From mboxrd@z Thu Jan 1 00:00:00 1970 From: Tyler Hicks Subject: Re: Unique audit record type ranges for individual LSMs Date: Wed, 6 Dec 2017 13:12:43 -0600 Message-ID: <2dcc6931-7b51-6bb4-e561-d8f4bdb3da99@canonical.com> References: <4491cccc-9219-f653-0c1d-f8dd6612f0f1@canonical.com> <3ea79b60-21cb-5638-304d-97bde8b12b5c@schaufler-ca.com> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="GWBnpO4JLTi3xcPilqE3KfL3Q76hwrIL2" Return-path: In-Reply-To: <3ea79b60-21cb-5638-304d-97bde8b12b5c@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org To: Casey Schaufler , linux-security-module@vger.kernel.org, Steve Grubb Cc: linux-audit@redhat.com, apparmor List-Id: linux-audit@redhat.com This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --GWBnpO4JLTi3xcPilqE3KfL3Q76hwrIL2 Content-Type: multipart/mixed; boundary="oVOhOIxBa2H0lPXEGGw0jaJ26wkTGoM9e"; protected-headers="v1" From: Tyler Hicks To: Casey Schaufler , linux-security-module@vger.kernel.org, Steve Grubb Cc: linux-audit@redhat.com, apparmor Message-ID: <2dcc6931-7b51-6bb4-e561-d8f4bdb3da99@canonical.com> Subject: Re: Unique audit record type ranges for individual LSMs References: <4491cccc-9219-f653-0c1d-f8dd6612f0f1@canonical.com> <3ea79b60-21cb-5638-304d-97bde8b12b5c@schaufler-ca.com> In-Reply-To: <3ea79b60-21cb-5638-304d-97bde8b12b5c@schaufler-ca.com> --oVOhOIxBa2H0lPXEGGw0jaJ26wkTGoM9e Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 12/06/2017 12:47 PM, Casey Schaufler wrote: > On 12/6/2017 9:51 AM, Tyler Hicks wrote: >> Hello - The AppArmor project would like for AppArmor audit records to = be >> supported by the audit-userspace tools, such as ausearch, but it >> requires some coordination between the linux-security-module and >> linux-audit lists. This was raised as a feature request years ago in >> Ubuntu and more recently in Debian: >> >> https://launchpad.net/bugs/1117804 >> https://bugs.debian.org/872726 >> >> The quick summary of the problem at hand is that the audit-userspace >> project requires that each LSM use a unique record type range for audi= t >> records while the kernel's common_lsm_audit() function uses the same >> record type (1400) for all records. SELinux, AppArmor, and SMACK are a= ll >> using common_lsm_audit() today and, therefore, the 1400-1499 range. >=20 > My, but this is a rat's nest, isn't it? The constants, such as AUDIT_MA= C_STATUS, > look as if they are intended to be generic. But the comment says the ra= nge is > for SELinux. Some of the events, including AUDIT_MAC_MAP_ADD *are* gene= ric, in > that they are from the netlbl subsystem. But some, AUDIT_AVC being para= mount, > are indeed SELinux specific. It is a rat's nest, which is why the Ubuntu bug above has lingered for so long. Good point regarding AUDIT_MAC_MAP_ADD being generic. >=20 >> While it will be potentially painful to switch, the AppArmor project i= s >> considering to use a unique range in order for audit-userspace to >> support AppArmor audit records. IMHO, SMACK would be free to continue >> using 1400-1499 as long as they don't need audit-userspace support and= >> SELinux would continue using 1400-1499. >=20 > Aside from the comment that says 1400-1499 are for SELinux, and the thr= ee > events (1400-1402) that are SELinux specific, the events really are gen= eral. > Why not add the AppArmor specifics to the 1400 range? Give them a gener= ic > sounding name and you'll achieve consistency. Change the comment to say= > "Security Module use" instead of "SELinux use". I would be alright with this solution. We could even claim 1400-1599 or even 1400-1699 for "Security Module use" if we thought 100 record types may not be enough in the future. I could see how there may be a desire for each LSM to have their own blocks of 100 where they can assign record types freely without coordination with LSM maintainers but I don't feel like new record types come around often enough for this to matter much. >=20 >> Steve Grubb previously told me that he intends 1500-1599 to be used by= >> AppArmor: >> >> https://www.redhat.com/archives/linux-audit/2014-May/msg00119.html >> >> >> John Johansen tells me that AppArmor previously used the 1500-1599 ran= ge >> before AppArmor was upstreamed. >> >> There's a conflicting comment in the kernel stating that 1500-1599 is = to >> by used by kernel LSPP events. As far as I can tell, there were never >> any kernel LSPP events that used the range. Steve is the one that adde= d >> that comment so I think it is a safe range for AppArmor to use: >> >> https://git.kernel.org/linus/90d526c074ae5db484388da56c399acf892b6c1= 7 >> >> Considering audit-userspace's stance, does the LSM community agree tha= t >> common_lsm_audit() should be modified to accept an audit record type >> parameter to pass on to audit_log_start()? >> >> If so, does everyone agree that 1500-1599 would be acceptable for >> AppArmor to use? >=20 > Why not change the comment and continue to use the 1400 range, adding > events as necessary? I don't have any problems with that but I'd like Steve Grubb to weigh in on it. Tyler --oVOhOIxBa2H0lPXEGGw0jaJ26wkTGoM9e-- --GWBnpO4JLTi3xcPilqE3KfL3Q76hwrIL2 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJaKEErAAoJENaSAD2qAscKzZAP/RXPuEmW9x+rujtoO3CPu38v 1CEgCj0GY/5vXg/n4fPbOlrH5/NdvUvmWf2ytRmQJUjKugE2ksOd+S0u2d/hi+Mc FwoxN5QZpa6a0uBXRSwi17u7XUWgkhGNOUU4BbDJS8VHYqynsBTxkT5FcbWRtCKz 3mIbybxBXiFZ5HQsajACQNpgo0U6tjg/gY+c5sBuL3FR/LMPChFgSg0MFAnOkECL B4jQqaH+Nx5QeE4d9KDzKr1bo4hDAc9wghv2AyiFqRjCg+om2AUFevj7Fr/jnp5v ydc9OKrePfPkgBAys8PfODjAuE2HBaKFe3BQ8XZJW4Fmek2bqxnlgE86BahoW+yk Nrk8i47/A3K2S7xDZoiwZydMMi01l5D178EkqfK+CaHxTEcGdNJhiOX3eVtGd77X vHjMP6ZmvZRrjU/rxSkYnC0QXK18YZSZMGNfxPLy7Y69p745RN1Ro+Va+XZuxZH3 dLoVmobHA8sPwe5mI3BfpGEwTewt0wn0DKCzjWhYVFT/35bm6rJxDKLg4YueWJNa 5QtlVvIs8OyyA3kjvkLPqXp1e5FetF7g1FdN/qgI7XbStP4FqkgKHQOZkZ/yxT0C js6xYc5mZ7Huw3IFUj58QVSnb8wMZ58HyVQb24wGNIovbOia0/VKrqRw6wra1Tvb Du5bwnXrOs4B8jj6364f =8o17 -----END PGP SIGNATURE----- --GWBnpO4JLTi3xcPilqE3KfL3Q76hwrIL2--