axi) > > > +{ > > > + int i; > > > + long len, ret; > > > + const char __user *p = (const char __user *)axi->mm->arg_start; > > > + char *buf; > > > + > > > + if (axi->mm != current->mm) > > > + return; /* execve failed, no additional info */ > > > + > > > + for (i = 0; i < axi->argc; i++, p += len) { > > > + len = strnlen_user(p, MAX_ARG_PAGES*PAGE_SIZE); > > > + /* > > > + * We just created this mm, if we can't find the strings > > > + * we just copied into it something is _very_ wrong. Similar > > > + * for strings that are too long, we should not have created > > > + * any. > > > + */ > > > + if (!len || len > MAX_ARG_STRLEN) { > > > + WARN_ON(1); > > > + send_sig(SIGKILL, current, 0); > > > + } > > > > Which is right here ^^^ > > > > Any ideas? > > Not from the top of my head, like the comment suggests, its not supposed > to happen :-(. It would be interesting to know if i == 0, if so that > would suggest arg_start is fuzzed, if not something else has gone south. Is that all you want is i's value? maybe len too? The trace was awfully short. Is there a way to make it tell more about what was in the call chain? IOW, tracing back to sys_execve entry. -Steve