Re: [PATCH ghak90 V9 02/13] audit: add container id

On Sat, Jun 27, 2020 at 9:22 AM Richard Guy Briggs [off-list ref] wrote:

Implement the proc fs write to set the audit container identifier of a
process, emitting an AUDIT_CONTAINER_OP record to document the event.

This is a write from the container orchestrator task to a proc entry of
the form /proc/PID/audit_containerid where PID is the process ID of the
newly created task that is to become the first task in a container, or
an additional task added to a container.

The write expects up to a u64 value (unset: 18446744073709551615).

The writer must have capability CAP_AUDIT_CONTROL.

This will produce a record such as this:
  type=CONTAINER_OP msg=audit(2018-06-06 12:39:29.636:26949) : op=set opid=2209 contid=123456 old-contid=18446744073709551615

The "op" field indicates an initial set.  The "opid" field is the
object's PID, the process being "contained".  New and old audit
container identifier values are given in the "contid" fields.

It is not permitted to unset the audit container identifier.
A child inherits its parent's audit container identifier.

Store the audit container identifier in a refcounted kernel object that
is added to the master list of audit container identifiers.  This will
allow multiple container orchestrators/engines to work on the same
machine without danger of inadvertantly re-using an existing identifier.
It will also allow an orchestrator to inject a process into an existing
container by checking if the original container owner is the one
injecting the task.  A hash table list is used to optimize searches.

Please see the github audit kernel issue for the main feature:
  https://github.com/linux-audit/audit-kernel/issues/90
Please see the github audit userspace issue for supporting additions:
  https://github.com/linux-audit/audit-userspace/issues/51
Please see the github audit testsuiite issue for the test case:
  https://github.com/linux-audit/audit-testsuite/issues/64
Please see the github audit wiki for the feature overview:
  https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID

Signed-off-by: Richard Guy Briggs <redacted>
Acked-by: Serge Hallyn <serge@hallyn.com>
Acked-by: Steve Grubb <redacted>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Reviewed-by: Ondrej Mosnacek <omosnace@redhat.com>
---
 fs/proc/base.c             |  36 +++++++++++
 include/linux/audit.h      |  33 ++++++++++
 include/uapi/linux/audit.h |   2 +
 kernel/audit.c             | 148 +++++++++++++++++++++++++++++++++++++++++++++
 kernel/audit.h             |   8 +++
 5 files changed, 227 insertions(+)

...

This is quasi-nitpicky, but it seems like audit_contid_valid() and
audit_contid_set() should be moved to kernel/audit.h if possible
(possibly even kernel/audit.c).  Maybe I'll see something later in the
patchset, but right now I'm struggling to think of why anyone outside
of audit would need to call these functions.

You should check your locking; I'm used to seeing exclusive locks
(e.g. the spinlock) around list adds/removes, it just reads/traversals
that can be done with just the RCU lock held.

+               kfree_rcu(cont, rcu);
+       }
+}

Another nitpick, but it might be nice to have similar arguments to the
_get() and _put() functions, e.g. struct audit_contobj, but that is
some serious bikeshedding (basically rename _hold() to _get() and
rename _hold to audit_task_contid_hold() or similar).

The RCU locks aren't strictly necessary here, are they?  In fact I
suppose we could probably just replace the _get() call with a
refcount_set(1) just as we do in audit_set_contid(), yes?

See my question/comment in patch 1/13; this check may not be needed or
it may need to be changed to something other than "!task->audit".

+       read_lock(&tasklist_lock);
+       /* Don't allow the contid to be unset */
+       if (!audit_contid_valid(contid)) {
+               rc = -EINVAL;
+               goto unlock;
+       }
+       /* if we don't have caps, reject */
+       if (!capable(CAP_AUDIT_CONTROL)) {
+               rc = -EPERM;
+               goto unlock;
+       }
+       /* if task has children or is not single-threaded, deny */
+       if (!list_empty(&task->children) ||
+           !(thread_group_leader(task) && thread_group_empty(task))) {
+               rc = -EBUSY;
+               goto unlock;
+       }
+       /* if contid is already set, deny */
+       if (audit_contid_set(task))
+               rc = -EEXIST;
+unlock:

Can we move the "unlock" target to the end of the function where it
just handles the unlocking and returns an error, including the
AUDIT_CONTAINER_OP record if necessary?  From what I can see we only
jump to "unlock" in case of error where we are not going to set the
audit container ID, yet the "unlock" target is placed in a misleading
location in the middle of the function.  It may be that everything
works correctly, but I would argue this is a bad practice that
increases the likelihood of buggy behavior in future code changes.

If you can't find way to arrange the code nicely, just duplicate the
"tasklist_lock" unlock operation in the error handlers before jumping
down to the end of the function.  It isn't perfect, but I believe it
will be a lot less fragile than the current approach.

+       read_unlock(&tasklist_lock);
+       rcu_read_lock();
+       oldcont = _audit_contobj_get(task);
+       if (!rc) {
+               struct audit_contobj *cont = NULL, *newcont = NULL;
+               int h = audit_hash_contid(contid);
+
+               spin_lock(&audit_contobj_list_lock);
+               list_for_each_entry_rcu(cont, &audit_contid_hash[h], list)
+                       if (cont->id == contid) {
+                               /* task injection to existing container */
+                               if (current == cont->owner) {
+                                       _audit_contobj_hold(cont);
+                                       newcont = cont;
+                               } else {
+                                       rc = -ENOTUNIQ;
+                                       spin_unlock(&audit_contobj_list_lock);
+                                       goto conterror;
+                               }
+                               break;
+                       }
+               if (!newcont) {
+                       newcont = kmalloc(sizeof(*newcont), GFP_ATOMIC);
+                       if (newcont) {
+                               INIT_LIST_HEAD(&newcont->list);
+                               newcont->id = contid;
+                               newcont->owner = get_task_struct(current);
+                               refcount_set(&newcont->refcount, 1);
+                               list_add_rcu(&newcont->list,
+                                            &audit_contid_hash[h]);
+                       } else {
+                               rc = -ENOMEM;
+                               spin_unlock(&audit_contobj_list_lock);
+                               goto conterror;
+                       }
+               }
+               spin_unlock(&audit_contobj_list_lock);
+               task->audit->cont = newcont;
+               _audit_contobj_put(oldcont);
+       }
+conterror:
+       task_unlock(task);
+
+       if (!audit_enabled)
+               return rc;
+
+       ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_CONTAINER_OP);
+       if (!ab)
+               return rc;
+
+       audit_log_format(ab,
+                        "op=set opid=%d contid=%llu old-contid=%llu",
+                        task_tgid_nr(task), contid, oldcont ? oldcont->id : -1);
+       _audit_contobj_put(oldcont);
+       rcu_read_unlock();
+       audit_log_end(ab);
+       return rc;
+}

--
paul moore
www.paul-moore.com