Re: [PATCH] netfilter: Record uid and gid in xt_AUDIT

[Paul Moore <paul@paul-moore.com>]

On Wed, Oct 9, 2024 at 6:34 PM Florian Westphal <fw@strlen.de> wrote:
> Paul Moore <paul@paul-moore.com> wrote:
> > On Wed, Oct 9, 2024 at 5:34 PM Florian Westphal <fw@strlen.de> wrote:
> > > Richard Weinberger <richard@nod.at> wrote:
> > > > When recording audit events for new outgoing connections,
> > > > it is helpful to log the user info of the associated socket,
> > > > if available.
> > > > Therefore, check if the skb has a socket, and if it does,
> > > > log the owning fsuid/fsgid.
> > >
> > > AFAIK audit isn't namespace aware at all (neither netns nor userns), so I
> > > wonder how to handle this.
> > >
> > > We can't reject adding a -j AUDIT rule for non-init-net (we could, but I'm sure
> > > it'll break some setups...).
> > >
> > > But I wonder if we should at least skip the uid if the user namespace is
> > > 'something else'.
> >
> > This isn't unique to netfilter and the approach we take in the rest of
> > audit is to always display UIDs/GIDs in the context of the
> > init_user_ns; grep for from_kuid() in kernel/audit*.c.
>
> Hmm, audit_netlink_ok() bails with -ECONNREFUSED for current_user_ns()
> != &init_user_ns, so audit_log_common_recv_msg() won't be called from
> tasks that reside in a different userns.

We have a requirement that the audit daemon and audit management tools
run in the initial user namespace, but these are the audit collection
and configuration mechanisms, not the audit record generation
mechanisms.  Regardless of the namespace limitations on auditd and
auditctl, we want to collect audit records across the system, which is
what we are doing in audit_tg().

> If you say its fine and audit can figure out that the retuned
> uid is not related to the initial user namespace, then ok.
>
> I was worried audit records could blame wrong/bogus user id.

Correct me if I'm wrong, but by using from_kXid(&init_user_ns, Xid) we
get the ID number that is correct for the init namespace, yes?  If so,
that's what we want as right now all of the audit records, filters,
etc. are intended to be set from the context of the initial namespace.

-- 
paul-moore.com