[PATCH v1 0/2] lsm: Preserve full ioctl commands in audit records

["Mickaël Salaün" <mic@digikod.net>]

Hi,

Ioctl commands are unsigned int values, with conventionally encoded size
and direction fields above bit 15.  However, struct lsm_ioctlop_audit
stores only a u16 and the common audit formatter uses %hx.  SELinux also
narrows the command before constructing this audit data.  As a result,
LSM audit records can conflate distinct ioctl requests; for example,
Landlock currently records 0xc00ffeee as 0xfeee.

The narrow audit field dates to its 2015 introduction [1] alongside
SELinux ioctl extended permissions.  Using the low type and number bytes
for those policy checks was deliberate, but the mailing-list review
contains no separate decision to truncate the audit value.  Audit
discussion instead identified ioctlcmd with the ioctl request in syscall
argument a1, and the audit field dictionary defines it as the request
argument to ioctl.

This also exposes an audit2allow -x assumption: it copies ioctlcmd
directly into a 16-bit SELinux extended-permission rule.  It needs to
derive that rule from the low 16 bits of the full audited request;
otherwise checkpolicy rejects generated values above 0xffff.

Patch 1 preserves the full command in shared audit data without changing
SELinux's low-16-bit policy checks.  Patch 2 updates the existing
Landlock test to exercise upper command bits.

[1] https://lore.kernel.org/r/1428616171-14767-1-git-send-email-jeffv@google.com

Mickaël Salaün (2):
  lsm: Preserve full ioctl commands in audit records
  selftests/landlock: Check full ioctl commands in audit records

 include/linux/lsm_audit.h                  |  2 +-
 security/lsm_audit.c                       |  2 +-
 security/selinux/hooks.c                   |  6 +++---
 tools/testing/selftests/landlock/fs_test.c | 10 +++++++---
 4 files changed, 12 insertions(+), 8 deletions(-)

-- 
2.55.0