Re: [PATCH ghak103 V1] audit: add support for fcaps v3

["Serge E. Hallyn" <serge@hallyn.com>]

On Wed, Jan 23, 2019 at 09:36:25PM -0500, Richard Guy Briggs wrote:
> V3 namespaced file capabilities were introduced in
> commit 8db6c34f1dbc ("Introduce v3 namespaced file capabilities")
> 
> Add support for these by adding the "frootid" field to the existing
> fcaps fields in the NAME and BPRM_FCAPS records.
> 
> Please see github issue
> https://github.com/linux-audit/audit-kernel/issues/103
> 
> Signed-off-by: Richard Guy Briggs <rgb@redhat.com>

Looks like good info to have,

Acked-by: Serge Hallyn <serge@hallyn.com>

> ---
> Passes audit-testsuite.
> 
>  include/linux/capability.h | 5 +++--
>  kernel/audit.c             | 6 ++++--
>  kernel/audit.h             | 1 +
>  kernel/auditsc.c           | 4 ++++
>  security/commoncap.c       | 2 ++
>  5 files changed, 14 insertions(+), 4 deletions(-)
> 
> diff --git a/include/linux/capability.h b/include/linux/capability.h
> index f640dcbc880c..f6bb691547fd 100644
> --- a/include/linux/capability.h
> +++ b/include/linux/capability.h
> @@ -14,7 +14,7 @@
>  #define _LINUX_CAPABILITY_H
>  
>  #include <uapi/linux/capability.h>
> -
> +#include <linux/uidgid.h>
>  
>  #define _KERNEL_CAPABILITY_VERSION _LINUX_CAPABILITY_VERSION_3
>  #define _KERNEL_CAPABILITY_U32S    _LINUX_CAPABILITY_U32S_3
> @@ -25,11 +25,12 @@
>  	__u32 cap[_KERNEL_CAPABILITY_U32S];
>  } kernel_cap_t;
>  
> -/* exact same as vfs_cap_data but in cpu endian and always filled completely */
> +/* exact same as vfs_ns_cap_data but in cpu endian and always filled completely */
>  struct cpu_vfs_cap_data {
>  	__u32 magic_etc;
>  	kernel_cap_t permitted;
>  	kernel_cap_t inheritable;
> +	kuid_t rootid;
>  };
>  
>  #define _USER_CAP_HEADER_SIZE  (sizeof(struct __user_cap_header_struct))
> diff --git a/kernel/audit.c b/kernel/audit.c
> index ca55ccb46b76..6f5eeb658ccb 100644
> --- a/kernel/audit.c
> +++ b/kernel/audit.c
> @@ -2083,8 +2083,9 @@ static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name)
>  {
>  	audit_log_cap(ab, "cap_fp", &name->fcap.permitted);
>  	audit_log_cap(ab, "cap_fi", &name->fcap.inheritable);
> -	audit_log_format(ab, " cap_fe=%d cap_fver=%x",
> -			 name->fcap.fE, name->fcap_ver);
> +	audit_log_format(ab, " cap_fe=%d cap_fver=%x cap_frootid=%d",
> +			 name->fcap.fE, name->fcap_ver,
> +			 from_kuid(&init_user_ns, name->fcap.rootid));
>  }
>  
>  static inline int audit_copy_fcaps(struct audit_names *name,
> @@ -2103,6 +2104,7 @@ static inline int audit_copy_fcaps(struct audit_names *name,
>  	name->fcap.permitted = caps.permitted;
>  	name->fcap.inheritable = caps.inheritable;
>  	name->fcap.fE = !!(caps.magic_etc & VFS_CAP_FLAGS_EFFECTIVE);
> +	name->fcap.rootid = caps.rootid;
>  	name->fcap_ver = (caps.magic_etc & VFS_CAP_REVISION_MASK) >>
>  				VFS_CAP_REVISION_SHIFT;
>  
> diff --git a/kernel/audit.h b/kernel/audit.h
> index 6ffb70575082..deefdbe61a47 100644
> --- a/kernel/audit.h
> +++ b/kernel/audit.h
> @@ -69,6 +69,7 @@ struct audit_cap_data {
>  		kernel_cap_t	effective;	/* effective set of process */
>  	};
>  	kernel_cap_t		ambient;
> +	kuid_t			rootid;
>  };
>  
>  /* When fs/namei.c:getname() is called, we store the pointer in name and bump
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index b585ceb2f7a2..461c52eff870 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -1358,6 +1358,9 @@ static void audit_log_exit(void)
>  			audit_log_cap(ab, "pi", &axs->new_pcap.inheritable);
>  			audit_log_cap(ab, "pe", &axs->new_pcap.effective);
>  			audit_log_cap(ab, "pa", &axs->new_pcap.ambient);
> +			audit_log_format(ab, " frootid=%d",
> +					 from_kuid(&init_user_ns,
> +						   axs->fcap.rootid));
>  			break; }
>  
>  		}
> @@ -2355,6 +2358,7 @@ int __audit_log_bprm_fcaps(struct linux_binprm *bprm,
>  	ax->fcap.permitted = vcaps.permitted;
>  	ax->fcap.inheritable = vcaps.inheritable;
>  	ax->fcap.fE = !!(vcaps.magic_etc & VFS_CAP_FLAGS_EFFECTIVE);
> +	ax->fcap.rootid = vcaps.rootid;
>  	ax->fcap_ver = (vcaps.magic_etc & VFS_CAP_REVISION_MASK) >> VFS_CAP_REVISION_SHIFT;
>  
>  	ax->old_pcap.permitted   = old->cap_permitted;
> diff --git a/security/commoncap.c b/security/commoncap.c
> index 232db019f051..c097f3568001 100644
> --- a/security/commoncap.c
> +++ b/security/commoncap.c
> @@ -643,6 +643,8 @@ int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data
>  	cpu_caps->permitted.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;
>  	cpu_caps->inheritable.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;
>  
> +	cpu_caps->rootid = rootkuid;
> +
>  	return 0;
>  }
>  
> -- 
> 1.8.3.1