Re: [PATCH RFC] audit-userspace: support for MAC_TASK_CONTEXTS and MAC_OBJ_CONTEXTS

[Steve Grubb <sgrubb@redhat.com>]

On Wednesday, August 4, 2021 7:32:37 PM EDT Casey Schaufler wrote:
> This patch supplies userspace support for the MAC_TASK_CONTEXTS
> and MAC_OBJ_CONTEXTS audit records proposed as part of the Linux
> security module (LSM) stacking effort.
> 
> I have posted as an RFC because, well, I'd like comments.

In general, this looks good. Typically, the return code of functions in the 
parser are unique for debugging (passing  --debug to ausearch) per record 
type. IOW, you can start at 1 instead of 62 since the output identifes the 
record type and return code.

There is the general issue of what ausearch  --format csv & --format text 
outputs, though.

-Steve
 
> The additional context values are added to the existing lists.
> The existing search methods work on these lists, so that's about
> all it takes.
> 
> ---
>  lib/libaudit.h       |   8 ++++
>  lib/msg_typetab.h    |   2 +
>  src/ausearch-parse.c | 101
> +++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 111
> insertions(+)
> 
> diff --git a/lib/libaudit.h b/lib/libaudit.h
> index ed75892..9bc3aa9 100644
> --- a/lib/libaudit.h
> +++ b/lib/libaudit.h
> @@ -311,6 +311,14 @@ extern "C" {
>  #define AUDIT_MAC_CALIPSO_DEL	1419 /* NetLabel: del CALIPSO DOI entry 
*/
>  #endif
> 
> +#ifndef AUDIT_MAC_TASK_CONTEXTS
> +#define AUDIT_MAC_TASK_CONTEXTS	1420 /* Multilple task contexts */
> +#endif
> +
> +#ifndef AUDIT_MAC_OBJ_CONTEXTS
> +#define AUDIT_MAC_OBJ_CONTEXTS	1421 /* Multilple object contexts */
> +#endif
> +
>  #ifndef AUDIT_ANOM_LINK
>  #define AUDIT_ANOM_LINK		1702 /* Suspicious use of file links */
>  #endif
> diff --git a/lib/msg_typetab.h b/lib/msg_typetab.h
> index dba2f7b..e6df28b 100644
> --- a/lib/msg_typetab.h
> +++ b/lib/msg_typetab.h
> @@ -147,6 +147,8 @@ _S(AUDIT_MAC_UNLBL_STCADD,           "MAC_UNLBL_STCADD"
>              ) _S(AUDIT_MAC_UNLBL_STCDEL,           "MAC_UNLBL_STCDEL"    
>          ) _S(AUDIT_MAC_CALIPSO_ADD,            "MAC_CALIPSO_ADD"         
>      ) _S(AUDIT_MAC_CALIPSO_DEL,            "MAC_CALIPSO_DEL"             
>  ) +_S(AUDIT_MAC_TASK_CONTEXTS,          "MAC_TASK_CONTEXTS"             )
> +_S(AUDIT_MAC_OBJ_CONTEXTS,           "MAC_OBJ_CONTEXTS"              )
> _S(AUDIT_ANOM_PROMISCUOUS,           "ANOM_PROMISCUOUS"              )
> _S(AUDIT_ANOM_ABEND,                 "ANOM_ABEND"                    )
> _S(AUDIT_ANOM_LINK,                  "ANOM_LINK"                     )
> diff --git a/src/ausearch-parse.c b/src/ausearch-parse.c
> index 9ee4a4f..286829e 100644
> --- a/src/ausearch-parse.c
> +++ b/src/ausearch-parse.c
> @@ -63,6 +63,8 @@ static int parse_simple_message(const lnode *n,
> search_items *s); static int parse_tty(const lnode *n, search_items *s);
>  static int parse_pkt(const lnode *n, search_items *s);
>  static int parse_kernel(lnode *n, search_items *s);
> +static int parse_task_contexts(lnode *n, search_items *s);
> +static int parse_obj_contexts(lnode *n, search_items *s);
> 
> 
>  static int audit_avc_init(search_items *s)
> @@ -184,6 +186,12 @@ int extract_search_items(llist *l)
>  			case AUDIT_TTY:
>  				ret = parse_tty(n, s);
>  				break;
> +			case AUDIT_MAC_TASK_CONTEXTS:
> +				ret = parse_task_contexts(n, s);
> +				break;
> +			case AUDIT_MAC_OBJ_CONTEXTS:
> +				ret = parse_obj_contexts(n, s);
> +				break;
>  			default:
>  				if (event_debug)
>  					fprintf(stderr,
> @@ -2768,3 +2776,96 @@ static int parse_kernel(lnode *n, search_items *s)
>  	return 0;
>  }
> 
> +static int parse_task_context(lnode *n, search_items *s, char *c, int l)
> +{
> +	char *str, *term;
> +	anode an;
> +
> +	str = strstr(n->message, c);
> +	if (str == NULL)
> +		return 64;
> +
> +	str += l;
> +	term = strchr(str, '"');
> +	if (term == NULL)
> +		return 62;
> +	*term = 0;
> +	if (audit_avc_init(s) != 0)
> +		return 63;
> +
> +	anode_init(&an);
> +	an.scontext = strdup(str);
> +	alist_append(s->avc, &an);
> +	*term = '"';
> +
> +	return 0;
> +}
> +
> +// parse multiple security module contexts
> +// subj_<lsm>...
> +static int parse_task_contexts(lnode *n, search_items *s)
> +{
> +	int rc, final = 64;
> +
> +	if (!event_subject)
> +		return 0;
> +
> +	rc = parse_task_context(n, s, "subj_selinux=\"", 14);
> +	if (rc == 62 || rc == 63)
> +		return rc;
> +	if (rc == 0)
> +		final = 0;
> +
> +	rc = parse_task_context(n, s, "subj_smack=\"", 12);
> +	if (rc == 62 || rc == 63)
> +		return rc;
> +	if (rc == 0)
> +		final = 0;
> +
> +	rc = parse_task_context(n, s, "subj_apparmor=\"", 15);
> +	if (rc == 62 || rc == 63)
> +		return rc;
> +	if (rc == 0)
> +		final = 0;
> +
> +	return final;
> +}
> +
> +static int parse_obj_context(lnode *n, search_items *s, char *c, int l)
> +{
> +	char *str, *term;
> +	anode an;
> +
> +	str = strstr(n->message, c);
> +	if (str != NULL) {
> +		str += l;
> +		term = strchr(str, '"');
> +		if (term)
> +			*term = 0;
> +		if (audit_avc_init(s) != 0)
> +			return 2;
> +		anode_init(&an);
> +		an.tcontext = strdup(str);
> +		alist_append(s->avc, &an);
> +		if (term)
> +			*term = '"';
> +	}
> +
> +	return 0;
> +}
> +
> +// parse multiple object security module contexts
> +// obj_<lsm>...
> +static int parse_obj_contexts(lnode *n, search_items *s)
> +{
> +	// obj context
> +	if (!event_object)
> +		return 0;
> +
> +	if (parse_obj_context(n, s, "obj_selinux=\"", 12))
> +		return 2;
> +	if (parse_obj_context(n, s, "obj_smack=\"", 10))
> +		return 2;
> +
> +	return 0;
> +}




--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit