Re: [PATCH ghak90 V7 05/21] audit: log drop of contid on exit of last task

On 2019-10-10 20:38, Paul Moore wrote:

On Wed, Sep 18, 2019 at 9:24 PM Richard Guy Briggs [off-list ref] wrote:

quoted

Since we are tracking the life of each audit container indentifier, we
can match the creation event with the destruction event.  Log the
destruction of the audit container identifier when the last process in
that container exits.

Signed-off-by: Richard Guy Briggs <redacted>
---
 kernel/audit.c   | 32 ++++++++++++++++++++++++++++++++
 kernel/audit.h   |  2 ++
 kernel/auditsc.c |  2 ++
 3 files changed, 36 insertions(+)

diff --git a/kernel/audit.c b/kernel/audit.c
index ea0899130cc1..53d13d638c63 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c

@@ -2503,6 +2503,38 @@ int audit_set_contid(struct task_struct *task, u64 contid)
        return rc;
 }

+void audit_log_container_drop(void)
+{
+       struct audit_buffer *ab;
+       uid_t uid;
+       struct tty_struct *tty;
+       char comm[sizeof(current->comm)];
+
+       if (!current->audit || !current->audit->cont ||
+           refcount_read(&current->audit->cont->refcount) > 1)
+               return;
+       ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONTAINER_OP);
+       if (!ab)
+               return;
+
+       uid = from_kuid(&init_user_ns, task_uid(current));
+       tty = audit_get_tty();
+       audit_log_format(ab,
+                        "op=drop opid=%d contid=%llu old-contid=%llu pid=%d uid=%u auid=%u tty=%s ses=%u",
+                        task_tgid_nr(current), audit_get_contid(current),
+                        audit_get_contid(current), task_tgid_nr(current), uid,
+                        from_kuid(&init_user_ns, audit_get_loginuid(current)),
+                        tty ? tty_name(tty) : "(none)",
+                                audit_get_sessionid(current));
+       audit_put_tty(tty);
+       audit_log_task_context(ab);
+       audit_log_format(ab, " comm=");
+       audit_log_untrustedstring(ab, get_task_comm(comm, current));
+       audit_log_d_path_exe(ab, current->mm);
+       audit_log_format(ab, " res=1");
+       audit_log_end(ab);
+}

Why can't we just do this in audit_cont_put()?  Is it because we call
audit_cont_put() in the new audit_free() function?  What if we were to
do it in __audit_free()/audit_free_syscall()?

The intent was to put this before the EOE record of a syscall so we
could fill out all the fields similarly to op=set, but this could stand
alone dropping or nulling a bunch of fields.

It would also never get printed if we left it before the EOE and had the
audit signal info record keep a reference to it.

Hmmm...

paul moore

- RGB

--
Richard Guy Briggs [off-list ref]
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635