From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 205CCC433EF for ; Tue, 28 Jun 2022 01:10:46 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-475-SVAfp3yrOLOYuIaKSK6xyA-1; Mon, 27 Jun 2022 21:10:41 -0400 X-MC-Unique: SVAfp3yrOLOYuIaKSK6xyA-1 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.rdu2.redhat.com [10.11.54.7]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 2FD8D83397B; Tue, 28 Jun 2022 01:10:40 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (unknown [10.30.29.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id 1FB16141510C; Tue, 28 Jun 2022 01:10:40 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (localhost [IPv6:::1]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id CA875194704A; Tue, 28 Jun 2022 01:10:39 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx10.intmail.prod.int.rdu2.redhat.com [10.11.54.10]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 4E8C81947056 for ; Tue, 28 Jun 2022 01:10:39 +0000 (UTC) Received: by smtp.corp.redhat.com (Postfix) id 41FE740334D; Tue, 28 Jun 2022 01:10:39 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast05.extmail.prod.ext.rdu2.redhat.com [10.11.55.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 3D252415F5E for ; Tue, 28 Jun 2022 01:10:39 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-1.mimecast.com [207.211.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 24FEF8316FB for ; Tue, 28 Jun 2022 01:10:39 +0000 (UTC) Received: from sonic316-27.consmr.mail.ne1.yahoo.com (sonic316-27.consmr.mail.ne1.yahoo.com [66.163.187.153]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-45-0CEm6beqOuCD-iCVpyA2Ig-1; Mon, 27 Jun 2022 21:10:37 -0400 X-MC-Unique: 0CEm6beqOuCD-iCVpyA2Ig-1 X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1656378636; bh=uEFw0lf7JDnug4vhMYc7Kph0lryGz6Bk0Vc/VsEc6+Y=; h=X-Sonic-MF:From:To:Subject:Date:From:Subject; b=qERoDO1BJ/QQCck4gGee/t+Y2Np1lv3wzfW65uI1QTSFo+OVUgD+nn8zio24X1hVEX7eZo/EAtqcRFlFudRlPR7/mHmYB4LiirHGkktPRiahhQ39woXN82U0QrieAB1Snkgc6ZtEuSIYawGQhevMjtMCKoiHAdaMWd9uGPyQGNG3wpNN14LMGgA/YKtoE39w2+FR9mJq2EpTWBMHetZdi1S/YXPudAvFAD6A0+IYZSA9QebiKP8QOUMzIYItX76Rv5FOBMN/zsZ7j1EOKq6A+MfiHH7Ubz0uqKCf7VfnEyaEugWpUyqp/1WcvH+KtvNy4SByNfLONSvpbMKlBEmadg== X-YMail-OSG: DxY_U5AVM1kExmWdyB1hqH9IgrYG50hP5Psn5DEBurKVDtB2U4uhNuDEuXNFwjW ymAJBGtmpFW0c3Au.c_IuP01C0rpghYpZk4QvHW1vlVLkFNpjK.cHvaXOKNqs55O9XOgOX3mP5_K Ks60SfekHDsj5Hl1hC6rp4oWefw0f1CjKF0fPK6BpGjkq_Kgxs7SKdAV25zWmvWdcnf2FAmD2Rxy 9yBH81XP3ltOiN5jWWjNEQM04EVXE1p7R1tzO2gOTjPUahMZvGvY7fnTzG0aj3i.RQIv4sM7L7eY 8O1X9Jhs7e26BFZXAQ7dKvcHxuPYAq32Spb7Nrqry2OB8oHWDheP_MGiPfcc05SpVURFTjYFoqso _.TM9n8nfIHEmSlnKmMsOzJk1DjqDd6O1cwxpe7Z3xjm59aHdndEWMDQObiH.Vad_HPj8JzSSVs1 jMv68sKUqlKF9_AHghQWWCu6JFbk01mCOlf2739A7N9bdW8DCL3DEUi7jXzxtzwCve_SYYvH8y3r dXLwDxxI.RugiTL_3rEfaxPT3uHlhsCl8s2i4WZ31TGG6a.IUz8XfkkEEx0Cx7osU_Atmvwkf4tt sgDPPlgHHVyxyA0PiCoe5HGp.Qke9uY.I0SyysueSiWtGMNVRzlkGJHaJJ26Z9hz5dNZJ6UNZmso wpI_Ml_M2bWzfPwd5FNa_tZ0M6FVlXUfYS9aOUpgijoeXgRs8orfhv5Z8g539VU4nbJHtPX.u6z4 R6tgMhHbUDBhupvDIyK1s7lvxnbgfugTHRDEJMqtBQKHeT9rY0cbarDxOBK53nLJ6ybRb4ER1IlD bbSAxm8EEUpC6ZPpDLmWgx2lrpU8EM4V0AITYbP59PIExuUGs3ync6xH4H0h7ANoqVNhQrRNrphG 1xWk2ZZxNScNOQCG1FHA9tP_8yG4OLgGA.TC9rgQ7pdgGw5Cj2umqhutXQTcgJfuwPmfvPqalbNq TbNDr5mw9iDYnzB6JQcYcptwvRElyy1vo0EGgsOpyQxGsDTQlmNs5b6jjm4Y0v0qDY1rPaDxsSmc HdcPJd_RH.JIGUBlAPKX7.dXIvDKQo5mg8BaVkqqpFmWPq8A0nfzqG989SJGDnrJkoL_GrHo36gT ugH5._ebiACysHa028tfzsMBlfwz26IpEBUtaybJ6iTaL8PCGiyXIaGFJ5uH2yQJp8EgrhKle8CG 1GEYK8JXYzJiJ_ZKsHB4RrPLLZN0wcto9eLBeC9iyrEKggAqR3mKMXOuBKkQJ32giwSnFQzIZttg T3hv2r8ZHQZPrTDtY4dHqIku9pWaCGRuEBjemf5oZ9x9aL4AbEe2n4J.D6SZshj4_Q5fhB4b18bt dANFoYdimhKlRm_GwRAFfUvBa1lPLgFbir_8Tb06a0FiQZvOo8a3pXxYb9nqmUn9KnE1xveXTadi e0QFxXpeJHcTHAVEO3IUx5PZ9sPmMlQYlryhK.nUrWTGZuaFcPtFmAt0NSelNXNS8zBPHdIPm6jn bqag2AZVRP79MKNcA7vMQ._buIZ6N22ShOyrw2WH76u4CT9tKW_f0UIbFpzbXNDmHE1D3mC0TxXD SPjMqaXe6BBZAdwbdoV9QZ31WcVlmZZeNWgkil.BLLK745xZ514ExLTAL00D8o7GgMQ71M.vpDTl ghhgq7s85qpwpr8OdfcVDY37rLPL7idfNCI1aeZMmd25EMkhAfdHHeTC4o6wAlLWwaU2UHGp3ldf oTxHc3vvO8jK3E1dXcygcBtTDh8HS83wO4TKQmB1yT_URymI6iCrWXJVjtCXh7GwLlXSo8hGXZyk 0xZA90T6Dg.K_0nCCIvnkSZJzsR.mMsABfqXi5RbbvCUqpI.GLfYt54B62hkJSpJLVCP6gAsTEr4 gzarlQU6ng_uy0m__RiQJqswA3hWqRkiPx5S7ojQM6IKiNvpy88m1qu5H9i20GISDBOz2uNzE.m2 XfettuRkiDz41vAa0.lBZqSG4TD4IQEwjuDLVQW8AwHhkNXo3GT6kRIobdom0TNynfHGjvgv.6U4 rztDMSQhzhPdGQgoK7aZ93ddSbfEDlN_V.nPSoSzkQSxKAo2.dKhxh4GIA6xgywjF0atoST4SZOZ y16cUSA4HPeDrXvNJ4IAWVlznslVZCuj.QvTHnyvo25E43JS9Kahy41os0ayMqz3rnMswBpeE8ZC zcnPe318tflzEkQ.ZA6rG4aXuQrjG42CLDk3_yuWM7vG3AgIPenyky_tMQ_6P96jAUioIWcNi4z_ ou20RY9TaGlJGFyQvPjYjul6yhRc5e.BO_WF6ffPj8JapVbiiNHmgEC0kjH9fbVkauFs- X-Sonic-MF: Received: from sonic.gate.mail.ne1.yahoo.com by sonic316.consmr.mail.ne1.yahoo.com with HTTP; Tue, 28 Jun 2022 01:10:36 +0000 Received: by hermes--canary-production-gq1-677bd878b7-wc7mq (Yahoo Inc. Hermes SMTP Server) with ESMTPA ID e584f9a769c6d1ee8a468863bbdfebe6; Tue, 28 Jun 2022 01:10:33 +0000 (UTC) From: Casey Schaufler To: casey.schaufler@intel.com, jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Subject: [PATCH v37 23/33] Audit: Keep multiple LSM data in audit_names Date: Mon, 27 Jun 2022 17:56:01 -0700 Message-Id: <20220628005611.13106-24-casey@schaufler-ca.com> In-Reply-To: <20220628005611.13106-1-casey@schaufler-ca.com> References: <20220628005611.13106-1-casey@schaufler-ca.com> MIME-Version: 1.0 X-Mimecast-Impersonation-Protect: Policy=CLT - Impersonation Protection Definition; Similar Internal Domain=false; Similar Monitored External Domain=false; Custom External Domain=false; Mimecast External Domain=false; Newly Observed Domain=false; Internal User Name=false; Custom Display Name List=false; Reply-to Address Mismatch=false; Targeted Threat Dictionary=false; Mimecast Threat Dictionary=false; Custom Threat Dictionary=false X-Scanned-By: MIMEDefang 2.85 on 10.11.54.10 X-BeenThere: linux-audit@redhat.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Linux Audit Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: john.johansen@canonical.com, linux-kernel@vger.kernel.org, linux-audit@redhat.com Errors-To: linux-audit-bounces@redhat.com Sender: "Linux-audit" X-Scanned-By: MIMEDefang 2.85 on 10.11.54.7 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=linux-audit-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Replace the osid field in the audit_names structure with a lsmblob structure. This accommodates the use of an lsmblob in security_audit_rule_match() and security_inode_getsecid(). Signed-off-by: Casey Schaufler Acked-by: Paul Moore --- kernel/audit.h | 2 +- kernel/auditsc.c | 22 ++++++++-------------- 2 files changed, 9 insertions(+), 15 deletions(-) diff --git a/kernel/audit.h b/kernel/audit.h index 316fac62d5f7..4af63e7dde17 100644 --- a/kernel/audit.h +++ b/kernel/audit.h @@ -82,7 +82,7 @@ struct audit_names { kuid_t uid; kgid_t gid; dev_t rdev; - u32 osid; + struct lsmblob lsmblob; struct audit_cap_data fcap; unsigned int fcap_ver; unsigned char type; /* record type */ diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 318529b1f930..4f141655ac0b 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -700,17 +700,16 @@ static int audit_filter_rules(struct task_struct *tsk, * lsmblob, which happens later in * this patch set. */ - lsmblob_init(&blob, name->osid); result = security_audit_rule_match( - &blob, + &name->lsmblob, f->type, f->op, &f->lsm_rules); } else if (ctx) { list_for_each_entry(n, &ctx->names_list, list) { - lsmblob_init(&blob, n->osid); if (security_audit_rule_match( - &blob, f->type, f->op, + &n->lsmblob, + f->type, f->op, &f->lsm_rules)) { ++result; break; @@ -1589,13 +1588,12 @@ static void audit_log_name(struct audit_context *context, struct audit_names *n, from_kgid(&init_user_ns, n->gid), MAJOR(n->rdev), MINOR(n->rdev)); - if (n->osid != 0) { - struct lsmblob blob; + if (lsmblob_is_set(&n->lsmblob)) { struct lsmcontext lsmctx; - lsmblob_init(&blob, n->osid); - if (security_secid_to_secctx(&blob, &lsmctx, LSMBLOB_FIRST)) { - audit_log_format(ab, " osid=%u", n->osid); + if (security_secid_to_secctx(&n->lsmblob, &lsmctx, + LSMBLOB_FIRST)) { + audit_log_format(ab, " osid=?"); if (call_panic) *call_panic = 2; } else { @@ -2303,17 +2301,13 @@ static void audit_copy_inode(struct audit_names *name, const struct dentry *dentry, struct inode *inode, unsigned int flags) { - struct lsmblob blob; - name->ino = inode->i_ino; name->dev = inode->i_sb->s_dev; name->mode = inode->i_mode; name->uid = inode->i_uid; name->gid = inode->i_gid; name->rdev = inode->i_rdev; - security_inode_getsecid(inode, &blob); - /* scaffolding until osid is updated */ - name->osid = lsmblob_first(&blob); + security_inode_getsecid(inode, &name->lsmblob); if (flags & AUDIT_INODE_NOEVAL) { name->fcap_ver = -1; return; -- 2.36.1 -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit