From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ondrej Mosnacek Subject: [RFC PATCH ghak10 v3 2/3] audit: Add functions to log time adjustments Date: Tue, 3 Jul 2018 14:44:36 +0200 Message-ID: <20180703124437.22733-3-omosnace@redhat.com> References: <20180703124437.22733-1-omosnace@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx14.extmail.prod.ext.phx2.redhat.com [10.5.110.43]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 95B32655C8 for ; Tue, 3 Jul 2018 12:45:01 +0000 (UTC) Received: from mail-wm0-f70.google.com (mail-wm0-f70.google.com [74.125.82.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 63B53308FBA5 for ; Tue, 3 Jul 2018 12:45:01 +0000 (UTC) Received: by mail-wm0-f70.google.com with SMTP id n8-v6so847705wmh.0 for ; Tue, 03 Jul 2018 05:45:01 -0700 (PDT) In-Reply-To: <20180703124437.22733-1-omosnace@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: Richard Guy Briggs List-Id: linux-audit@redhat.com This patch adds two functions to the audit interface: - audit_tk_injoffset(), which will be called whenever a timekeeping offset is injected by a syscall from userspace, - audit_ntp_adjust(), which will be called whenever an NTP internal variable is changed by a syscall from userspace. Syntax of records produced by these messages: AUDIT_TIME_INJOFFSET sec - the 'seconds' part of the offset nsec - the 'nanoseconds' part of the offset AUDIT_TIME_ADJNTPVAL type - which value was adjusted: offset - corresponding to the time_offset variable freq - corresponding to the time_freq variable status - corresponding to the time_status variable maxerr - corresponding to the time_maxerror variable esterr - corresponding to the time_esterror variable const - corresponding to the time_constant variable adjust - corresponding to the time_adjust variable tick - corresponding to the tick_usec variable tai - corresponding to the timekeeping's TAI offset old - the original value new - the new value Signed-off-by: Ondrej Mosnacek --- include/linux/audit.h | 21 +++++++++++++++++++++ kernel/auditsc.c | 15 +++++++++++++++ 2 files changed, 36 insertions(+) diff --git a/include/linux/audit.h b/include/linux/audit.h index 9334fbef7bae..0d084d4b4042 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -26,6 +26,7 @@ #include #include #include +#include #define AUDIT_INO_UNSET ((unsigned long)-1) #define AUDIT_DEV_UNSET ((dev_t)-1) @@ -356,6 +357,8 @@ extern void __audit_log_capset(const struct cred *new, const struct cred *old); extern void __audit_mmap_fd(int fd, int flags); extern void __audit_log_kern_module(char *name); extern void __audit_fanotify(unsigned int response); +extern void __audit_tk_injoffset(struct timespec64 offset); +extern void __audit_ntp_adjust(const char *type, s64 oldval, s64 newval); static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp) { @@ -458,6 +461,18 @@ static inline void audit_fanotify(unsigned int response) __audit_fanotify(response); } +static inline void audit_tk_injoffset(struct timespec64 offset) +{ + if (!audit_dummy_context()) + __audit_tk_injoffset(offset); +} + +static inline void audit_ntp_adjust(const char *type, s64 oldval, s64 newval) +{ + if (!audit_dummy_context()) + __audit_ntp_adjust(type, oldval, newval); +} + extern int audit_n_rules; extern int audit_signals; #else /* CONFIG_AUDITSYSCALL */ @@ -584,6 +599,12 @@ static inline void audit_log_kern_module(char *name) static inline void audit_fanotify(unsigned int response) { } +static inline void audit_tk_injoffset(struct timespec64 offset) +{ } + +static inline void audit_ntp_adjust(const char *type, s64 oldval, s64 newval) +{ } + static inline void audit_ptrace(struct task_struct *t) { } #define audit_n_rules 0 diff --git a/kernel/auditsc.c b/kernel/auditsc.c index d762e0b8160e..078249e7444d 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -2422,6 +2422,21 @@ void __audit_fanotify(unsigned int response) AUDIT_FANOTIFY, "resp=%u", response); } +/* We need to allocate with GFP_ATOMIC here, since these two functions will be + * called while holding the timekeeping lock: */ +void __audit_tk_injoffset(struct timespec64 offset) +{ + audit_log(audit_context(), GFP_ATOMIC, AUDIT_TIME_INJOFFSET, + "sec=%lli nsec=%li", (long long)offset.tv_sec, offset.tv_nsec); +} + +void __audit_ntp_adjust(const char *type, s64 oldval, s64 newval) +{ + audit_log(audit_context(), GFP_ATOMIC, AUDIT_TIME_ADJNTPVAL, + "type=%s old=%lli new=%lli", type, + (long long)oldval, (long long)newval); +} + static void audit_log_task(struct audit_buffer *ab) { kuid_t auid, uid; -- 2.17.1