* Re: [Fwd: [PATCH][RFC] SMACK : add logging support V1] [not found] <49B3AB1A.8040201@numericable.fr> @ 2009-03-28 5:24 ` Casey Schaufler 2009-03-30 14:20 ` Eric Paris 0 siblings, 1 reply; 5+ messages in thread From: Casey Schaufler @ 2009-03-28 5:24 UTC (permalink / raw) To: etienne; +Cc: linux-audit etienne wrote: > Hi, > > could you have a look at this patch from the audit point of view? > > thanks, > Etienne > > > > > Hello, > > the following patch, against current 2.6.29-rc7, add logging of smack decisions. > This is of course very useful to understand what your current smack policy does. > It borrows a lot from selinux; > > It introduces a '/smack/logging' switch : > 0: no logging > 1: log denied (default) > 2: log accepted > 3: log denied&accepted > > > example of logs produced : > > type=1400 audit(1236429348.858:5655879): SMACK[smack_task_kill]: denied pid=6521 comm="bash" subject:'toto' object:'_' requested:w pid=5757 comm="knetworkmanager" > type=1400 audit(1236429361.477:5655882): SMACK[smk_curacc_shm]: denied pid=6533 comm="ipcrm" subject:'toto' object:'_' requested:rw key=491521 > type=1400 audit(1236429392.389:5655885): SMACK[smack_sb_mount]: denied pid=6536 comm="mount" subject:'toto' object:'_' requested:w path="/debug" dev=sda5 ino=16161 > type=1400 audit(1236429485.009:5655890): SMACK[smack_ptrace_may_access]: denied pid=6539 comm="strace" subject:'toto' object:'_' requested:rw pid=5634 comm="python" > type=1400 audit(1236429527.693:5655893): SMACK[smack_inode_getattr]: denied pid=6544 comm="ls" subject:'toto' object:'etienne' requested:r path="/home/etienne/linux" dev=sda8 ino=2342913 > type=1400 audit(1236429741.006:6006665): SMACK[smack_socket_sendmsg]: granted pid=6580 comm="ping" subject:'toto' object:'@' requested:w daddr=192.168.0.10 > type=1400 audit(1236429741.006:6006666): SMACK[smack_socket_sock_rcv_skb]: granted pid=6580 comm="ping" subject:'@' object:'toto' requested:w saddr=192.168.0.10 daddr=192.168.0.10 netif=lo > > > > Signed-off-by: <etienne.basset@numericable.fr> > Acked-by: Casey Schaufler <casey@schaufler-ca.com> > --- > Documentation/Smack.txt | 12 + > security/smack/Kconfig | 2 +- > security/smack/Makefile | 2 +- > security/smack/smack_logging.c | 460 ++++++++++++++++++++++++++++++++++++++++ > security/smack/smack_logging.h | 97 +++++++++ > security/smack/smack_lsm.c | 356 +++++++++++++++++++++++-------- > security/smack/smackfs.c | 52 +++++ > 7 files changed, 892 insertions(+), 89 deletions(-) > --- > diff --git a/Documentation/Smack.txt b/Documentation/Smack.txt > index 989c2fc..81a6921 100644 > --- a/Documentation/Smack.txt > +++ b/Documentation/Smack.txt > @@ -491,3 +491,15 @@ Smack supports some mount options: > > These mount options apply to all file system types. > > +Smack logging support > + > +Smack supports logging of security accesses. It will log by default all denied > +requests. The interface to change this behavior is /smack/logging, where you > +can write the logging level you desire : > +0: no logging > +1: log denied (default) > +2: log accepted > +3: log denied&accepted > + > +Note that due to the rate-limit of audit messages, logging accepted request will > +drop a lot of messages. > diff --git a/security/smack/Kconfig b/security/smack/Kconfig > index 603b087..d83e708 100644 > --- a/security/smack/Kconfig > +++ b/security/smack/Kconfig > @@ -1,6 +1,6 @@ > config SECURITY_SMACK > bool "Simplified Mandatory Access Control Kernel Support" > - depends on NETLABEL && SECURITY_NETWORK > + depends on NETLABEL && SECURITY_NETWORK && AUDIT > default n > help > This selects the Simplified Mandatory Access Control Kernel. > diff --git a/security/smack/Makefile b/security/smack/Makefile > index 67a63aa..b562fba 100644 > --- a/security/smack/Makefile > +++ b/security/smack/Makefile > @@ -4,4 +4,4 @@ > > obj-$(CONFIG_SECURITY_SMACK) := smack.o > > -smack-y := smack_lsm.o smack_access.o smackfs.o > +smack-y := smack_lsm.o smack_access.o smackfs.o smack_logging.o > diff --git a/security/smack/smack_logging.c b/security/smack/smack_logging.c > new file mode 100644 > index 0000000..1ff81c0 > --- /dev/null > +++ b/security/smack/smack_logging.c > @@ -0,0 +1,460 @@ > +/* > + * Smack logging > + * > + * heavily inspired by security/selinux/avc.c > + * > + * All credits to : Stephen Smalley, <sds@epoch.ncsc.mil> > + * James Morris <jmorris@redhat.com> > + * Author : Etienne Basset, <etienne.basset@ensta.org> > + * > + * This program is free software; you can redistribute it and/or modify > + * it under the terms of the GNU General Public License version 2, > + * as published by the Free Software Foundation. > + */ > +#include <linux/types.h> > +#include <linux/stddef.h> > +#include <linux/kernel.h> > +#include <linux/fs.h> > +#include <linux/init.h> > +#include <net/sock.h> > +#include <linux/un.h> > +#include <net/af_unix.h> > +#include <linux/audit.h> > +#include <linux/ipv6.h> > +#include <linux/ip.h> > +#include <net/ip.h> > +#include <net/ipv6.h> > +#include <linux/tcp.h> > +#include <linux/udp.h> > +#include <linux/dccp.h> > +#include <linux/sctp.h> > +#include "smack.h" > +#include "smack_logging.h" > + > +/* what do we log > + * can be overwrite at run-time by /smack/logging > + */ > +struct smack_log_policy log_policy = { > + .log_accepted = 0, > + .log_denied = 1 > +}; > + > + > + > +/** > + * ipv4_skb_to_auditdata : fill smack_auditdata from skb > + * @skb : the skb > + * @ad : the audit data to fill > + * @proto : the layer 4 protocol > + * > + * return 0 on success > + */ > +int ipv4_skb_to_auditdata(struct sk_buff *skb, > + struct smack_audit_data *ad, u8 *proto) > +{ > + int ret = 0; > + struct iphdr *ih; > + > + ih = ip_hdr(skb); > + if (ih == NULL) > + return -EINVAL; > + > + ad->u.net.v4info.saddr = ih->saddr; > + ad->u.net.v4info.daddr = ih->daddr; > + > + if (proto) > + *proto = ih->protocol; > + /* non initial fragment */ > + if (ntohs(ih->frag_off) & IP_OFFSET) > + return 0; > + > + switch (ih->protocol) { > + case IPPROTO_TCP: { > + struct tcphdr *th = tcp_hdr(skb); > + if (th == NULL) > + break; > + > + ad->u.net.sport = th->source; > + ad->u.net.dport = th->dest; > + break; > + } > + case IPPROTO_UDP: { > + struct udphdr *uh = udp_hdr(skb); > + if (uh == NULL) > + break; > + > + ad->u.net.sport = uh->source; > + ad->u.net.dport = uh->dest; > + break; > + } > + case IPPROTO_DCCP: { > + struct dccp_hdr *dh = dccp_hdr(skb); > + if (dh == NULL) > + break; > + > + ad->u.net.sport = dh->dccph_sport; > + ad->u.net.dport = dh->dccph_dport; > + break; > + } > + case IPPROTO_SCTP: { > + struct sctphdr *sh = sctp_hdr(skb); > + if (sh == NULL) > + break; > + ad->u.net.sport = sh->source; > + ad->u.net.dport = sh->dest; > + break; > + } > + default: > + ret = -EINVAL; > + } > + return ret; > +} > +#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) > +/** > + * ipv6_skb_to_auditdata : fill smack_auditdata from skb > + * @skb : the skb > + * @ad : the audit data to fill > + * @proto : the layer 4 protocol > + * > + * return 0 on success > + */ > +int ipv6_skb_to_auditdata(struct sk_buff *skb, > + struct smack_audit_data *ad, u8 *proto) > +{ > + int offset, ret = 0; > + struct ipv6hdr *ip6; > + u8 nexthdr; > + > + ip6 = ipv6_hdr(skb); > + if (ip6 == NULL) > + return -EINVAL; > + ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr); > + ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr); > + ret = 0; > + /* IPv6 can have several extension header before the Transport header > + * skip them */ > + offset = skb_network_offset(skb); > + offset += sizeof(*ip6); > + nexthdr = ip6->nexthdr; > + offset = ipv6_skip_exthdr(skb, offset, &nexthdr); > + if (offset < 0) > + return 0; > + if (proto) > + *proto = nexthdr; > + switch (nexthdr) { > + case IPPROTO_TCP: { > + struct tcphdr _tcph, *th; > + > + th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph); > + if (th == NULL) > + break; > + > + ad->u.net.sport = th->source; > + ad->u.net.dport = th->dest; > + break; > + } > + case IPPROTO_UDP: { > + struct udphdr _udph, *uh; > + > + uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph); > + if (uh == NULL) > + break; > + > + ad->u.net.sport = uh->source; > + ad->u.net.dport = uh->dest; > + break; > + } > + case IPPROTO_DCCP: { > + struct dccp_hdr _dccph, *dh; > + > + dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph); > + if (dh == NULL) > + break; > + > + ad->u.net.sport = dh->dccph_sport; > + ad->u.net.dport = dh->dccph_dport; > + break; > + } > + case IPPROTO_SCTP: { > + struct sctphdr _sctph, *sh; > + > + sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph); > + if (sh == NULL) > + break; > + ad->u.net.sport = sh->source; > + ad->u.net.dport = sh->dest; > + break; > + } > + default: > + ret = -EINVAL; > + } > + return ret; > +} > +#endif > + > + > +static inline void avc_print_ipv6_addr(struct audit_buffer *ab, > + struct in6_addr *addr, __be16 port, > + char *name1, char *name2) > +{ > + if (!ipv6_addr_any(addr)) > + audit_log_format(ab, " %s=%pI6", name1, addr); > + if (port) > + audit_log_format(ab, " %s=%d", name2, ntohs(port)); > +} > + > +static inline void avc_print_ipv4_addr(struct audit_buffer *ab, __be32 addr, > + __be16 port, char *name1, char *name2) > +{ > + if (addr) > + audit_log_format(ab, " %s=%pI4", name1, &addr); > + if (port) > + audit_log_format(ab, " %s=%d", name2, ntohs(port)); > +} > +/** > + * smack_str_from_perm : helper to transalate an int to a > + * readable string > + * @string : the string to fill > + * @access : the int > + * > + */ > +static inline void smack_str_from_perm(char *string, int access) > +{ > + int i = 0; > + if (access & MAY_READ) > + string[i++] = 'r'; > + if (access & MAY_WRITE) > + string[i++] = 'w'; > + if (access & MAY_EXEC) > + string[i++] = 'x'; > + if (access & MAY_APPEND) > + string[i++] = 'a'; > + string[i] = '\0'; > +} > + > + > +/** > + * smack_log - Audit the granting or denial of permissions. > + * @subject_label : smack label of the requester > + * @object_label : smack label of the object being accessed > + * @request: requested permissions > + * @result: result from smk_access > + * @a: auxiliary audit data > + * > + * Audit the granting or denial of permissions in accordance > + * with the policy. > + */ > +void smack_log(char *subject_label, char *object_label, int request, > + int result, struct smack_audit_data *a) > +{ > + struct task_struct *tsk = current; > + struct inode *inode = NULL; > + struct audit_buffer *ab; > + char request_buffer[5]; > + u32 denied; > + u32 audited = 0; > + > + /* check if we have to log the current event */ > + if (result != 0) { > + denied = 1; > + if (log_policy.log_denied) > + audited = 1; > + } else { > + denied = 0; > + if (log_policy.log_accepted) > + audited = 1; > + } > + if (audited == 0) > + return; > + > + /* we use GFP_ATOMIC so we won't sleep */ > + ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_AVC); > + if (!ab) > + return; > + audit_log_format(ab, "SMACK[%s]: %s ", a->function, denied ? "denied" : "granted"); > + > + if (a && a->tsk) > + tsk = a->tsk; > + if (tsk && tsk->pid) { > + audit_log_format(ab, " pid=%d comm=", tsk->pid); > + audit_log_untrustedstring(ab, tsk->comm); > + } > + smack_str_from_perm(request_buffer, request); > + audit_log_format(ab, " subject:'%s' object:'%s' requested:%s ", > + subject_label, object_label, request_buffer); > + > + if (a==NULL) > + goto audit_log_end; > + > + switch (a->type) { > + case AVC_AUDIT_DATA_IPC: > + audit_log_format(ab, "key=%d ", a->u.ipc_id); > + break; > + case AVC_AUDIT_DATA_CAP: > + audit_log_format(ab, "capability=%d ", a->u.cap); > + break; > + case AVC_AUDIT_DATA_FS: > + if (a->u.fs.path.dentry) { > + struct dentry *dentry = a->u.fs.path.dentry; > + if (a->u.fs.path.mnt) { > + audit_log_d_path(ab, "path=", &a->u.fs.path); > + } else { > + audit_log_format(ab, "name="); > + audit_log_untrustedstring(ab, dentry->d_name.name); > + } > + inode = dentry->d_inode; > + } else if (a->u.fs.inode) { > + struct dentry *dentry; > + inode = a->u.fs.inode; > + dentry = d_find_alias(inode); > + if (dentry) { > + audit_log_format(ab, "name="); > + audit_log_untrustedstring(ab, dentry->d_name.name); > + dput(dentry); > + } > + } > + if (inode) > + audit_log_format(ab, " dev=%s ino=%lu", > + inode->i_sb->s_id, > + inode->i_ino); > + break; > + case AVC_AUDIT_DATA_TASK: > + tsk = a->u.tsk; > + if (tsk && tsk->pid) { > + audit_log_format(ab, "pid=%d comm=", tsk->pid); > + audit_log_untrustedstring(ab, tsk->comm); > + } > + break; > + case AVC_AUDIT_DATA_NET: > + if (a->u.net.sk) { > + struct sock *sk = a->u.net.sk; > + struct unix_sock *u; > + int len = 0; > + char *p = NULL; > + > + switch (sk->sk_family) { > + case AF_INET: { > + struct inet_sock *inet = inet_sk(sk); > + > + avc_print_ipv4_addr(ab, inet->rcv_saddr, > + inet->sport, > + "laddr", "lport"); > + avc_print_ipv4_addr(ab, inet->daddr, > + inet->dport, > + "faddr", "fport"); > + break; > + } > + case AF_INET6: { > + struct inet_sock *inet = inet_sk(sk); > + struct ipv6_pinfo *inet6 = inet6_sk(sk); > + > + avc_print_ipv6_addr(ab, &inet6->rcv_saddr, > + inet->sport, > + "laddr", "lport"); > + avc_print_ipv6_addr(ab, &inet6->daddr, > + inet->dport, > + "faddr", "fport"); > + break; > + } > + case AF_UNIX: > + u = unix_sk(sk); > + if (u->dentry) { > + struct path path = { > + .dentry = u->dentry, > + .mnt = u->mnt > + }; > + audit_log_d_path(ab, "path=", > + &path); > + break; > + } > + if (!u->addr) > + break; > + len = u->addr->len-sizeof(short); > + p = &u->addr->name->sun_path[0]; > + audit_log_format(ab, " path="); > + if (*p) > + audit_log_untrustedstring(ab, p); > + else > + audit_log_n_hex(ab, p, len); > + break; > + } > + } > + > + switch (a->u.net.family) { > + case AF_INET: > + avc_print_ipv4_addr(ab, a->u.net.v4info.saddr, > + a->u.net.sport, > + "saddr", ":"); > + avc_print_ipv4_addr(ab, a->u.net.v4info.daddr, > + a->u.net.dport, > + "daddr", ":"); > + break; > + case AF_INET6: > + avc_print_ipv6_addr(ab, &a->u.net.v6info.saddr, > + a->u.net.sport, > + "saddr", ":"); > + avc_print_ipv6_addr(ab, &a->u.net.v6info.daddr, > + a->u.net.dport, > + "daddr", ":"); > + break; > + } > + if (a->u.net.netif > 0) { > + struct net_device *dev; > + > + /* NOTE: we always use init's namespace */ > + dev = dev_get_by_index(&init_net, > + a->u.net.netif); > + if (dev) { > + audit_log_format(ab, " netif=%s", > + dev->name); > + dev_put(dev); > + } > + } > + break; > +#ifdef CONFIG_KEYS > + case AVC_AUDIT_DATA_KEY: > + audit_log_format(ab, " key serial=%u", a->u.key); > + if (a->u.key_desc) > + audit_log_format(ab, " key desc=%s", a->u.key_desc); > + break; > +#endif > + } /* switch (a->type) */ > + > +audit_log_end: > + audit_log_end(ab); > +} > + > +/** > + * smk_curracc_log : check access of current on olabel > + * @olabel : label being accessed > + * @access : access requested > + * @a : pointer to data > + * > + * return the same perm return by smk_curacc > + */ > +int smk_curacc_log(char *olabel, int access, struct smack_audit_data *a) > +{ > + int rc; > + rc = smk_curacc(olabel, access); > + smack_log(current_security(), olabel, access, rc, a); > + return rc; > +} > + > +/** > + * smk_access_log : check access of slabel on olabel > + * @slabel : subjet label > + * @olabel : label being accessed > + * @access : access requested > + * @a : pointer to data > + * > + * return the same perm return by smk_access > + */ > +int smk_access_log(char *slabel, char *olabel, int access, > + struct smack_audit_data *a) > +{ > + int rc; > + rc = smk_access(slabel, olabel, access); > + smack_log(slabel, olabel, access, rc, a); > + return rc; > +} > + > diff --git a/security/smack/smack_logging.h b/security/smack/smack_logging.h > new file mode 100644 > index 0000000..1a01574 > --- /dev/null > +++ b/security/smack/smack_logging.h > @@ -0,0 +1,97 @@ > +/* > + * Smack logging function > + * Heavily borrowed from selinux/avc.h > + * > + * Author : Etienne BASSET <etienne.basset@ensta.org> > + * > + * All credits to : Stephen Smalley, <sds@epoch.ncsc.mil> > + * All BUGS to : Etienne BASSET <etienne.basset@ensta.org> > + */ > +#ifndef _SMACK_LOGGING_ > +#define _SMACK_LOGGING_ > + > +#include <linux/stddef.h> > +#include <linux/errno.h> > +#include <linux/kernel.h> > +#include <linux/kdev_t.h> > +#include <linux/spinlock.h> > +#include <linux/init.h> > +#include <linux/audit.h> > +#include <linux/in6.h> > +#include <linux/path.h> > +#include <asm/system.h> > +#include <linux/key.h> > + > + > +struct smack_log_policy { > + int log_accepted; > + int log_denied; > +}; > +extern struct smack_log_policy log_policy; > + > + > +/* Auxiliary data to use in generating the audit record. */ > +struct smack_audit_data { > + char type; > +#define AVC_AUDIT_DATA_FS 1 > +#define AVC_AUDIT_DATA_NET 2 > +#define AVC_AUDIT_DATA_CAP 3 > +#define AVC_AUDIT_DATA_IPC 4 > +#define AVC_AUDIT_DATA_TASK 5 > +#define AVC_AUDIT_DATA_KEY 6 > + struct task_struct *tsk; > + union { > + struct { > + struct path path; > + struct inode *inode; > + } fs; > + struct { > + int netif; > + struct sock *sk; > + u16 family; > + __be16 dport; > + __be16 sport; > + union { > + struct { > + __be32 daddr; > + __be32 saddr; > + } v4; > + struct { > + struct in6_addr daddr; > + struct in6_addr saddr; > + } v6; > + } fam; > + } net; > + int cap; > + int ipc_id; > + struct task_struct *tsk; > +#ifdef CONFIG_KEYS > + key_serial_t key; > + char *key_desc; > +#endif > + } u; > + const char *function; > +}; > + > +#define v4info fam.v4 > +#define v6info fam.v6 > + > +int ipv4_skb_to_auditdata(struct sk_buff *skb, > + struct smack_audit_data *ad, u8 *proto); > + > +int ipv6_skb_to_auditdata(struct sk_buff *skb, > + struct smack_audit_data *ad, u8 *proto); > + > +/* Initialize an AVC audit data structure. */ > +#define SMACK_AUDIT_DATA_INIT(_d, _t) \ > + { memset((_d), 0, sizeof(struct smack_audit_data)); (_d)->type = AVC_AUDIT_DATA_##_t; (_d)->function = __func__; } > + > +void smack_log(char *subject_label, char *object_label, > + int request, > + int result, struct smack_audit_data *auditdata); > + > +int smk_access_log(char *subjectlabel, char *olabel, int access, > + struct smack_audit_data *a); > +int smk_curacc_log(char *olabel, int access, struct smack_audit_data *a); > + > +#endif > diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c > index 0278bc0..6e7af4e 100644 > --- a/security/smack/smack_lsm.c > +++ b/security/smack/smack_lsm.c > @@ -29,6 +29,7 @@ > #include <linux/audit.h> > > #include "smack.h" > +#include "smack_logging.h" > > #define task_security(task) (task_cred_xxx((task), security)) > > @@ -99,14 +100,20 @@ struct inode_smack *new_inode_smack(char *smack) > static int smack_ptrace_may_access(struct task_struct *ctp, unsigned int mode) > { > int rc; > + struct smack_audit_data ad; > > rc = cap_ptrace_may_access(ctp, mode); > if (rc != 0) > return rc; > > + SMACK_AUDIT_DATA_INIT(&ad, TASK); > + ad.u.tsk = ctp; > + /* we won't log here, because rc can be overriden */ > rc = smk_access(current_security(), task_security(ctp), MAY_READWRITE); > if (rc != 0 && capable(CAP_MAC_OVERRIDE)) > - return 0; > + rc = 0; > + > + smack_log(current_security(), task_security(ctp), MAY_READWRITE, rc, &ad); > return rc; > } > > @@ -121,14 +128,20 @@ static int smack_ptrace_may_access(struct task_struct *ctp, unsigned int mode) > static int smack_ptrace_traceme(struct task_struct *ptp) > { > int rc; > - > + struct smack_audit_data ad; > rc = cap_ptrace_traceme(ptp); > if (rc != 0) > return rc; > > + SMACK_AUDIT_DATA_INIT(&ad, TASK); > + ad.u.tsk = ptp; > + > + /* we won't log here, because rc can be overriden */ > rc = smk_access(task_security(ptp), current_security(), MAY_READWRITE); > if (rc != 0 && has_capability(ptp, CAP_MAC_OVERRIDE)) > - return 0; > + rc = 0; > + > + smack_log(task_security(ptp), current_security(), MAY_READWRITE, rc, &ad); > return rc; > } > > @@ -324,8 +337,14 @@ static int smack_sb_kern_mount(struct super_block *sb, int flags, void *data) > static int smack_sb_statfs(struct dentry *dentry) > { > struct superblock_smack *sbp = dentry->d_sb->s_security; > + struct smack_audit_data ad; > + int rc; > + > + SMACK_AUDIT_DATA_INIT(&ad, FS); > + ad.u.fs.path.dentry = dentry; > > - return smk_curacc(sbp->smk_floor, MAY_READ); > + rc = smk_curacc_log(sbp->smk_floor, MAY_READ, &ad); > + return rc; > } > > /** > @@ -343,8 +362,12 @@ static int smack_sb_mount(char *dev_name, struct path *path, > char *type, unsigned long flags, void *data) > { > struct superblock_smack *sbp = path->mnt->mnt_sb->s_security; > + struct smack_audit_data ad; > > - return smk_curacc(sbp->smk_floor, MAY_WRITE); > + SMACK_AUDIT_DATA_INIT(&ad, FS); > + ad.u.fs.path.dentry = path->dentry; > + ad.u.fs.path.mnt = path->mnt; > + return smk_curacc_log(sbp->smk_floor, MAY_WRITE, &ad); > } > > /** > @@ -358,10 +381,14 @@ static int smack_sb_mount(char *dev_name, struct path *path, > static int smack_sb_umount(struct vfsmount *mnt, int flags) > { > struct superblock_smack *sbp; > + struct smack_audit_data ad; > > sbp = mnt->mnt_sb->s_security; > + SMACK_AUDIT_DATA_INIT(&ad, FS); > + ad.u.fs.path.dentry = mnt->mnt_mountpoint; > + ad.u.fs.path.mnt = mnt; > > - return smk_curacc(sbp->smk_floor, MAY_WRITE); > + return smk_curacc_log(sbp->smk_floor, MAY_WRITE, &ad); > } > > /* > @@ -438,15 +465,20 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir, > static int smack_inode_link(struct dentry *old_dentry, struct inode *dir, > struct dentry *new_dentry) > { > - int rc; > char *isp; > + struct smack_audit_data ad; > + int rc; > + > + SMACK_AUDIT_DATA_INIT(&ad, FS); > + ad.u.fs.path.dentry = old_dentry; > > isp = smk_of_inode(old_dentry->d_inode); > - rc = smk_curacc(isp, MAY_WRITE); > + rc = smk_curacc_log(isp, MAY_WRITE, &ad); > > if (rc == 0 && new_dentry->d_inode != NULL) { > isp = smk_of_inode(new_dentry->d_inode); > - rc = smk_curacc(isp, MAY_WRITE); > + ad.u.fs.path.dentry = new_dentry; > + rc = smk_curacc_log(isp, MAY_WRITE, &ad); > } > > return rc; > @@ -463,18 +495,24 @@ static int smack_inode_link(struct dentry *old_dentry, struct inode *dir, > static int smack_inode_unlink(struct inode *dir, struct dentry *dentry) > { > struct inode *ip = dentry->d_inode; > + struct smack_audit_data ad; > int rc; > > + SMACK_AUDIT_DATA_INIT(&ad, FS); > + ad.u.fs.path.dentry = dentry; > + > /* > * You need write access to the thing you're unlinking > */ > - rc = smk_curacc(smk_of_inode(ip), MAY_WRITE); > - if (rc == 0) > + rc = smk_curacc_log(smk_of_inode(ip), MAY_WRITE, &ad); > + if (rc == 0) { > /* > * You also need write access to the containing directory > */ > - rc = smk_curacc(smk_of_inode(dir), MAY_WRITE); > - > + ad.u.fs.path.dentry = NULL; > + ad.u.fs.inode = dir; > + rc = smk_curacc_log(smk_of_inode(dir), MAY_WRITE, &ad); > + } > return rc; > } > > @@ -488,17 +526,24 @@ static int smack_inode_unlink(struct inode *dir, struct dentry *dentry) > */ > static int smack_inode_rmdir(struct inode *dir, struct dentry *dentry) > { > + struct smack_audit_data ad; > int rc; > > + SMACK_AUDIT_DATA_INIT(&ad, FS); > + ad.u.fs.path.dentry = dentry; > + > /* > * You need write access to the thing you're removing > */ > - rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE); > - if (rc == 0) > + rc = smk_curacc_log(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad); > + if (rc == 0) { > /* > * You also need write access to the containing directory > */ > - rc = smk_curacc(smk_of_inode(dir), MAY_WRITE); > + ad.u.fs.path.dentry = NULL; > + ad.u.fs.inode = dir; > + rc = smk_curacc_log(smk_of_inode(dir), MAY_WRITE, &ad); > + } > > return rc; > } > @@ -522,15 +567,19 @@ static int smack_inode_rename(struct inode *old_inode, > { > int rc; > char *isp; > + struct smack_audit_data ad; > + > + SMACK_AUDIT_DATA_INIT(&ad, FS); > + ad.u.fs.path.dentry = old_dentry; > > isp = smk_of_inode(old_dentry->d_inode); > - rc = smk_curacc(isp, MAY_READWRITE); > + rc = smk_curacc_log(isp, MAY_READWRITE, &ad); > > if (rc == 0 && new_dentry->d_inode != NULL) { > isp = smk_of_inode(new_dentry->d_inode); > - rc = smk_curacc(isp, MAY_READWRITE); > + ad.u.fs.path.dentry = new_dentry; > + rc = smk_curacc_log(isp, MAY_READWRITE, &ad); > } > - > return rc; > } > > @@ -546,14 +595,16 @@ static int smack_inode_rename(struct inode *old_inode, > */ > static int smack_inode_permission(struct inode *inode, int mask) > { > + struct smack_audit_data ad; > /* > * No permission to check. Existence test. Yup, it's there. > */ > if (mask == 0) > return 0; > - > - return smk_curacc(smk_of_inode(inode), mask); > -} > + SMACK_AUDIT_DATA_INIT(&ad, FS); > + ad.u.fs.inode = inode; > + return smk_curacc_log(smk_of_inode(inode), mask, &ad); > + } > > /** > * smack_inode_setattr - Smack check for setting attributes > @@ -564,13 +615,15 @@ static int smack_inode_permission(struct inode *inode, int mask) > */ > static int smack_inode_setattr(struct dentry *dentry, struct iattr *iattr) > { > + struct smack_audit_data ad; > /* > * Need to allow for clearing the setuid bit. > */ > if (iattr->ia_valid & ATTR_FORCE) > return 0; > - > - return smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE); > + SMACK_AUDIT_DATA_INIT(&ad, FS); > + ad.u.fs.path.dentry = dentry; > + return smk_curacc_log(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad); > } > > /** > @@ -582,7 +635,12 @@ static int smack_inode_setattr(struct dentry *dentry, struct iattr *iattr) > */ > static int smack_inode_getattr(struct vfsmount *mnt, struct dentry *dentry) > { > - return smk_curacc(smk_of_inode(dentry->d_inode), MAY_READ); > + struct smack_audit_data ad; > + > + SMACK_AUDIT_DATA_INIT(&ad, FS); > + ad.u.fs.path.dentry = dentry; > + ad.u.fs.path.mnt = mnt; > + return smk_curacc_log(smk_of_inode(dentry->d_inode), MAY_READ, &ad); > } > > /** > @@ -600,6 +658,7 @@ static int smack_inode_getattr(struct vfsmount *mnt, struct dentry *dentry) > static int smack_inode_setxattr(struct dentry *dentry, const char *name, > const void *value, size_t size, int flags) > { > + struct smack_audit_data ad; > int rc = 0; > > if (strcmp(name, XATTR_NAME_SMACK) == 0 || > @@ -610,8 +669,10 @@ static int smack_inode_setxattr(struct dentry *dentry, const char *name, > } else > rc = cap_inode_setxattr(dentry, name, value, size, flags); > > + SMACK_AUDIT_DATA_INIT(&ad, FS); > + ad.u.fs.path.dentry = dentry; > if (rc == 0) > - rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE); > + rc = smk_curacc_log(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad); > > return rc; > } > @@ -666,7 +727,11 @@ static void smack_inode_post_setxattr(struct dentry *dentry, const char *name, > */ > static int smack_inode_getxattr(struct dentry *dentry, const char *name) > { > - return smk_curacc(smk_of_inode(dentry->d_inode), MAY_READ); > + struct smack_audit_data ad; > + > + SMACK_AUDIT_DATA_INIT(&ad, FS); > + ad.u.fs.path.dentry = dentry; > + return smk_curacc_log(smk_of_inode(dentry->d_inode), MAY_READ, &ad); > } > > /* > @@ -680,6 +745,7 @@ static int smack_inode_getxattr(struct dentry *dentry, const char *name) > */ > static int smack_inode_removexattr(struct dentry *dentry, const char *name) > { > + struct smack_audit_data ad; > int rc = 0; > > if (strcmp(name, XATTR_NAME_SMACK) == 0 || > @@ -690,8 +756,10 @@ static int smack_inode_removexattr(struct dentry *dentry, const char *name) > } else > rc = cap_inode_removexattr(dentry, name); > > + SMACK_AUDIT_DATA_INIT(&ad, FS); > + ad.u.fs.path.dentry = dentry; > if (rc == 0) > - rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE); > + rc = smk_curacc_log(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad); > > return rc; > } > @@ -851,12 +919,16 @@ static int smack_file_ioctl(struct file *file, unsigned int cmd, > unsigned long arg) > { > int rc = 0; > + struct smack_audit_data ad; > + > + SMACK_AUDIT_DATA_INIT(&ad, FS); > + ad.u.fs.path = file->f_path; > > if (_IOC_DIR(cmd) & _IOC_WRITE) > - rc = smk_curacc(file->f_security, MAY_WRITE); > + rc = smk_curacc_log(file->f_security, MAY_WRITE, &ad); > > if (rc == 0 && (_IOC_DIR(cmd) & _IOC_READ)) > - rc = smk_curacc(file->f_security, MAY_READ); > + rc = smk_curacc_log(file->f_security, MAY_READ, &ad); > > return rc; > } > @@ -870,7 +942,11 @@ static int smack_file_ioctl(struct file *file, unsigned int cmd, > */ > static int smack_file_lock(struct file *file, unsigned int cmd) > { > - return smk_curacc(file->f_security, MAY_WRITE); > + struct smack_audit_data ad; > + > + SMACK_AUDIT_DATA_INIT(&ad, FS); > + ad.u.fs.path.dentry = file->f_path.dentry; > + return smk_curacc_log(file->f_security, MAY_WRITE, &ad); > } > > /** > @@ -884,8 +960,12 @@ static int smack_file_lock(struct file *file, unsigned int cmd) > static int smack_file_fcntl(struct file *file, unsigned int cmd, > unsigned long arg) > { > + struct smack_audit_data ad; > int rc; > > + SMACK_AUDIT_DATA_INIT(&ad, FS); > + ad.u.fs.path = file->f_path; > + > switch (cmd) { > case F_DUPFD: > case F_GETFD: > @@ -893,7 +973,7 @@ static int smack_file_fcntl(struct file *file, unsigned int cmd, > case F_GETLK: > case F_GETOWN: > case F_GETSIG: > - rc = smk_curacc(file->f_security, MAY_READ); > + rc = smk_curacc_log(file->f_security, MAY_READ, &ad); > break; > case F_SETFD: > case F_SETFL: > @@ -901,10 +981,10 @@ static int smack_file_fcntl(struct file *file, unsigned int cmd, > case F_SETLKW: > case F_SETOWN: > case F_SETSIG: > - rc = smk_curacc(file->f_security, MAY_WRITE); > + rc = smk_curacc_log(file->f_security, MAY_WRITE, &ad); > break; > default: > - rc = smk_curacc(file->f_security, MAY_READWRITE); > + rc = smk_curacc_log(file->f_security, MAY_READWRITE, &ad); > } > > return rc; > @@ -939,14 +1019,20 @@ static int smack_file_send_sigiotask(struct task_struct *tsk, > { > struct file *file; > int rc; > + struct smack_audit_data ad; > > /* > * struct fown_struct is never outside the context of a struct file > */ > file = container_of(fown, struct file, f_owner); > + /* we don't log here as rc can be overriden */ > rc = smk_access(file->f_security, tsk->cred->security, MAY_WRITE); > if (rc != 0 && has_capability(tsk, CAP_MAC_OVERRIDE)) > return 0; > + > + SMACK_AUDIT_DATA_INIT(&ad, TASK); > + ad.u.tsk = tsk; > + smack_log(file->f_security, tsk->cred->security, MAY_WRITE, rc, &ad); > return rc; > } > > @@ -959,7 +1045,10 @@ static int smack_file_send_sigiotask(struct task_struct *tsk, > static int smack_file_receive(struct file *file) > { > int may = 0; > + struct smack_audit_data ad; > > + SMACK_AUDIT_DATA_INIT(&ad, TASK); > + ad.u.fs.path = file->f_path; > /* > * This code relies on bitmasks. > */ > @@ -968,7 +1057,7 @@ static int smack_file_receive(struct file *file) > if (file->f_mode & FMODE_WRITE) > may |= MAY_WRITE; > > - return smk_curacc(file->f_security, may); > + return smk_curacc_log(file->f_security, may, &ad); > } > > /* > @@ -1048,6 +1137,22 @@ static int smack_kernel_create_files_as(struct cred *new, > } > > /** > + * smk_curacc_on_task - helper to log task related access > + * @p: the task object > + * @access : the access requested > + * > + * Return 0 if access is permitted > + */ > +static int smk_curacc_on_task(struct task_struct *p, int access) > +{ > + struct smack_audit_data ad; > + > + SMACK_AUDIT_DATA_INIT(&ad, TASK); > + ad.u.tsk = p; > + return smk_curacc_log(task_security(p), access, &ad); > +} > + > +/** > * smack_task_setpgid - Smack check on setting pgid > * @p: the task object > * @pgid: unused > @@ -1056,7 +1161,7 @@ static int smack_kernel_create_files_as(struct cred *new, > */ > static int smack_task_setpgid(struct task_struct *p, pid_t pgid) > { > - return smk_curacc(task_security(p), MAY_WRITE); > + return smk_curacc_on_task(p, MAY_WRITE); > } > > /** > @@ -1067,7 +1172,7 @@ static int smack_task_setpgid(struct task_struct *p, pid_t pgid) > */ > static int smack_task_getpgid(struct task_struct *p) > { > - return smk_curacc(task_security(p), MAY_READ); > + return smk_curacc_on_task(p, MAY_READ); > } > > /** > @@ -1078,7 +1183,7 @@ static int smack_task_getpgid(struct task_struct *p) > */ > static int smack_task_getsid(struct task_struct *p) > { > - return smk_curacc(task_security(p), MAY_READ); > + return smk_curacc_on_task(p, MAY_READ); > } > > /** > @@ -1106,7 +1211,7 @@ static int smack_task_setnice(struct task_struct *p, int nice) > > rc = cap_task_setnice(p, nice); > if (rc == 0) > - rc = smk_curacc(task_security(p), MAY_WRITE); > + rc = smk_curacc_on_task(p, MAY_WRITE); > return rc; > } > > @@ -1123,7 +1228,7 @@ static int smack_task_setioprio(struct task_struct *p, int ioprio) > > rc = cap_task_setioprio(p, ioprio); > if (rc == 0) > - rc = smk_curacc(task_security(p), MAY_WRITE); > + rc = smk_curacc_on_task(p, MAY_WRITE); > return rc; > } > > @@ -1135,7 +1240,7 @@ static int smack_task_setioprio(struct task_struct *p, int ioprio) > */ > static int smack_task_getioprio(struct task_struct *p) > { > - return smk_curacc(task_security(p), MAY_READ); > + return smk_curacc_on_task(p, MAY_READ); > } > > /** > @@ -1153,7 +1258,7 @@ static int smack_task_setscheduler(struct task_struct *p, int policy, > > rc = cap_task_setscheduler(p, policy, lp); > if (rc == 0) > - rc = smk_curacc(task_security(p), MAY_WRITE); > + rc = smk_curacc_on_task(p, MAY_WRITE); > return rc; > } > > @@ -1165,7 +1270,7 @@ static int smack_task_setscheduler(struct task_struct *p, int policy, > */ > static int smack_task_getscheduler(struct task_struct *p) > { > - return smk_curacc(task_security(p), MAY_READ); > + return smk_curacc_on_task(p, MAY_READ); > } > > /** > @@ -1176,7 +1281,7 @@ static int smack_task_getscheduler(struct task_struct *p) > */ > static int smack_task_movememory(struct task_struct *p) > { > - return smk_curacc(task_security(p), MAY_WRITE); > + return smk_curacc_on_task(p, MAY_WRITE); > } > > /** > @@ -1194,18 +1299,23 @@ static int smack_task_movememory(struct task_struct *p) > static int smack_task_kill(struct task_struct *p, struct siginfo *info, > int sig, u32 secid) > { > + struct smack_audit_data ad; > + > + SMACK_AUDIT_DATA_INIT(&ad, TASK); > + ad.u.tsk = p; > /* > * Sending a signal requires that the sender > * can write the receiver. > */ > if (secid == 0) > - return smk_curacc(task_security(p), MAY_WRITE); > + return smk_curacc_log(task_security(p), MAY_WRITE, &ad); > /* > * If the secid isn't 0 we're dealing with some USB IO > * specific behavior. This is not clean. For one thing > * we can't take privilege into account. > */ > - return smk_access(smack_from_secid(secid), task_security(p), MAY_WRITE); > + return smk_access_log(smack_from_secid(secid), task_security(p), > + MAY_WRITE, &ad); > } > > /** > @@ -1216,12 +1326,13 @@ static int smack_task_kill(struct task_struct *p, struct siginfo *info, > */ > static int smack_task_wait(struct task_struct *p) > { > + struct smack_audit_data ad; > int rc; > > + /* we don't log here, we can be overriden */ > rc = smk_access(current_security(), task_security(p), MAY_WRITE); > if (rc == 0) > - return 0; > - > + goto out_log; > /* > * Allow the operation to succeed if either task > * has privilege to perform operations that might > @@ -1235,7 +1346,11 @@ static int smack_task_wait(struct task_struct *p) > */ > if (capable(CAP_MAC_OVERRIDE) || has_capability(p, CAP_MAC_OVERRIDE)) > return 0; > - > + /* we log only if we didn't get overriden */ > + out_log: > + SMACK_AUDIT_DATA_INIT(&ad, TASK); > + ad.u.tsk = p; > + smack_log(current_security(), task_security(p), MAY_WRITE, rc, &ad); > return rc; > } > > @@ -1567,22 +1682,30 @@ static int smack_socket_connect(struct socket *sock, struct sockaddr *sap, > { > struct socket_smack *ssp = sock->sk->sk_security; > char *hostsp; > + struct smack_audit_data ad; > + struct sockaddr_in *sin; > int rc; > > + > if (sock->sk == NULL || sock->sk->sk_family != PF_INET) > return 0; > > if (addrlen < sizeof(struct sockaddr_in)) > return -EINVAL; > - > - hostsp = smack_host_label((struct sockaddr_in *)sap); > + sin = (struct sockaddr_in *)sap; > + hostsp = smack_host_label(sin); > if (hostsp == NULL) { > if (ssp->smk_labeled != SMACK_CIPSO_SOCKET) > return smack_netlabel(sock->sk, SMACK_CIPSO_SOCKET); > return 0; > } > + SMACK_AUDIT_DATA_INIT(&ad, NET); > + ad.u.net.family = sock->sk->sk_family; > + ad.u.net.v4info.daddr = sin->sin_addr.s_addr; > + ad.u.net.dport = sin->sin_port; > + > + rc = smk_access_log(ssp->smk_out, hostsp, MAY_WRITE, &ad); > > - rc = smk_access(ssp->smk_out, hostsp, MAY_WRITE); > if (rc != 0) > return rc; > > @@ -1673,6 +1796,23 @@ static void smack_shm_free_security(struct shmid_kernel *shp) > } > > /** > + * smk_curacc_shm : check if current has access on shm > + * @shp : the object > + * @access : access requested > + * > + * Returns 0 if current has the requested access, error code otherwise > + */ > +static int smk_curacc_shm(struct shmid_kernel *shp, int access) > +{ > + char *ssp = smack_of_shm(shp); > + struct smack_audit_data ad; > + > + SMACK_AUDIT_DATA_INIT(&ad, IPC); > + ad.u.ipc_id = shp->shm_perm.id; > + return smk_curacc_log(ssp, access, &ad); > +} > + > +/** > * smack_shm_associate - Smack access check for shm > * @shp: the object > * @shmflg: access requested > @@ -1681,11 +1821,10 @@ static void smack_shm_free_security(struct shmid_kernel *shp) > */ > static int smack_shm_associate(struct shmid_kernel *shp, int shmflg) > { > - char *ssp = smack_of_shm(shp); > int may; > > may = smack_flags_to_may(shmflg); > - return smk_curacc(ssp, may); > + return smk_curacc_shm(shp, may); > } > > /** > @@ -1697,7 +1836,6 @@ static int smack_shm_associate(struct shmid_kernel *shp, int shmflg) > */ > static int smack_shm_shmctl(struct shmid_kernel *shp, int cmd) > { > - char *ssp; > int may; > > switch (cmd) { > @@ -1720,9 +1858,7 @@ static int smack_shm_shmctl(struct shmid_kernel *shp, int cmd) > default: > return -EINVAL; > } > - > - ssp = smack_of_shm(shp); > - return smk_curacc(ssp, may); > + return smk_curacc_shm(shp, may); > } > > /** > @@ -1736,11 +1872,10 @@ static int smack_shm_shmctl(struct shmid_kernel *shp, int cmd) > static int smack_shm_shmat(struct shmid_kernel *shp, char __user *shmaddr, > int shmflg) > { > - char *ssp = smack_of_shm(shp); > int may; > > may = smack_flags_to_may(shmflg); > - return smk_curacc(ssp, may); > + return smk_curacc_shm(shp, may); > } > > /** > @@ -1782,6 +1917,23 @@ static void smack_sem_free_security(struct sem_array *sma) > } > > /** > + * smk_curacc_sem : check if current has access on sem > + * @sma : the object > + * @access : access requested > + * > + * Returns 0 if current has the requested access, error code otherwise > + */ > +static int smk_curacc_sem(struct sem_array *sma, int access) > +{ > + char *ssp = smack_of_sem(sma); > + struct smack_audit_data ad; > + > + SMACK_AUDIT_DATA_INIT(&ad, IPC); > + ad.u.ipc_id = sma->sem_perm.id; > + return smk_curacc_log(ssp, access, &ad); > +} > + > +/** > * smack_sem_associate - Smack access check for sem > * @sma: the object > * @semflg: access requested > @@ -1790,11 +1942,10 @@ static void smack_sem_free_security(struct sem_array *sma) > */ > static int smack_sem_associate(struct sem_array *sma, int semflg) > { > - char *ssp = smack_of_sem(sma); > int may; > > may = smack_flags_to_may(semflg); > - return smk_curacc(ssp, may); > + return smk_curacc_sem(sma, may); > } > > /** > @@ -1806,7 +1957,6 @@ static int smack_sem_associate(struct sem_array *sma, int semflg) > */ > static int smack_sem_semctl(struct sem_array *sma, int cmd) > { > - char *ssp; > int may; > > switch (cmd) { > @@ -1835,8 +1985,7 @@ static int smack_sem_semctl(struct sem_array *sma, int cmd) > return -EINVAL; > } > > - ssp = smack_of_sem(sma); > - return smk_curacc(ssp, may); > + return smk_curacc_sem(sma, may); > } > > /** > @@ -1853,9 +2002,7 @@ static int smack_sem_semctl(struct sem_array *sma, int cmd) > static int smack_sem_semop(struct sem_array *sma, struct sembuf *sops, > unsigned nsops, int alter) > { > - char *ssp = smack_of_sem(sma); > - > - return smk_curacc(ssp, MAY_READWRITE); > + return smk_curacc_sem(sma, MAY_READWRITE); > } > > /** > @@ -1897,6 +2044,23 @@ static char *smack_of_msq(struct msg_queue *msq) > } > > /** > + * smk_curacc_msq : helper to check if current has access on msq > + * @msq : the msq > + * @access : access requested > + * > + * return 0 if current has access, error otherwise > + */ > +static int smk_curacc_msq(struct msg_queue *msq, int access) > +{ > + char *msp = smack_of_msq(msq); > + struct smack_audit_data ad; > + > + SMACK_AUDIT_DATA_INIT(&ad, IPC); > + ad.u.ipc_id = msq->q_perm.id; > + return smk_curacc_log(msp, access, &ad); > +} > + > +/** > * smack_msg_queue_associate - Smack access check for msg_queue > * @msq: the object > * @msqflg: access requested > @@ -1905,11 +2069,10 @@ static char *smack_of_msq(struct msg_queue *msq) > */ > static int smack_msg_queue_associate(struct msg_queue *msq, int msqflg) > { > - char *msp = smack_of_msq(msq); > int may; > > may = smack_flags_to_may(msqflg); > - return smk_curacc(msp, may); > + return smk_curacc_msq(msq, may); > } > > /** > @@ -1921,7 +2084,6 @@ static int smack_msg_queue_associate(struct msg_queue *msq, int msqflg) > */ > static int smack_msg_queue_msgctl(struct msg_queue *msq, int cmd) > { > - char *msp; > int may; > > switch (cmd) { > @@ -1943,8 +2105,7 @@ static int smack_msg_queue_msgctl(struct msg_queue *msq, int cmd) > return -EINVAL; > } > > - msp = smack_of_msq(msq); > - return smk_curacc(msp, may); > + return smk_curacc_msq(msq, may); > } > > /** > @@ -1958,11 +2119,10 @@ static int smack_msg_queue_msgctl(struct msg_queue *msq, int cmd) > static int smack_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, > int msqflg) > { > - char *msp = smack_of_msq(msq); > - int rc; > + int may; > > - rc = smack_flags_to_may(msqflg); > - return smk_curacc(msp, rc); > + may = smack_flags_to_may(msqflg); > + return smk_curacc_msq(msq, may); > } > > /** > @@ -1978,9 +2138,7 @@ static int smack_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, > static int smack_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg, > struct task_struct *target, long type, int mode) > { > - char *msp = smack_of_msq(msq); > - > - return smk_curacc(msp, MAY_READWRITE); > + return smk_curacc_msq(msq, MAY_READWRITE); > } > > /** > @@ -1993,10 +2151,13 @@ static int smack_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg, > static int smack_ipc_permission(struct kern_ipc_perm *ipp, short flag) > { > char *isp = ipp->security; > + struct smack_audit_data ad; > int may; > + SMACK_AUDIT_DATA_INIT(&ad, IPC); > + ad.u.ipc_id = ipp->id; > > may = smack_flags_to_may(flag); > - return smk_curacc(isp, may); > + return smk_curacc_log(isp, may, &ad); > } > > /** > @@ -2255,8 +2416,12 @@ static int smack_unix_stream_connect(struct socket *sock, > { > struct inode *sp = SOCK_INODE(sock); > struct inode *op = SOCK_INODE(other); > + struct smack_audit_data ad; > > - return smk_access(smk_of_inode(sp), smk_of_inode(op), MAY_READWRITE); > + SMACK_AUDIT_DATA_INIT(&ad, NET); > + ad.u.net.sk = other->sk; > + return smk_access_log(smk_of_inode(sp), smk_of_inode(op), > + MAY_READWRITE, &ad); > } > > /** > @@ -2271,8 +2436,12 @@ static int smack_unix_may_send(struct socket *sock, struct socket *other) > { > struct inode *sp = SOCK_INODE(sock); > struct inode *op = SOCK_INODE(other); > + struct smack_audit_data ad; > > - return smk_access(smk_of_inode(sp), smk_of_inode(op), MAY_WRITE); > + SMACK_AUDIT_DATA_INIT(&ad, NET); > + ad.u.net.sk = other->sk; > + return smk_access_log(smk_of_inode(sp), smk_of_inode(op), > + MAY_WRITE, &ad); > } > > /** > @@ -2292,6 +2461,7 @@ static int smack_socket_sendmsg(struct socket *sock, struct msghdr *msg, > struct socket_smack *ssp = sock->sk->sk_security; > char *hostsp; > int rc; > + struct smack_audit_data ad; > > /* > * Perfectly reasonable for this to be NULL > @@ -2305,8 +2475,12 @@ static int smack_socket_sendmsg(struct socket *sock, struct msghdr *msg, > return smack_netlabel(sock->sk, SMACK_CIPSO_SOCKET); > return 0; > } > + SMACK_AUDIT_DATA_INIT(&ad, NET); > + ad.u.net.family = sip->sin_family; > + ad.u.net.dport = sip->sin_port; > + ad.u.net.v4info.daddr = sip->sin_addr.s_addr; > > - rc = smk_access(ssp->smk_out, hostsp, MAY_WRITE); > + rc = smk_access_log(ssp->smk_out, hostsp, MAY_WRITE, &ad); > if (rc != 0) > return rc; > > @@ -2314,7 +2488,6 @@ static int smack_socket_sendmsg(struct socket *sock, struct msghdr *msg, > return smack_netlabel(sock->sk, SMACK_UNLABELED_SOCKET); > > return 0; > - > } > > > @@ -2405,6 +2578,7 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) > struct socket_smack *ssp = sk->sk_security; > char smack[SMK_LABELLEN]; > char *csp; > + struct smack_audit_data ad; > int rc; > > if (sk->sk_family != PF_INET && sk->sk_family != PF_INET6) > @@ -2424,13 +2598,17 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) > > netlbl_secattr_destroy(&secattr); > > + SMACK_AUDIT_DATA_INIT(&ad, NET); > + ad.u.net.family = sk->sk_family; > + ad.u.net.netif = skb->iif; > + ipv4_skb_to_auditdata(skb, &ad, NULL); > /* > * Receiving a packet requires that the other end > * be able to write here. Read access is not required. > * This is the simplist possible security model > * for networking. > */ > - rc = smk_access(csp, ssp->smk_in, MAY_WRITE); > + rc = smk_access_log(csp, ssp->smk_in, MAY_WRITE, &ad); > if (rc != 0) > netlbl_skbuff_err(skb, rc, 0); > return rc; > @@ -2638,6 +2816,7 @@ static int smack_key_permission(key_ref_t key_ref, > const struct cred *cred, key_perm_t perm) > { > struct key *keyp; > + struct smack_audit_data ad; > > keyp = key_ref_to_ptr(key_ref); > if (keyp == NULL) > @@ -2653,8 +2832,11 @@ static int smack_key_permission(key_ref_t key_ref, > */ > if (cred->security == NULL) > return -EACCES; > + SMACK_AUDIT_DATA_INIT(&ad, KEY); > + ad.u.key = keyp->serial; > + ad.u.key_desc = keyp->description; > > - return smk_access(cred->security, keyp->security, MAY_READWRITE); > + return smk_access_log(cred->security, keyp->security, MAY_READWRITE, &ad); > } > #endif /* CONFIG_KEYS */ > > diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c > index 8e42800..923223f 100644 > --- a/security/smack/smackfs.c > +++ b/security/smack/smackfs.c > @@ -27,6 +27,7 @@ > #include <linux/ctype.h> > #include <linux/audit.h> > #include "smack.h" > +#include "smack_logging.h" > > /* > * smackfs pseudo filesystem. > @@ -41,6 +42,7 @@ enum smk_inos { > SMK_AMBIENT = 7, /* internet ambient label */ > SMK_NETLBLADDR = 8, /* single label hosts */ > SMK_ONLYCAP = 9, /* the only "capable" label */ > + SMK_LOGGING = 10, /* logging */ > }; > > /* > @@ -1112,6 +1114,54 @@ static const struct file_operations smk_onlycap_ops = { > .write = smk_write_onlycap, > }; > > + > +static ssize_t smk_read_logging(struct file *filp, char __user *buf, > + size_t count, loff_t *ppos) > +{ > + char temp[32]; > + ssize_t rc; > + > + if (*ppos != 0) > + return 0; > + > + sprintf(temp, "%d\n", > + log_policy.log_denied + log_policy.log_accepted*2); > + rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp)); > + return rc; > +} > + > +static ssize_t smk_write_logging(struct file *file, const char __user *buf, > + size_t count, loff_t *ppos) > +{ > + char temp[32]; > + int i; > + > + if (!capable(CAP_MAC_ADMIN)) > + return -EPERM; > + > + if (count >= sizeof(temp) || count == 0) > + return -EINVAL; > + > + if (copy_from_user(temp, buf, count) != 0) > + return -EFAULT; > + > + temp[count] = '\0'; > + > + if (sscanf(temp, "%d", &i) != 1) > + return -EINVAL; > + if (i < 0 || i > 3) > + return -EINVAL; > + log_policy.log_denied = i & 1; > + log_policy.log_accepted = (i & 2) >> 1 ; > + return count; > +} > + > + > + > +static const struct file_operations smk_logging_ops = { > + .read = smk_read_logging, > + .write = smk_write_logging, > +}; > /** > * smk_fill_super - fill the /smackfs superblock > * @sb: the empty superblock > @@ -1142,6 +1192,8 @@ static int smk_fill_super(struct super_block *sb, void *data, int silent) > {"netlabel", &smk_netlbladdr_ops, S_IRUGO|S_IWUSR}, > [SMK_ONLYCAP] = > {"onlycap", &smk_onlycap_ops, S_IRUGO|S_IWUSR}, > + [SMK_LOGGING] = > + {"logging", &smk_logging_ops, S_IRUGO|S_IWUSR}, > /* last one */ {""} > }; > > > > > ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Fwd: [PATCH][RFC] SMACK : add logging support V1] 2009-03-28 5:24 ` [Fwd: [PATCH][RFC] SMACK : add logging support V1] Casey Schaufler @ 2009-03-30 14:20 ` Eric Paris [not found] ` <49D10FC5.4060504@numericable.fr> 0 siblings, 1 reply; 5+ messages in thread From: Eric Paris @ 2009-03-30 14:20 UTC (permalink / raw) To: Casey Schaufler; +Cc: linux-audit, jmorris, etienne > > Hello, > > > > the following patch, against current 2.6.29-rc7, add logging of smack decisions. > > This is of course very useful to understand what your current smack policy does. > > It borrows a lot from selinux; Lets start with running the patch through scripts/checkpatch.pl You've got some pretty serious whitespace damage in places. I didn't look much at all in the SMACK code only the more generic audit code. Are you sure you got the capability no audit stuff right? I guess you would know it pretty quickly since capabilities for memory allocation are checked a LOT, but on OOM and FS full they are checked too. You don't have to but I'd like to see some reworking if you are willing. Any code that you stole line for line from SELinux, lets put that stuff in a single place. I think that's going to mean pretty much all of smack_logging.h could be reasonably moved to a generic header for both of you to use (just make it generic, i'm not asking you to port selinux et al. to the new header.) I also feel like we could do better reusing code from smack_log and avc_audit but maybe that's beyond what you are willing to try to to take on. > > It introduces a '/smack/logging' switch : > > 0: no logging > > 1: log denied (default) > > 2: log accepted > > 3: log denied&accepted > > > > > > example of logs produced : > > > > type=1400 audit(1236429348.858:5655879): SMACK[smack_task_kill]: denied pid=6521 comm="bash" subject:'toto' object:'_' requested:w pid=5757 comm="knetworkmanager" > > type=1400 audit(1236429361.477:5655882): SMACK[smk_curacc_shm]: denied pid=6533 comm="ipcrm" subject:'toto' object:'_' requested:rw key=491521 > > type=1400 audit(1236429392.389:5655885): SMACK[smack_sb_mount]: denied pid=6536 comm="mount" subject:'toto' object:'_' requested:w path="/debug" dev=sda5 ino=16161 > > type=1400 audit(1236429485.009:5655890): SMACK[smack_ptrace_may_access]: denied pid=6539 comm="strace" subject:'toto' object:'_' requested:rw pid=5634 comm="python" > > type=1400 audit(1236429527.693:5655893): SMACK[smack_inode_getattr]: denied pid=6544 comm="ls" subject:'toto' object:'etienne' requested:r path="/home/etienne/linux" dev=sda8 ino=2342913 > > type=1400 audit(1236429741.006:6006665): SMACK[smack_socket_sendmsg]: granted pid=6580 comm="ping" subject:'toto' object:'@' requested:w daddr=192.168.0.10 > > type=1400 audit(1236429741.006:6006666): SMACK[smack_socket_sock_rcv_skb]: granted pid=6580 comm="ping" subject:'@' object:'toto' requested:w saddr=192.168.0.10 daddr=192.168.0.10 netif=lo Change everything to be a key=value pair. PLEASE! SELinux does some boneheaded things and SMACK can get them right. Things that get an auto-NAK from the audit people (aka me) SMACK[smack_task_kill] (key=value) denied (kay=value, maybe sgrubb suggestion for key name?) anything closed in '....' use the string logging functions. using : as as separator I pretty strongly detest %s these days. Using it on the left side of an = is ok if you are REALLY careful. Using it on the right makes me cringe. Can smack labels have characters which are not ascii letters (spaces?) Also it isn't in the examples, but something with an sport or dport looks totally busted, I comment inline below.... Looks like you would get records with something like saddr=192.168.0.10 :=12345 daddr=192.168.0.10 :=80 See my complaint about %s? > > Signed-off-by: <etienne.basset@numericable.fr> > > > > Acked-by: Casey Schaufler <casey@schaufler-ca.com> > > > --- > > Documentation/Smack.txt | 12 + > > security/smack/Kconfig | 2 +- > > security/smack/Makefile | 2 +- > > security/smack/smack_logging.c | 460 ++++++++++++++++++++++++++++++++++++++++ > > security/smack/smack_logging.h | 97 +++++++++ > > security/smack/smack_lsm.c | 356 +++++++++++++++++++++++-------- > > security/smack/smackfs.c | 52 +++++ > > 7 files changed, 892 insertions(+), 89 deletions(-) > > --- > > diff --git a/Documentation/Smack.txt b/Documentation/Smack.txt > > index 989c2fc..81a6921 100644 > > --- a/Documentation/Smack.txt > > +++ b/Documentation/Smack.txt > > @@ -491,3 +491,15 @@ Smack supports some mount options: > > > > These mount options apply to all file system types. > > > > +Smack logging support > > + > > +Smack supports logging of security accesses. It will log by default all denied > > +requests. The interface to change this behavior is /smack/logging, where you > > +can write the logging level you desire : > > +0: no logging > > +1: log denied (default) > > +2: log accepted > > +3: log denied&accepted > > + > > +Note that due to the rate-limit of audit messages, logging accepted request will > > +drop a lot of messages. > > diff --git a/security/smack/Kconfig b/security/smack/Kconfig > > index 603b087..d83e708 100644 > > --- a/security/smack/Kconfig > > +++ b/security/smack/Kconfig > > @@ -1,6 +1,6 @@ > > config SECURITY_SMACK > > bool "Simplified Mandatory Access Control Kernel Support" > > - depends on NETLABEL && SECURITY_NETWORK > > + depends on NETLABEL && SECURITY_NETWORK && AUDIT > > default n > > help > > This selects the Simplified Mandatory Access Control Kernel. > > diff --git a/security/smack/Makefile b/security/smack/Makefile > > index 67a63aa..b562fba 100644 > > --- a/security/smack/Makefile > > +++ b/security/smack/Makefile > > @@ -4,4 +4,4 @@ > > > > obj-$(CONFIG_SECURITY_SMACK) := smack.o > > > > -smack-y := smack_lsm.o smack_access.o smackfs.o > > +smack-y := smack_lsm.o smack_access.o smackfs.o smack_logging.o > > diff --git a/security/smack/smack_logging.c b/security/smack/smack_logging.c > > new file mode 100644 > > index 0000000..1ff81c0 > > --- /dev/null > > +++ b/security/smack/smack_logging.c > > @@ -0,0 +1,460 @@ > > +/* > > + * Smack logging > > + * > > + * heavily inspired by security/selinux/avc.c > > + * > > + * All credits to : Stephen Smalley, <sds@epoch.ncsc.mil> > > + * James Morris <jmorris@redhat.com> > > + * Author : Etienne Basset, <etienne.basset@ensta.org> > > + * > > + * This program is free software; you can redistribute it and/or modify > > + * it under the terms of the GNU General Public License version 2, > > + * as published by the Free Software Foundation. > > + */ > > +#include <linux/types.h> > > +#include <linux/stddef.h> > > +#include <linux/kernel.h> > > +#include <linux/fs.h> > > +#include <linux/init.h> > > +#include <net/sock.h> > > +#include <linux/un.h> > > +#include <net/af_unix.h> > > +#include <linux/audit.h> > > +#include <linux/ipv6.h> > > +#include <linux/ip.h> > > +#include <net/ip.h> > > +#include <net/ipv6.h> > > +#include <linux/tcp.h> > > +#include <linux/udp.h> > > +#include <linux/dccp.h> > > +#include <linux/sctp.h> > > +#include "smack.h" > > +#include "smack_logging.h" > > + > > +/* what do we log > > + * can be overwrite at run-time by /smack/logging > > + */ > > +struct smack_log_policy log_policy = { > > + .log_accepted = 0, > > + .log_denied = 1 > > +}; > > + > > + > > + > > +/** > > + * ipv4_skb_to_auditdata : fill smack_auditdata from skb > > + * @skb : the skb > > + * @ad : the audit data to fill > > + * @proto : the layer 4 protocol > > + * > > + * return 0 on success > > + */ > > +int ipv4_skb_to_auditdata(struct sk_buff *skb, > > + struct smack_audit_data *ad, u8 *proto) > > +{ > > + int ret = 0; > > + struct iphdr *ih; > > + > > + ih = ip_hdr(skb); > > + if (ih == NULL) > > + return -EINVAL; > > + > > + ad->u.net.v4info.saddr = ih->saddr; > > + ad->u.net.v4info.daddr = ih->daddr; > > + > > + if (proto) > > + *proto = ih->protocol; > > + /* non initial fragment */ > > + if (ntohs(ih->frag_off) & IP_OFFSET) > > + return 0; > > + > > + switch (ih->protocol) { > > + case IPPROTO_TCP: { > > + struct tcphdr *th = tcp_hdr(skb); > > + if (th == NULL) > > + break; > > + > > + ad->u.net.sport = th->source; > > + ad->u.net.dport = th->dest; > > + break; > > + } > > + case IPPROTO_UDP: { > > + struct udphdr *uh = udp_hdr(skb); > > + if (uh == NULL) > > + break; > > + > > + ad->u.net.sport = uh->source; > > + ad->u.net.dport = uh->dest; > > + break; > > + } > > + case IPPROTO_DCCP: { > > + struct dccp_hdr *dh = dccp_hdr(skb); > > + if (dh == NULL) > > + break; > > + > > + ad->u.net.sport = dh->dccph_sport; > > + ad->u.net.dport = dh->dccph_dport; > > + break; > > + } > > + case IPPROTO_SCTP: { > > + struct sctphdr *sh = sctp_hdr(skb); > > + if (sh == NULL) > > + break; > > + ad->u.net.sport = sh->source; > > + ad->u.net.dport = sh->dest; > > + break; > > + } > > + default: > > + ret = -EINVAL; > > + } > > + return ret; > > +} > > +#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) > > +/** > > + * ipv6_skb_to_auditdata : fill smack_auditdata from skb > > + * @skb : the skb > > + * @ad : the audit data to fill > > + * @proto : the layer 4 protocol > > + * > > + * return 0 on success > > + */ > > +int ipv6_skb_to_auditdata(struct sk_buff *skb, > > + struct smack_audit_data *ad, u8 *proto) > > +{ > > + int offset, ret = 0; > > + struct ipv6hdr *ip6; > > + u8 nexthdr; > > + > > + ip6 = ipv6_hdr(skb); > > + if (ip6 == NULL) > > + return -EINVAL; > > + ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr); > > + ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr); > > + ret = 0; > > + /* IPv6 can have several extension header before the Transport header > > + * skip them */ > > + offset = skb_network_offset(skb); > > + offset += sizeof(*ip6); > > + nexthdr = ip6->nexthdr; > > + offset = ipv6_skip_exthdr(skb, offset, &nexthdr); > > + if (offset < 0) > > + return 0; > > + if (proto) > > + *proto = nexthdr; > > + switch (nexthdr) { > > + case IPPROTO_TCP: { > > + struct tcphdr _tcph, *th; > > + > > + th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph); > > + if (th == NULL) > > + break; > > + > > + ad->u.net.sport = th->source; > > + ad->u.net.dport = th->dest; > > + break; > > + } > > + case IPPROTO_UDP: { > > + struct udphdr _udph, *uh; > > + > > + uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph); > > + if (uh == NULL) > > + break; > > + > > + ad->u.net.sport = uh->source; > > + ad->u.net.dport = uh->dest; > > + break; > > + } > > + case IPPROTO_DCCP: { > > + struct dccp_hdr _dccph, *dh; > > + > > + dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph); > > + if (dh == NULL) > > + break; > > + > > + ad->u.net.sport = dh->dccph_sport; > > + ad->u.net.dport = dh->dccph_dport; > > + break; > > + } > > + case IPPROTO_SCTP: { > > + struct sctphdr _sctph, *sh; > > + > > + sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph); > > + if (sh == NULL) > > + break; > > + ad->u.net.sport = sh->source; > > + ad->u.net.dport = sh->dest; > > + break; > > + } > > + default: > > + ret = -EINVAL; > > + } > > + return ret; > > +} > > +#endif > > + > > + > > +static inline void avc_print_ipv6_addr(struct audit_buffer *ab, > > + struct in6_addr *addr, __be16 port, > > + char *name1, char *name2) > > +{ > > + if (!ipv6_addr_any(addr)) > > + audit_log_format(ab, " %s=%pI6", name1, addr); > > + if (port) > > + audit_log_format(ab, " %s=%d", name2, ntohs(port)); > > +} > > + > > +static inline void avc_print_ipv4_addr(struct audit_buffer *ab, __be32 addr, > > + __be16 port, char *name1, char *name2) > > +{ > > + if (addr) > > + audit_log_format(ab, " %s=%pI4", name1, &addr); > > + if (port) > > + audit_log_format(ab, " %s=%d", name2, ntohs(port)); > > +} > > +/** > > + * smack_str_from_perm : helper to transalate an int to a > > + * readable string > > + * @string : the string to fill > > + * @access : the int > > + * > > + */ > > +static inline void smack_str_from_perm(char *string, int access) > > +{ > > + int i = 0; > > + if (access & MAY_READ) > > + string[i++] = 'r'; > > + if (access & MAY_WRITE) > > + string[i++] = 'w'; > > + if (access & MAY_EXEC) > > + string[i++] = 'x'; > > + if (access & MAY_APPEND) > > + string[i++] = 'a'; > > + string[i] = '\0'; > > +} > > + > > + > > +/** > > + * smack_log - Audit the granting or denial of permissions. > > + * @subject_label : smack label of the requester > > + * @object_label : smack label of the object being accessed > > + * @request: requested permissions > > + * @result: result from smk_access > > + * @a: auxiliary audit data > > + * > > + * Audit the granting or denial of permissions in accordance > > + * with the policy. > > + */ > > +void smack_log(char *subject_label, char *object_label, int request, > > + int result, struct smack_audit_data *a) > > +{ > > + struct task_struct *tsk = current; > > + struct inode *inode = NULL; > > + struct audit_buffer *ab; > > + char request_buffer[5]; EWWWWWW, [5]? maybe #define it above near the smack_str_from_perm() so if you ever add a perm you won't have this get too small? > > + u32 denied; > > + u32 audited = 0; > > + > > + /* check if we have to log the current event */ > > + if (result != 0) { > > + denied = 1; > > + if (log_policy.log_denied) > > + audited = 1; > > + } else { > > + denied = 0; > > + if (log_policy.log_accepted) > > + audited = 1; > > + } > > + if (audited == 0) > > + return; > > + > > + /* we use GFP_ATOMIC so we won't sleep */ > > + ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_AVC); > > + if (!ab) > > + return; > > + audit_log_format(ab, "SMACK[%s]: %s ", a->function, denied ? "denied" : "granted"); > > + > > + if (a && a->tsk) > > + tsk = a->tsk; > > + if (tsk && tsk->pid) { > > + audit_log_format(ab, " pid=%d comm=", tsk->pid); > > + audit_log_untrustedstring(ab, tsk->comm); > > + } > > + smack_str_from_perm(request_buffer, request); > > + audit_log_format(ab, " subject:'%s' object:'%s' requested:%s ", > > + subject_label, object_label, request_buffer); > > + > > + if (a==NULL) > > + goto audit_log_end; > > + > > + switch (a->type) { > > + case AVC_AUDIT_DATA_IPC: > > + audit_log_format(ab, "key=%d ", a->u.ipc_id); > > + break; > > + case AVC_AUDIT_DATA_CAP: > > + audit_log_format(ab, "capability=%d ", a->u.cap); > > + break; > > + case AVC_AUDIT_DATA_FS: > > + if (a->u.fs.path.dentry) { > > + struct dentry *dentry = a->u.fs.path.dentry; > > + if (a->u.fs.path.mnt) { > > + audit_log_d_path(ab, "path=", &a->u.fs.path); > > + } else { > > + audit_log_format(ab, "name="); > > + audit_log_untrustedstring(ab, dentry->d_name.name); > > + } > > + inode = dentry->d_inode; > > + } else if (a->u.fs.inode) { > > + struct dentry *dentry; > > + inode = a->u.fs.inode; > > + dentry = d_find_alias(inode); > > + if (dentry) { > > + audit_log_format(ab, "name="); > > + audit_log_untrustedstring(ab, dentry->d_name.name); > > + dput(dentry); > > + } > > + } > > + if (inode) > > + audit_log_format(ab, " dev=%s ino=%lu", > > + inode->i_sb->s_id, > > + inode->i_ino); > > + break; > > + case AVC_AUDIT_DATA_TASK: > > + tsk = a->u.tsk; > > + if (tsk && tsk->pid) { > > + audit_log_format(ab, "pid=%d comm=", tsk->pid); > > + audit_log_untrustedstring(ab, tsk->comm); > > + } > > + break; > > + case AVC_AUDIT_DATA_NET: > > + if (a->u.net.sk) { > > + struct sock *sk = a->u.net.sk; > > + struct unix_sock *u; > > + int len = 0; > > + char *p = NULL; > > + > > + switch (sk->sk_family) { > > + case AF_INET: { > > + struct inet_sock *inet = inet_sk(sk); > > + > > + avc_print_ipv4_addr(ab, inet->rcv_saddr, > > + inet->sport, > > + "laddr", "lport"); > > + avc_print_ipv4_addr(ab, inet->daddr, > > + inet->dport, > > + "faddr", "fport"); > > + break; > > + } > > + case AF_INET6: { > > + struct inet_sock *inet = inet_sk(sk); > > + struct ipv6_pinfo *inet6 = inet6_sk(sk); > > + > > + avc_print_ipv6_addr(ab, &inet6->rcv_saddr, > > + inet->sport, > > + "laddr", "lport"); > > + avc_print_ipv6_addr(ab, &inet6->daddr, > > + inet->dport, > > + "faddr", "fport"); > > + break; > > + } > > + case AF_UNIX: > > + u = unix_sk(sk); > > + if (u->dentry) { > > + struct path path = { > > + .dentry = u->dentry, > > + .mnt = u->mnt > > + }; > > + audit_log_d_path(ab, "path=", > > + &path); > > + break; > > + } > > + if (!u->addr) > > + break; > > + len = u->addr->len-sizeof(short); > > + p = &u->addr->name->sun_path[0]; > > + audit_log_format(ab, " path="); > > + if (*p) > > + audit_log_untrustedstring(ab, p); > > + else > > + audit_log_n_hex(ab, p, len); uhhhh, couldn't use just use "audit_log_n_untrusted_string? > > + break; > > + } > > + } > > + > > + switch (a->u.net.family) { > > + case AF_INET: > > + avc_print_ipv4_addr(ab, a->u.net.v4info.saddr, > > + a->u.net.sport, > > + "saddr", ":"); > > + avc_print_ipv4_addr(ab, a->u.net.v4info.daddr, > > + a->u.net.dport, > > + "daddr", ":"); name2 = ":" ?!?!?! > > + break; > > + case AF_INET6: > > + avc_print_ipv6_addr(ab, &a->u.net.v6info.saddr, > > + a->u.net.sport, > > + "saddr", ":"); > > + avc_print_ipv6_addr(ab, &a->u.net.v6info.daddr, > > + a->u.net.dport, > > + "daddr", ":"); > > + break; > > + } > > + if (a->u.net.netif > 0) { > > + struct net_device *dev; > > + > > + /* NOTE: we always use init's namespace */ > > + dev = dev_get_by_index(&init_net, > > + a->u.net.netif); > > + if (dev) { > > + audit_log_format(ab, " netif=%s", > > + dev->name); > > + dev_put(dev); > > + } > > + } > > + break; > > +#ifdef CONFIG_KEYS > > + case AVC_AUDIT_DATA_KEY: > > + audit_log_format(ab, " key serial=%u", a->u.key); > > + if (a->u.key_desc) > > + audit_log_format(ab, " key desc=%s", a->u.key_desc); no, no, no. everything needs to be a key=value. " key " fails that test! > > + break; > > +#endif > > + } /* switch (a->type) */ > > + > > +audit_log_end: > > + audit_log_end(ab); > > +} > > + > > +/** > > + * smk_curracc_log : check access of current on olabel > > + * @olabel : label being accessed > > + * @access : access requested > > + * @a : pointer to data > > + * > > + * return the same perm return by smk_curacc > > + */ > > +int smk_curacc_log(char *olabel, int access, struct smack_audit_data *a) > > +{ > > + int rc; > > + rc = smk_curacc(olabel, access); > > + smack_log(current_security(), olabel, access, rc, a); > > + return rc; > > +} > > + > > +/** > > + * smk_access_log : check access of slabel on olabel > > + * @slabel : subjet label > > + * @olabel : label being accessed > > + * @access : access requested > > + * @a : pointer to data > > + * > > + * return the same perm return by smk_access > > + */ > > +int smk_access_log(char *slabel, char *olabel, int access, > > + struct smack_audit_data *a) > > +{ > > + int rc; > > + rc = smk_access(slabel, olabel, access); > > + smack_log(slabel, olabel, access, rc, a); > > + return rc; > > +} > > + > > diff --git a/security/smack/smack_logging.h b/security/smack/smack_logging.h > > new file mode 100644 > > index 0000000..1a01574 > > --- /dev/null > > +++ b/security/smack/smack_logging.h > > @@ -0,0 +1,97 @@ > > +/* > > + * Smack logging function > > + * Heavily borrowed from selinux/avc.h > > + * > > + * Author : Etienne BASSET <etienne.basset@ensta.org> > > + * > > + * All credits to : Stephen Smalley, <sds@epoch.ncsc.mil> > > + * All BUGS to : Etienne BASSET <etienne.basset@ensta.org> > > + */ > > +#ifndef _SMACK_LOGGING_ > > +#define _SMACK_LOGGING_ > > + > > +#include <linux/stddef.h> > > +#include <linux/errno.h> > > +#include <linux/kernel.h> > > +#include <linux/kdev_t.h> > > +#include <linux/spinlock.h> > > +#include <linux/init.h> > > +#include <linux/audit.h> > > +#include <linux/in6.h> > > +#include <linux/path.h> > > +#include <asm/system.h> > > +#include <linux/key.h> > > + > > + > > +struct smack_log_policy { > > + int log_accepted; > > + int log_denied; > > +}; > > +extern struct smack_log_policy log_policy; > > + > > + > > +/* Auxiliary data to use in generating the audit record. */ > > +struct smack_audit_data { > > + char type; > > +#define AVC_AUDIT_DATA_FS 1 > > +#define AVC_AUDIT_DATA_NET 2 > > +#define AVC_AUDIT_DATA_CAP 3 > > +#define AVC_AUDIT_DATA_IPC 4 > > +#define AVC_AUDIT_DATA_TASK 5 > > +#define AVC_AUDIT_DATA_KEY 6 > > + struct task_struct *tsk; > > + union { > > + struct { > > + struct path path; > > + struct inode *inode; > > + } fs; > > + struct { > > + int netif; > > + struct sock *sk; > > + u16 family; > > + __be16 dport; > > + __be16 sport; > > + union { > > + struct { > > + __be32 daddr; > > + __be32 saddr; > > + } v4; > > + struct { > > + struct in6_addr daddr; > > + struct in6_addr saddr; > > + } v6; > > + } fam; > > + } net; > > + int cap; > > + int ipc_id; > > + struct task_struct *tsk; > > +#ifdef CONFIG_KEYS > > + key_serial_t key; > > + char *key_desc; > > +#endif > > + } u; > > + const char *function; > > +}; > > + > > +#define v4info fam.v4 > > +#define v6info fam.v6 > > + > > +int ipv4_skb_to_auditdata(struct sk_buff *skb, > > + struct smack_audit_data *ad, u8 *proto); > > + > > +int ipv6_skb_to_auditdata(struct sk_buff *skb, > > + struct smack_audit_data *ad, u8 *proto); > > + > > +/* Initialize an AVC audit data structure. */ > > +#define SMACK_AUDIT_DATA_INIT(_d, _t) \ > > + { memset((_d), 0, sizeof(struct smack_audit_data)); (_d)->type = AVC_AUDIT_DATA_##_t; (_d)->function = __func__; } > > + > > +void smack_log(char *subject_label, char *object_label, > > + int request, > > + int result, struct smack_audit_data *auditdata); > > + > > +int smk_access_log(char *subjectlabel, char *olabel, int access, > > + struct smack_audit_data *a); > > +int smk_curacc_log(char *olabel, int access, struct smack_audit_data *a); > > + > > +#endif > > diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c > > index 0278bc0..6e7af4e 100644 > > --- a/security/smack/smack_lsm.c > > +++ b/security/smack/smack_lsm.c > > @@ -29,6 +29,7 @@ > > #include <linux/audit.h> > > > > #include "smack.h" > > +#include "smack_logging.h" > > > > #define task_security(task) (task_cred_xxx((task), security)) > > > > @@ -99,14 +100,20 @@ struct inode_smack *new_inode_smack(char *smack) > > static int smack_ptrace_may_access(struct task_struct *ctp, unsigned int mode) > > { > > int rc; > > + struct smack_audit_data ad; > > > > rc = cap_ptrace_may_access(ctp, mode); > > if (rc != 0) > > return rc; > > > > + SMACK_AUDIT_DATA_INIT(&ad, TASK); > > + ad.u.tsk = ctp; > > + /* we won't log here, because rc can be overriden */ > > rc = smk_access(current_security(), task_security(ctp), MAY_READWRITE); > > if (rc != 0 && capable(CAP_MAC_OVERRIDE)) > > - return 0; > > + rc = 0; > > + > > + smack_log(current_security(), task_security(ctp), MAY_READWRITE, rc, &ad); > > return rc; > > } > > > > @@ -121,14 +128,20 @@ static int smack_ptrace_may_access(struct task_struct *ctp, unsigned int mode) > > static int smack_ptrace_traceme(struct task_struct *ptp) > > { > > int rc; > > - > > + struct smack_audit_data ad; > > rc = cap_ptrace_traceme(ptp); > > if (rc != 0) > > return rc; > > > > + SMACK_AUDIT_DATA_INIT(&ad, TASK); > > + ad.u.tsk = ptp; > > + > > + /* we won't log here, because rc can be overriden */ > > rc = smk_access(task_security(ptp), current_security(), MAY_READWRITE); > > if (rc != 0 && has_capability(ptp, CAP_MAC_OVERRIDE)) > > - return 0; > > + rc = 0; > > + > > + smack_log(task_security(ptp), current_security(), MAY_READWRITE, rc, &ad); > > return rc; > > } > > > > @@ -324,8 +337,14 @@ static int smack_sb_kern_mount(struct super_block *sb, int flags, void *data) > > static int smack_sb_statfs(struct dentry *dentry) > > { > > struct superblock_smack *sbp = dentry->d_sb->s_security; > > + struct smack_audit_data ad; > > + int rc; > > + > > + SMACK_AUDIT_DATA_INIT(&ad, FS); > > + ad.u.fs.path.dentry = dentry; > > > > - return smk_curacc(sbp->smk_floor, MAY_READ); > > + rc = smk_curacc_log(sbp->smk_floor, MAY_READ, &ad); > > + return rc; > > } > > > > /** > > @@ -343,8 +362,12 @@ static int smack_sb_mount(char *dev_name, struct path *path, > > char *type, unsigned long flags, void *data) > > { > > struct superblock_smack *sbp = path->mnt->mnt_sb->s_security; > > + struct smack_audit_data ad; > > > > - return smk_curacc(sbp->smk_floor, MAY_WRITE); > > + SMACK_AUDIT_DATA_INIT(&ad, FS); > > + ad.u.fs.path.dentry = path->dentry; > > + ad.u.fs.path.mnt = path->mnt; > > + return smk_curacc_log(sbp->smk_floor, MAY_WRITE, &ad); > > } > > > > /** > > @@ -358,10 +381,14 @@ static int smack_sb_mount(char *dev_name, struct path *path, > > static int smack_sb_umount(struct vfsmount *mnt, int flags) > > { > > struct superblock_smack *sbp; > > + struct smack_audit_data ad; > > > > sbp = mnt->mnt_sb->s_security; > > + SMACK_AUDIT_DATA_INIT(&ad, FS); > > + ad.u.fs.path.dentry = mnt->mnt_mountpoint; > > + ad.u.fs.path.mnt = mnt; > > > > - return smk_curacc(sbp->smk_floor, MAY_WRITE); > > + return smk_curacc_log(sbp->smk_floor, MAY_WRITE, &ad); > > } > > > > /* > > @@ -438,15 +465,20 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir, > > static int smack_inode_link(struct dentry *old_dentry, struct inode *dir, > > struct dentry *new_dentry) > > { > > - int rc; > > char *isp; > > + struct smack_audit_data ad; > > + int rc; > > + > > + SMACK_AUDIT_DATA_INIT(&ad, FS); > > + ad.u.fs.path.dentry = old_dentry; > > > > isp = smk_of_inode(old_dentry->d_inode); > > - rc = smk_curacc(isp, MAY_WRITE); > > + rc = smk_curacc_log(isp, MAY_WRITE, &ad); > > > > if (rc == 0 && new_dentry->d_inode != NULL) { > > isp = smk_of_inode(new_dentry->d_inode); > > - rc = smk_curacc(isp, MAY_WRITE); > > + ad.u.fs.path.dentry = new_dentry; > > + rc = smk_curacc_log(isp, MAY_WRITE, &ad); > > } > > > > return rc; > > @@ -463,18 +495,24 @@ static int smack_inode_link(struct dentry *old_dentry, struct inode *dir, > > static int smack_inode_unlink(struct inode *dir, struct dentry *dentry) > > { > > struct inode *ip = dentry->d_inode; > > + struct smack_audit_data ad; > > int rc; > > > > + SMACK_AUDIT_DATA_INIT(&ad, FS); > > + ad.u.fs.path.dentry = dentry; > > + > > /* > > * You need write access to the thing you're unlinking > > */ > > - rc = smk_curacc(smk_of_inode(ip), MAY_WRITE); > > - if (rc == 0) > > + rc = smk_curacc_log(smk_of_inode(ip), MAY_WRITE, &ad); > > + if (rc == 0) { > > /* > > * You also need write access to the containing directory > > */ > > - rc = smk_curacc(smk_of_inode(dir), MAY_WRITE); > > - > > + ad.u.fs.path.dentry = NULL; > > + ad.u.fs.inode = dir; > > + rc = smk_curacc_log(smk_of_inode(dir), MAY_WRITE, &ad); > > + } > > return rc; > > } > > > > @@ -488,17 +526,24 @@ static int smack_inode_unlink(struct inode *dir, struct dentry *dentry) > > */ > > static int smack_inode_rmdir(struct inode *dir, struct dentry *dentry) > > { > > + struct smack_audit_data ad; > > int rc; > > > > + SMACK_AUDIT_DATA_INIT(&ad, FS); > > + ad.u.fs.path.dentry = dentry; > > + > > /* > > * You need write access to the thing you're removing > > */ > > - rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE); > > - if (rc == 0) > > + rc = smk_curacc_log(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad); > > + if (rc == 0) { > > /* > > * You also need write access to the containing directory > > */ > > - rc = smk_curacc(smk_of_inode(dir), MAY_WRITE); > > + ad.u.fs.path.dentry = NULL; > > + ad.u.fs.inode = dir; > > + rc = smk_curacc_log(smk_of_inode(dir), MAY_WRITE, &ad); > > + } > > > > return rc; > > } > > @@ -522,15 +567,19 @@ static int smack_inode_rename(struct inode *old_inode, > > { > > int rc; > > char *isp; > > + struct smack_audit_data ad; > > + > > + SMACK_AUDIT_DATA_INIT(&ad, FS); > > + ad.u.fs.path.dentry = old_dentry; > > > > isp = smk_of_inode(old_dentry->d_inode); > > - rc = smk_curacc(isp, MAY_READWRITE); > > + rc = smk_curacc_log(isp, MAY_READWRITE, &ad); > > > > if (rc == 0 && new_dentry->d_inode != NULL) { > > isp = smk_of_inode(new_dentry->d_inode); > > - rc = smk_curacc(isp, MAY_READWRITE); > > + ad.u.fs.path.dentry = new_dentry; > > + rc = smk_curacc_log(isp, MAY_READWRITE, &ad); > > } > > - > > return rc; > > } > > > > @@ -546,14 +595,16 @@ static int smack_inode_rename(struct inode *old_inode, > > */ > > static int smack_inode_permission(struct inode *inode, int mask) > > { > > + struct smack_audit_data ad; > > /* > > * No permission to check. Existence test. Yup, it's there. > > */ > > if (mask == 0) > > return 0; > > - > > - return smk_curacc(smk_of_inode(inode), mask); > > -} > > + SMACK_AUDIT_DATA_INIT(&ad, FS); > > + ad.u.fs.inode = inode; > > + return smk_curacc_log(smk_of_inode(inode), mask, &ad); > > + } > > > > /** > > * smack_inode_setattr - Smack check for setting attributes > > @@ -564,13 +615,15 @@ static int smack_inode_permission(struct inode *inode, int mask) > > */ > > static int smack_inode_setattr(struct dentry *dentry, struct iattr *iattr) > > { > > + struct smack_audit_data ad; > > /* > > * Need to allow for clearing the setuid bit. > > */ > > if (iattr->ia_valid & ATTR_FORCE) > > return 0; > > - > > - return smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE); > > + SMACK_AUDIT_DATA_INIT(&ad, FS); > > + ad.u.fs.path.dentry = dentry; > > + return smk_curacc_log(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad); > > } > > > > /** > > @@ -582,7 +635,12 @@ static int smack_inode_setattr(struct dentry *dentry, struct iattr *iattr) > > */ > > static int smack_inode_getattr(struct vfsmount *mnt, struct dentry *dentry) > > { > > - return smk_curacc(smk_of_inode(dentry->d_inode), MAY_READ); > > + struct smack_audit_data ad; > > + > > + SMACK_AUDIT_DATA_INIT(&ad, FS); > > + ad.u.fs.path.dentry = dentry; > > + ad.u.fs.path.mnt = mnt; > > + return smk_curacc_log(smk_of_inode(dentry->d_inode), MAY_READ, &ad); > > } > > > > /** > > @@ -600,6 +658,7 @@ static int smack_inode_getattr(struct vfsmount *mnt, struct dentry *dentry) > > static int smack_inode_setxattr(struct dentry *dentry, const char *name, > > const void *value, size_t size, int flags) > > { > > + struct smack_audit_data ad; > > int rc = 0; > > > > if (strcmp(name, XATTR_NAME_SMACK) == 0 || > > @@ -610,8 +669,10 @@ static int smack_inode_setxattr(struct dentry *dentry, const char *name, > > } else > > rc = cap_inode_setxattr(dentry, name, value, size, flags); > > > > + SMACK_AUDIT_DATA_INIT(&ad, FS); > > + ad.u.fs.path.dentry = dentry; > > if (rc == 0) > > - rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE); > > + rc = smk_curacc_log(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad); > > > > return rc; > > } > > @@ -666,7 +727,11 @@ static void smack_inode_post_setxattr(struct dentry *dentry, const char *name, > > */ > > static int smack_inode_getxattr(struct dentry *dentry, const char *name) > > { > > - return smk_curacc(smk_of_inode(dentry->d_inode), MAY_READ); > > + struct smack_audit_data ad; > > + > > + SMACK_AUDIT_DATA_INIT(&ad, FS); > > + ad.u.fs.path.dentry = dentry; > > + return smk_curacc_log(smk_of_inode(dentry->d_inode), MAY_READ, &ad); > > } > > > > /* > > @@ -680,6 +745,7 @@ static int smack_inode_getxattr(struct dentry *dentry, const char *name) > > */ > > static int smack_inode_removexattr(struct dentry *dentry, const char *name) > > { > > + struct smack_audit_data ad; > > int rc = 0; > > > > if (strcmp(name, XATTR_NAME_SMACK) == 0 || > > @@ -690,8 +756,10 @@ static int smack_inode_removexattr(struct dentry *dentry, const char *name) > > } else > > rc = cap_inode_removexattr(dentry, name); > > > > + SMACK_AUDIT_DATA_INIT(&ad, FS); > > + ad.u.fs.path.dentry = dentry; > > if (rc == 0) > > - rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE); > > + rc = smk_curacc_log(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad); > > > > return rc; > > } > > @@ -851,12 +919,16 @@ static int smack_file_ioctl(struct file *file, unsigned int cmd, > > unsigned long arg) > > { > > int rc = 0; > > + struct smack_audit_data ad; > > + > > + SMACK_AUDIT_DATA_INIT(&ad, FS); > > + ad.u.fs.path = file->f_path; > > > > if (_IOC_DIR(cmd) & _IOC_WRITE) > > - rc = smk_curacc(file->f_security, MAY_WRITE); > > + rc = smk_curacc_log(file->f_security, MAY_WRITE, &ad); > > > > if (rc == 0 && (_IOC_DIR(cmd) & _IOC_READ)) > > - rc = smk_curacc(file->f_security, MAY_READ); > > + rc = smk_curacc_log(file->f_security, MAY_READ, &ad); > > > > return rc; > > } > > @@ -870,7 +942,11 @@ static int smack_file_ioctl(struct file *file, unsigned int cmd, > > */ > > static int smack_file_lock(struct file *file, unsigned int cmd) > > { > > - return smk_curacc(file->f_security, MAY_WRITE); > > + struct smack_audit_data ad; > > + > > + SMACK_AUDIT_DATA_INIT(&ad, FS); > > + ad.u.fs.path.dentry = file->f_path.dentry; > > + return smk_curacc_log(file->f_security, MAY_WRITE, &ad); > > } > > > > /** > > @@ -884,8 +960,12 @@ static int smack_file_lock(struct file *file, unsigned int cmd) > > static int smack_file_fcntl(struct file *file, unsigned int cmd, > > unsigned long arg) > > { > > + struct smack_audit_data ad; > > int rc; > > > > + SMACK_AUDIT_DATA_INIT(&ad, FS); > > + ad.u.fs.path = file->f_path; > > + > > switch (cmd) { > > case F_DUPFD: > > case F_GETFD: > > @@ -893,7 +973,7 @@ static int smack_file_fcntl(struct file *file, unsigned int cmd, > > case F_GETLK: > > case F_GETOWN: > > case F_GETSIG: > > - rc = smk_curacc(file->f_security, MAY_READ); > > + rc = smk_curacc_log(file->f_security, MAY_READ, &ad); > > break; > > case F_SETFD: > > case F_SETFL: > > @@ -901,10 +981,10 @@ static int smack_file_fcntl(struct file *file, unsigned int cmd, > > case F_SETLKW: > > case F_SETOWN: > > case F_SETSIG: > > - rc = smk_curacc(file->f_security, MAY_WRITE); > > + rc = smk_curacc_log(file->f_security, MAY_WRITE, &ad); > > break; > > default: > > - rc = smk_curacc(file->f_security, MAY_READWRITE); > > + rc = smk_curacc_log(file->f_security, MAY_READWRITE, &ad); > > } > > > > return rc; > > @@ -939,14 +1019,20 @@ static int smack_file_send_sigiotask(struct task_struct *tsk, > > { > > struct file *file; > > int rc; > > + struct smack_audit_data ad; > > > > /* > > * struct fown_struct is never outside the context of a struct file > > */ > > file = container_of(fown, struct file, f_owner); > > + /* we don't log here as rc can be overriden */ > > rc = smk_access(file->f_security, tsk->cred->security, MAY_WRITE); > > if (rc != 0 && has_capability(tsk, CAP_MAC_OVERRIDE)) > > return 0; > > + > > + SMACK_AUDIT_DATA_INIT(&ad, TASK); > > + ad.u.tsk = tsk; > > + smack_log(file->f_security, tsk->cred->security, MAY_WRITE, rc, &ad); > > return rc; > > } > > > > @@ -959,7 +1045,10 @@ static int smack_file_send_sigiotask(struct task_struct *tsk, > > static int smack_file_receive(struct file *file) > > { > > int may = 0; > > + struct smack_audit_data ad; > > > > + SMACK_AUDIT_DATA_INIT(&ad, TASK); > > + ad.u.fs.path = file->f_path; > > /* > > * This code relies on bitmasks. > > */ > > @@ -968,7 +1057,7 @@ static int smack_file_receive(struct file *file) > > if (file->f_mode & FMODE_WRITE) > > may |= MAY_WRITE; > > > > - return smk_curacc(file->f_security, may); > > + return smk_curacc_log(file->f_security, may, &ad); > > } > > > > /* > > @@ -1048,6 +1137,22 @@ static int smack_kernel_create_files_as(struct cred *new, > > } > > > > /** > > + * smk_curacc_on_task - helper to log task related access > > + * @p: the task object > > + * @access : the access requested > > + * > > + * Return 0 if access is permitted > > + */ > > +static int smk_curacc_on_task(struct task_struct *p, int access) > > +{ > > + struct smack_audit_data ad; > > + > > + SMACK_AUDIT_DATA_INIT(&ad, TASK); > > + ad.u.tsk = p; > > + return smk_curacc_log(task_security(p), access, &ad); > > +} > > + > > +/** > > * smack_task_setpgid - Smack check on setting pgid > > * @p: the task object > > * @pgid: unused > > @@ -1056,7 +1161,7 @@ static int smack_kernel_create_files_as(struct cred *new, > > */ > > static int smack_task_setpgid(struct task_struct *p, pid_t pgid) > > { > > - return smk_curacc(task_security(p), MAY_WRITE); > > + return smk_curacc_on_task(p, MAY_WRITE); > > } > > > > /** > > @@ -1067,7 +1172,7 @@ static int smack_task_setpgid(struct task_struct *p, pid_t pgid) > > */ > > static int smack_task_getpgid(struct task_struct *p) > > { > > - return smk_curacc(task_security(p), MAY_READ); > > + return smk_curacc_on_task(p, MAY_READ); > > } > > > > /** > > @@ -1078,7 +1183,7 @@ static int smack_task_getpgid(struct task_struct *p) > > */ > > static int smack_task_getsid(struct task_struct *p) > > { > > - return smk_curacc(task_security(p), MAY_READ); > > + return smk_curacc_on_task(p, MAY_READ); > > } > > > > /** > > @@ -1106,7 +1211,7 @@ static int smack_task_setnice(struct task_struct *p, int nice) > > > > rc = cap_task_setnice(p, nice); > > if (rc == 0) > > - rc = smk_curacc(task_security(p), MAY_WRITE); > > + rc = smk_curacc_on_task(p, MAY_WRITE); > > return rc; > > } > > > > @@ -1123,7 +1228,7 @@ static int smack_task_setioprio(struct task_struct *p, int ioprio) > > > > rc = cap_task_setioprio(p, ioprio); > > if (rc == 0) > > - rc = smk_curacc(task_security(p), MAY_WRITE); > > + rc = smk_curacc_on_task(p, MAY_WRITE); > > return rc; > > } > > > > @@ -1135,7 +1240,7 @@ static int smack_task_setioprio(struct task_struct *p, int ioprio) > > */ > > static int smack_task_getioprio(struct task_struct *p) > > { > > - return smk_curacc(task_security(p), MAY_READ); > > + return smk_curacc_on_task(p, MAY_READ); > > } > > > > /** > > @@ -1153,7 +1258,7 @@ static int smack_task_setscheduler(struct task_struct *p, int policy, > > > > rc = cap_task_setscheduler(p, policy, lp); > > if (rc == 0) > > - rc = smk_curacc(task_security(p), MAY_WRITE); > > + rc = smk_curacc_on_task(p, MAY_WRITE); > > return rc; > > } > > > > @@ -1165,7 +1270,7 @@ static int smack_task_setscheduler(struct task_struct *p, int policy, > > */ > > static int smack_task_getscheduler(struct task_struct *p) > > { > > - return smk_curacc(task_security(p), MAY_READ); > > + return smk_curacc_on_task(p, MAY_READ); > > } > > > > /** > > @@ -1176,7 +1281,7 @@ static int smack_task_getscheduler(struct task_struct *p) > > */ > > static int smack_task_movememory(struct task_struct *p) > > { > > - return smk_curacc(task_security(p), MAY_WRITE); > > + return smk_curacc_on_task(p, MAY_WRITE); > > } > > > > /** > > @@ -1194,18 +1299,23 @@ static int smack_task_movememory(struct task_struct *p) > > static int smack_task_kill(struct task_struct *p, struct siginfo *info, > > int sig, u32 secid) > > { > > + struct smack_audit_data ad; > > + > > + SMACK_AUDIT_DATA_INIT(&ad, TASK); > > + ad.u.tsk = p; > > /* > > * Sending a signal requires that the sender > > * can write the receiver. > > */ > > if (secid == 0) > > - return smk_curacc(task_security(p), MAY_WRITE); > > + return smk_curacc_log(task_security(p), MAY_WRITE, &ad); > > /* > > * If the secid isn't 0 we're dealing with some USB IO > > * specific behavior. This is not clean. For one thing > > * we can't take privilege into account. > > */ > > - return smk_access(smack_from_secid(secid), task_security(p), MAY_WRITE); > > + return smk_access_log(smack_from_secid(secid), task_security(p), > > + MAY_WRITE, &ad); > > } > > > > /** > > @@ -1216,12 +1326,13 @@ static int smack_task_kill(struct task_struct *p, struct siginfo *info, > > */ > > static int smack_task_wait(struct task_struct *p) > > { > > + struct smack_audit_data ad; > > int rc; > > > > + /* we don't log here, we can be overriden */ > > rc = smk_access(current_security(), task_security(p), MAY_WRITE); > > if (rc == 0) > > - return 0; > > - > > + goto out_log; > > /* > > * Allow the operation to succeed if either task > > * has privilege to perform operations that might > > @@ -1235,7 +1346,11 @@ static int smack_task_wait(struct task_struct *p) > > */ > > if (capable(CAP_MAC_OVERRIDE) || has_capability(p, CAP_MAC_OVERRIDE)) > > return 0; > > - > > + /* we log only if we didn't get overriden */ > > + out_log: > > + SMACK_AUDIT_DATA_INIT(&ad, TASK); > > + ad.u.tsk = p; > > + smack_log(current_security(), task_security(p), MAY_WRITE, rc, &ad); > > return rc; > > } > > > > @@ -1567,22 +1682,30 @@ static int smack_socket_connect(struct socket *sock, struct sockaddr *sap, > > { > > struct socket_smack *ssp = sock->sk->sk_security; > > char *hostsp; > > + struct smack_audit_data ad; > > + struct sockaddr_in *sin; > > int rc; > > > > + > > if (sock->sk == NULL || sock->sk->sk_family != PF_INET) > > return 0; > > > > if (addrlen < sizeof(struct sockaddr_in)) > > return -EINVAL; > > - > > - hostsp = smack_host_label((struct sockaddr_in *)sap); > > + sin = (struct sockaddr_in *)sap; > > + hostsp = smack_host_label(sin); > > if (hostsp == NULL) { > > if (ssp->smk_labeled != SMACK_CIPSO_SOCKET) > > return smack_netlabel(sock->sk, SMACK_CIPSO_SOCKET); > > return 0; > > } > > + SMACK_AUDIT_DATA_INIT(&ad, NET); > > + ad.u.net.family = sock->sk->sk_family; > > + ad.u.net.v4info.daddr = sin->sin_addr.s_addr; > > + ad.u.net.dport = sin->sin_port; > > + > > + rc = smk_access_log(ssp->smk_out, hostsp, MAY_WRITE, &ad); > > > > - rc = smk_access(ssp->smk_out, hostsp, MAY_WRITE); > > if (rc != 0) > > return rc; > > > > @@ -1673,6 +1796,23 @@ static void smack_shm_free_security(struct shmid_kernel *shp) > > } > > > > /** > > + * smk_curacc_shm : check if current has access on shm > > + * @shp : the object > > + * @access : access requested > > + * > > + * Returns 0 if current has the requested access, error code otherwise > > + */ > > +static int smk_curacc_shm(struct shmid_kernel *shp, int access) > > +{ > > + char *ssp = smack_of_shm(shp); > > + struct smack_audit_data ad; > > + > > + SMACK_AUDIT_DATA_INIT(&ad, IPC); > > + ad.u.ipc_id = shp->shm_perm.id; > > + return smk_curacc_log(ssp, access, &ad); > > +} > > + > > +/** > > * smack_shm_associate - Smack access check for shm > > * @shp: the object > > * @shmflg: access requested > > @@ -1681,11 +1821,10 @@ static void smack_shm_free_security(struct shmid_kernel *shp) > > */ > > static int smack_shm_associate(struct shmid_kernel *shp, int shmflg) > > { > > - char *ssp = smack_of_shm(shp); > > int may; > > > > may = smack_flags_to_may(shmflg); > > - return smk_curacc(ssp, may); > > + return smk_curacc_shm(shp, may); > > } > > > > /** > > @@ -1697,7 +1836,6 @@ static int smack_shm_associate(struct shmid_kernel *shp, int shmflg) > > */ > > static int smack_shm_shmctl(struct shmid_kernel *shp, int cmd) > > { > > - char *ssp; > > int may; > > > > switch (cmd) { > > @@ -1720,9 +1858,7 @@ static int smack_shm_shmctl(struct shmid_kernel *shp, int cmd) > > default: > > return -EINVAL; > > } > > - > > - ssp = smack_of_shm(shp); > > - return smk_curacc(ssp, may); > > + return smk_curacc_shm(shp, may); > > } > > > > /** > > @@ -1736,11 +1872,10 @@ static int smack_shm_shmctl(struct shmid_kernel *shp, int cmd) > > static int smack_shm_shmat(struct shmid_kernel *shp, char __user *shmaddr, > > int shmflg) > > { > > - char *ssp = smack_of_shm(shp); > > int may; > > > > may = smack_flags_to_may(shmflg); > > - return smk_curacc(ssp, may); > > + return smk_curacc_shm(shp, may); > > } > > > > /** > > @@ -1782,6 +1917,23 @@ static void smack_sem_free_security(struct sem_array *sma) > > } > > > > /** > > + * smk_curacc_sem : check if current has access on sem > > + * @sma : the object > > + * @access : access requested > > + * > > + * Returns 0 if current has the requested access, error code otherwise > > + */ > > +static int smk_curacc_sem(struct sem_array *sma, int access) > > +{ > > + char *ssp = smack_of_sem(sma); > > + struct smack_audit_data ad; > > + > > + SMACK_AUDIT_DATA_INIT(&ad, IPC); > > + ad.u.ipc_id = sma->sem_perm.id; > > + return smk_curacc_log(ssp, access, &ad); > > +} > > + > > +/** > > * smack_sem_associate - Smack access check for sem > > * @sma: the object > > * @semflg: access requested > > @@ -1790,11 +1942,10 @@ static void smack_sem_free_security(struct sem_array *sma) > > */ > > static int smack_sem_associate(struct sem_array *sma, int semflg) > > { > > - char *ssp = smack_of_sem(sma); > > int may; > > > > may = smack_flags_to_may(semflg); > > - return smk_curacc(ssp, may); > > + return smk_curacc_sem(sma, may); > > } > > > > /** > > @@ -1806,7 +1957,6 @@ static int smack_sem_associate(struct sem_array *sma, int semflg) > > */ > > static int smack_sem_semctl(struct sem_array *sma, int cmd) > > { > > - char *ssp; > > int may; > > > > switch (cmd) { > > @@ -1835,8 +1985,7 @@ static int smack_sem_semctl(struct sem_array *sma, int cmd) > > return -EINVAL; > > } > > > > - ssp = smack_of_sem(sma); > > - return smk_curacc(ssp, may); > > + return smk_curacc_sem(sma, may); > > } > > > > /** > > @@ -1853,9 +2002,7 @@ static int smack_sem_semctl(struct sem_array *sma, int cmd) > > static int smack_sem_semop(struct sem_array *sma, struct sembuf *sops, > > unsigned nsops, int alter) > > { > > - char *ssp = smack_of_sem(sma); > > - > > - return smk_curacc(ssp, MAY_READWRITE); > > + return smk_curacc_sem(sma, MAY_READWRITE); > > } > > > > /** > > @@ -1897,6 +2044,23 @@ static char *smack_of_msq(struct msg_queue *msq) > > } > > > > /** > > + * smk_curacc_msq : helper to check if current has access on msq > > + * @msq : the msq > > + * @access : access requested > > + * > > + * return 0 if current has access, error otherwise > > + */ > > +static int smk_curacc_msq(struct msg_queue *msq, int access) > > +{ > > + char *msp = smack_of_msq(msq); > > + struct smack_audit_data ad; > > + > > + SMACK_AUDIT_DATA_INIT(&ad, IPC); > > + ad.u.ipc_id = msq->q_perm.id; > > + return smk_curacc_log(msp, access, &ad); > > +} > > + > > +/** > > * smack_msg_queue_associate - Smack access check for msg_queue > > * @msq: the object > > * @msqflg: access requested > > @@ -1905,11 +2069,10 @@ static char *smack_of_msq(struct msg_queue *msq) > > */ > > static int smack_msg_queue_associate(struct msg_queue *msq, int msqflg) > > { > > - char *msp = smack_of_msq(msq); > > int may; > > > > may = smack_flags_to_may(msqflg); > > - return smk_curacc(msp, may); > > + return smk_curacc_msq(msq, may); > > } > > > > /** > > @@ -1921,7 +2084,6 @@ static int smack_msg_queue_associate(struct msg_queue *msq, int msqflg) > > */ > > static int smack_msg_queue_msgctl(struct msg_queue *msq, int cmd) > > { > > - char *msp; > > int may; > > > > switch (cmd) { > > @@ -1943,8 +2105,7 @@ static int smack_msg_queue_msgctl(struct msg_queue *msq, int cmd) > > return -EINVAL; > > } > > > > - msp = smack_of_msq(msq); > > - return smk_curacc(msp, may); > > + return smk_curacc_msq(msq, may); > > } > > > > /** > > @@ -1958,11 +2119,10 @@ static int smack_msg_queue_msgctl(struct msg_queue *msq, int cmd) > > static int smack_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, > > int msqflg) > > { > > - char *msp = smack_of_msq(msq); > > - int rc; > > + int may; > > > > - rc = smack_flags_to_may(msqflg); > > - return smk_curacc(msp, rc); > > + may = smack_flags_to_may(msqflg); > > + return smk_curacc_msq(msq, may); > > } > > > > /** > > @@ -1978,9 +2138,7 @@ static int smack_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, > > static int smack_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg, > > struct task_struct *target, long type, int mode) > > { > > - char *msp = smack_of_msq(msq); > > - > > - return smk_curacc(msp, MAY_READWRITE); > > + return smk_curacc_msq(msq, MAY_READWRITE); > > } > > > > /** > > @@ -1993,10 +2151,13 @@ static int smack_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg, > > static int smack_ipc_permission(struct kern_ipc_perm *ipp, short flag) > > { > > char *isp = ipp->security; > > + struct smack_audit_data ad; > > int may; > > + SMACK_AUDIT_DATA_INIT(&ad, IPC); > > + ad.u.ipc_id = ipp->id; > > > > may = smack_flags_to_may(flag); > > - return smk_curacc(isp, may); > > + return smk_curacc_log(isp, may, &ad); > > } > > > > /** > > @@ -2255,8 +2416,12 @@ static int smack_unix_stream_connect(struct socket *sock, > > { > > struct inode *sp = SOCK_INODE(sock); > > struct inode *op = SOCK_INODE(other); > > + struct smack_audit_data ad; > > > > - return smk_access(smk_of_inode(sp), smk_of_inode(op), MAY_READWRITE); > > + SMACK_AUDIT_DATA_INIT(&ad, NET); > > + ad.u.net.sk = other->sk; > > + return smk_access_log(smk_of_inode(sp), smk_of_inode(op), > > + MAY_READWRITE, &ad); > > } > > > > /** > > @@ -2271,8 +2436,12 @@ static int smack_unix_may_send(struct socket *sock, struct socket *other) > > { > > struct inode *sp = SOCK_INODE(sock); > > struct inode *op = SOCK_INODE(other); > > + struct smack_audit_data ad; > > > > - return smk_access(smk_of_inode(sp), smk_of_inode(op), MAY_WRITE); > > + SMACK_AUDIT_DATA_INIT(&ad, NET); > > + ad.u.net.sk = other->sk; > > + return smk_access_log(smk_of_inode(sp), smk_of_inode(op), > > + MAY_WRITE, &ad); > > } > > > > /** > > @@ -2292,6 +2461,7 @@ static int smack_socket_sendmsg(struct socket *sock, struct msghdr *msg, > > struct socket_smack *ssp = sock->sk->sk_security; > > char *hostsp; > > int rc; > > + struct smack_audit_data ad; > > > > /* > > * Perfectly reasonable for this to be NULL > > @@ -2305,8 +2475,12 @@ static int smack_socket_sendmsg(struct socket *sock, struct msghdr *msg, > > return smack_netlabel(sock->sk, SMACK_CIPSO_SOCKET); > > return 0; > > } > > + SMACK_AUDIT_DATA_INIT(&ad, NET); > > + ad.u.net.family = sip->sin_family; > > + ad.u.net.dport = sip->sin_port; > > + ad.u.net.v4info.daddr = sip->sin_addr.s_addr; > > > > - rc = smk_access(ssp->smk_out, hostsp, MAY_WRITE); > > + rc = smk_access_log(ssp->smk_out, hostsp, MAY_WRITE, &ad); > > if (rc != 0) > > return rc; > > > > @@ -2314,7 +2488,6 @@ static int smack_socket_sendmsg(struct socket *sock, struct msghdr *msg, > > return smack_netlabel(sock->sk, SMACK_UNLABELED_SOCKET); > > > > return 0; > > - > > } > > > > > > @@ -2405,6 +2578,7 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) > > struct socket_smack *ssp = sk->sk_security; > > char smack[SMK_LABELLEN]; > > char *csp; > > + struct smack_audit_data ad; > > int rc; > > > > if (sk->sk_family != PF_INET && sk->sk_family != PF_INET6) > > @@ -2424,13 +2598,17 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) > > > > netlbl_secattr_destroy(&secattr); > > > > + SMACK_AUDIT_DATA_INIT(&ad, NET); > > + ad.u.net.family = sk->sk_family; > > + ad.u.net.netif = skb->iif; > > + ipv4_skb_to_auditdata(skb, &ad, NULL); > > /* > > * Receiving a packet requires that the other end > > * be able to write here. Read access is not required. > > * This is the simplist possible security model > > * for networking. > > */ > > - rc = smk_access(csp, ssp->smk_in, MAY_WRITE); > > + rc = smk_access_log(csp, ssp->smk_in, MAY_WRITE, &ad); > > if (rc != 0) > > netlbl_skbuff_err(skb, rc, 0); > > return rc; > > @@ -2638,6 +2816,7 @@ static int smack_key_permission(key_ref_t key_ref, > > const struct cred *cred, key_perm_t perm) > > { > > struct key *keyp; > > + struct smack_audit_data ad; > > > > keyp = key_ref_to_ptr(key_ref); > > if (keyp == NULL) > > @@ -2653,8 +2832,11 @@ static int smack_key_permission(key_ref_t key_ref, > > */ > > if (cred->security == NULL) > > return -EACCES; > > + SMACK_AUDIT_DATA_INIT(&ad, KEY); > > + ad.u.key = keyp->serial; > > + ad.u.key_desc = keyp->description; > > > > - return smk_access(cred->security, keyp->security, MAY_READWRITE); > > + return smk_access_log(cred->security, keyp->security, MAY_READWRITE, &ad); > > } > > #endif /* CONFIG_KEYS */ > > > > diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c > > index 8e42800..923223f 100644 > > --- a/security/smack/smackfs.c > > +++ b/security/smack/smackfs.c > > @@ -27,6 +27,7 @@ > > #include <linux/ctype.h> > > #include <linux/audit.h> > > #include "smack.h" > > +#include "smack_logging.h" > > > > /* > > * smackfs pseudo filesystem. > > @@ -41,6 +42,7 @@ enum smk_inos { > > SMK_AMBIENT = 7, /* internet ambient label */ > > SMK_NETLBLADDR = 8, /* single label hosts */ > > SMK_ONLYCAP = 9, /* the only "capable" label */ > > + SMK_LOGGING = 10, /* logging */ > > }; > > > > /* > > @@ -1112,6 +1114,54 @@ static const struct file_operations smk_onlycap_ops = { > > .write = smk_write_onlycap, > > }; > > > > + > > +static ssize_t smk_read_logging(struct file *filp, char __user *buf, > > + size_t count, loff_t *ppos) > > +{ > > + char temp[32]; > > + ssize_t rc; > > + > > + if (*ppos != 0) > > + return 0; > > + > > + sprintf(temp, "%d\n", > > + log_policy.log_denied + log_policy.log_accepted*2); > > + rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp)); > > + return rc; > > +} > > + > > +static ssize_t smk_write_logging(struct file *file, const char __user *buf, > > + size_t count, loff_t *ppos) > > +{ > > + char temp[32]; > > + int i; > > + > > + if (!capable(CAP_MAC_ADMIN)) > > + return -EPERM; > > + > > + if (count >= sizeof(temp) || count == 0) > > + return -EINVAL; > > + > > + if (copy_from_user(temp, buf, count) != 0) > > + return -EFAULT; > > + > > + temp[count] = '\0'; > > + > > + if (sscanf(temp, "%d", &i) != 1) > > + return -EINVAL; > > + if (i < 0 || i > 3) > > + return -EINVAL; > > + log_policy.log_denied = i & 1; > > + log_policy.log_accepted = (i & 2) >> 1 ; > > + return count; > > +} > > + > > + > > + > > +static const struct file_operations smk_logging_ops = { > > + .read = smk_read_logging, > > + .write = smk_write_logging, > > +}; > > /** > > * smk_fill_super - fill the /smackfs superblock > > * @sb: the empty superblock > > @@ -1142,6 +1192,8 @@ static int smk_fill_super(struct super_block *sb, void *data, int silent) > > {"netlabel", &smk_netlbladdr_ops, S_IRUGO|S_IWUSR}, > > [SMK_ONLYCAP] = > > {"onlycap", &smk_onlycap_ops, S_IRUGO|S_IWUSR}, > > + [SMK_LOGGING] = > > + {"logging", &smk_logging_ops, S_IRUGO|S_IWUSR}, > > /* last one */ {""} > > }; > > > > > > > > > > > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit ^ permalink raw reply [flat|nested] 5+ messages in thread
[parent not found: <49D10FC5.4060504@numericable.fr>]
* Re: [Fwd: [PATCH][RFC] SMACK : add logging support V1] [not found] ` <49D10FC5.4060504@numericable.fr> @ 2009-03-30 19:31 ` Eric Paris [not found] ` <49D28EAC.1040604@numericable.fr> 0 siblings, 1 reply; 5+ messages in thread From: Eric Paris @ 2009-03-30 19:31 UTC (permalink / raw) To: Etienne Basset; +Cc: linux-audit, jmorris On Mon, 2009-03-30 at 20:30 +0200, Etienne Basset wrote: > > I didn't look much at all in the SMACK code only the more generic audit > > code. Are you sure you got the capability no audit stuff right? I > > guess you would know it pretty quickly since capabilities for memory > > allocation are checked a LOT, but on OOM and FS full they are checked > > too. > > > I'm not quite sure what you're referring to. You mean a way to not log too much frequent events? SMACK doesn't have it's own capabilities enforcement (it just calls cap_capable()) so this doesn't matter to you at all. Just pretend I didn't say anything. > > You don't have to but I'd like to see some reworking if you are willing. > > Any code that you stole line for line from SELinux, lets put that stuff > > in a single place. I think that's going to mean pretty much all of > > smack_logging.h could be reasonably moved to a generic header for both > > of you to use (just make it generic, i'm not asking you to port selinux > > et al. to the new header.) > > OK, would it be something like include/linux/lsm_common_audit.h ? James? lsm_audit.h? security_audit.h? Should I just shut up and not try to work towards a generic lsm audit framework? I'm just seeing a lot of code that I've seen before. > > I also feel like we could do better reusing > > code from smack_log and avc_audit but maybe that's beyond what you are > > willing to try to to take on > > > > you mean doing : > smack:smack_log(...) > smack_audit_specific_data() > ... > common_security_audit(struct common_audit_data *) > > selinux:avc_audit(...) > selinux_specific_data() > ... > common_security_audit(struct common_audit_data *); > > It would make sense I guess I believe they both output the same set of information right? (except selinux has a tclass smack doesn't?) . But since we can't really fix/change SELinux logging right now maybe this isn't worth doing too much work over. If you see an easy way to make more of the code generic, do it. If not, don't worry about it. The real difference between the two is in security/selinux/avc.c::avc_dump_query() vs the beginning of smack_log(). If it's reasonable to somehow combine most/all of the other code, i say we do it. This might mean something like struct selinux_audit_struct { u32 ssid u32 tsid u16 tclass u32 requested struct av_decision *avd int result } struct smack_audit_struct { char *function int result char *subj char *obj char *requested } common_audit_struct { [everything we have today] union { struct selinux_audit_struct selinux_audit; struct smack_audit_struct smack_audit; } void (*lsm_audit)(struct audit_buffer*, void *); } So we could call some new generic function that does all of the buffer allocation and reporting, then call back into the private selinux/smack function with the data in the union. Maybe this isn't as easy as it sounded in my head... I just don't think we want a 3,4,5,6 implementations of lsm auditing. > > I pretty strongly detest %s these days. Using it on the left side of an > > = is ok if you are REALLY careful. Using it on the right makes me > > cringe. Can smack labels have characters which are not ascii letters > > (spaces?) > > > no, smack basically do the same tests when importing smack label than you do > in kernel/audit.c:audit_string_contains_control > except smack allows the '"' character How did you plan to handle a SMACK label with a ' ? Using the audit string functions and being given a label with a " is going to give you the hex output. (which might someday turn into better encoding, but I'm still waiting to see some code to do it better) Can I suggest if you write userspace tools to do anything with these audit records that you use libauparse? So if we do make changes, SMACK tools keep working (this is the main problem with changing how SELinux uses audit, the userspace tools don't use libauparse so we can't make changes in just the kernel+library...) -Eric ^ permalink raw reply [flat|nested] 5+ messages in thread
[parent not found: <49D28EAC.1040604@numericable.fr>]
* Re: [Fwd: [PATCH][RFC] SMACK : add logging support V1] [not found] ` <49D28EAC.1040604@numericable.fr> @ 2009-04-01 18:22 ` Eric Paris 2009-04-01 22:21 ` Casey Schaufler 0 siblings, 1 reply; 5+ messages in thread From: Eric Paris @ 2009-04-01 18:22 UTC (permalink / raw) To: Etienne Basset; +Cc: linux-audit, jmorris On Tue, 2009-03-31 at 23:44 +0200, Etienne Basset wrote: > Eric Paris wrote: > > On Mon, 2009-03-30 at 20:30 +0200, Etienne Basset wrote: > >>> I pretty strongly detest %s these days. Using it on the left side of an > >>> = is ok if you are REALLY careful. Using it on the right makes me > >>> cringe. Can smack labels have characters which are not ascii letters > >>> (spaces?) > >>> > >> no, smack basically do the same tests when importing smack label than you do > >> in kernel/audit.c:audit_string_contains_control > >> except smack allows the '"' character > > > > How did you plan to handle a SMACK label with a ' ? Using the audit > > string functions and being given a label with a " is going to give you > > the hex output. (which might someday turn into better encoding, but I'm > > still waiting to see some code to do it better) > > > hum, since smack labels cannot have special characters and are limited to length 24, > maybe we could just do : > subject=FOO object=BAR > but it would imply using a "object=%s subject=%s" > > or using audit_log_untrustedstring and live with the fact that Labels with '"' will be > printed in hex (i dont expect '"' to be frequently used in labels.) Since it can contain a " you may not use %s. Just go with audit_log_untrustedstring and hope people don't use a " > > Can I suggest if you write userspace tools to do anything with these > > audit records that you use libauparse? So if we do make changes, SMACK > > tools keep working (this is the main problem with changing how SELinux > > uses audit, the userspace tools don't use libauparse so we can't make > > changes in just the kernel+library...) > > > i can have a look, but my first need is /var/log/messages being pretty obvious to read The changes to string encoding and we want to do would actually make records more human readable, so if that's your concern we are good. But, if you ever make tools that parse the raw audit.log rather than using libauparse it possible (likely?) they break someday down the line. Don't forget these are going to show up in /var/log/audit/audit.log if you have auditd running. They'll show up in dmesg/syslog if not. Thanks for trying to share code between LSMs! -Eric ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Fwd: [PATCH][RFC] SMACK : add logging support V1] 2009-04-01 18:22 ` Eric Paris @ 2009-04-01 22:21 ` Casey Schaufler 0 siblings, 0 replies; 5+ messages in thread From: Casey Schaufler @ 2009-04-01 22:21 UTC (permalink / raw) To: Eric Paris; +Cc: linux-audit, jmorris, Etienne Basset Eric Paris wrote: >> ... >> >> or using audit_log_untrustedstring and live with the fact that Labels with '"' will be >> printed in hex (i dont expect '"' to be frequently used in labels.) >> > > Since it can contain a " you may not use %s. Just go with > audit_log_untrustedstring and hope people don't use a " > I am willing to declare that ' and " may not be used in labels. I've already done so with "/" to accommodate anyone who wants to use a label in a path name. I've never allowed whitespace. > >>> Can I suggest if you write userspace tools to do anything with these >>> audit records that you use libauparse? So if we do make changes, SMACK >>> tools keep working (this is the main problem with changing how SELinux >>> uses audit, the userspace tools don't use libauparse so we can't make >>> changes in just the kernel+library...) >>> >>> >> i can have a look, but my first need is /var/log/messages being pretty obvious to read >> > > The changes to string encoding and we want to do would actually make > records more human readable, so if that's your concern we are good. > But, if you ever make tools that parse the raw audit.log rather than > using libauparse it possible (likely?) they break someday down the line. > > Don't forget these are going to show up in /var/log/audit/audit.log if > you have auditd running. They'll show up in dmesg/syslog if not. > > Thanks for trying to share code between LSMs! > > -Eric > > > ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2009-04-01 22:22 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <49B3AB1A.8040201@numericable.fr>
2009-03-28 5:24 ` [Fwd: [PATCH][RFC] SMACK : add logging support V1] Casey Schaufler
2009-03-30 14:20 ` Eric Paris
[not found] ` <49D10FC5.4060504@numericable.fr>
2009-03-30 19:31 ` Eric Paris
[not found] ` <49D28EAC.1040604@numericable.fr>
2009-04-01 18:22 ` Eric Paris
2009-04-01 22:21 ` Casey Schaufler
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox