* [PATCH ghau51/ghau40 v6 1/7] AUDIT_CONTAINER_OP message type basic support
2019-04-09 19:16 [PATCH ghau51/ghau40 v6 0/7] add support for audit container identifier Richard Guy Briggs
@ 2019-04-09 19:16 ` Richard Guy Briggs
2019-04-09 19:16 ` [PATCH ghau51/ghau40 v6 2/7] AUDIT_CONTAINER_ID " Richard Guy Briggs
` (5 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Richard Guy Briggs @ 2019-04-09 19:16 UTC (permalink / raw)
To: containers, Linux-Audit Mailing List, LKML
Cc: eparis, Steve Grubb, omosnace, Paul Moore, nhorman, Richard Guy Briggs
This defines the message number for the audit container identifier
registration record should the kernel headers not be up to date, gives
the record number a name for printing and allows the record to be
interpreted since it is in the 1000 range like AUDIT_LOGIN.
See: https://github.com/linux-audit/audit-userspace/issues/51
See: https://github.com/linux-audit/audit-kernel/issues/90
See: https://github.com/linux-audit/audit-testsuite/issues/64
See: https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
---
lib/libaudit.h | 4 ++++
lib/msg_typetab.h | 1 +
lib/netlink.c | 1 +
3 files changed, 6 insertions(+)
diff --git a/lib/libaudit.h b/lib/libaudit.h
index ca7aa63e354e..6cf20252e76f 100644
--- a/lib/libaudit.h
+++ b/lib/libaudit.h
@@ -243,6 +243,10 @@ extern "C" {
#define AUDIT_GET_FEATURE 1019 /* Get which features are enabled */
#endif
+#ifndef AUDIT_CONTAINER_OP
+#define AUDIT_CONTAINER_OP 1020 /* Container creation notice */
+#endif
+
#ifndef AUDIT_MMAP
#define AUDIT_MMAP 1323 /* Descriptor and flags in mmap */
#endif
diff --git a/lib/msg_typetab.h b/lib/msg_typetab.h
index f5d76e4f38a1..f9fa46dcfa67 100644
--- a/lib/msg_typetab.h
+++ b/lib/msg_typetab.h
@@ -44,6 +44,7 @@ _S(AUDIT_LOGIN, "LOGIN" )
//_S(AUDIT_TTY_SET, "TTY_SET" )
//_S(AUDIT_SET_FEATURE, "SET_FEATURE" )
//_S(AUDIT_GET_FEATURE, "GET_FEATURE" )
+_S(AUDIT_CONTAINER_OP, "CONTAINER_OP" )
_S(AUDIT_USER_AUTH, "USER_AUTH" )
_S(AUDIT_USER_ACCT, "USER_ACCT" )
_S(AUDIT_USER_MGMT, "USER_MGMT" )
diff --git a/lib/netlink.c b/lib/netlink.c
index 5b2028fda7e8..caa963b1ddb2 100644
--- a/lib/netlink.c
+++ b/lib/netlink.c
@@ -184,6 +184,7 @@ static int adjust_reply(struct audit_reply *rep, int len)
break;
case AUDIT_USER:
case AUDIT_LOGIN:
+ case AUDIT_CONTAINER_OP:
case AUDIT_KERNEL:
case AUDIT_FIRST_USER_MSG...AUDIT_LAST_USER_MSG:
case AUDIT_FIRST_USER_MSG2...AUDIT_LAST_USER_MSG2:
--
1.8.3.1
^ permalink raw reply [flat|nested] 8+ messages in thread* [PATCH ghau51/ghau40 v6 2/7] AUDIT_CONTAINER_ID message type basic support
2019-04-09 19:16 [PATCH ghau51/ghau40 v6 0/7] add support for audit container identifier Richard Guy Briggs
2019-04-09 19:16 ` [PATCH ghau51/ghau40 v6 1/7] AUDIT_CONTAINER_OP message type basic support Richard Guy Briggs
@ 2019-04-09 19:16 ` Richard Guy Briggs
2019-04-09 19:16 ` [PATCH ghau51/ghau40 v6 3/7] auditctl: add support for AUDIT_CONTID filter Richard Guy Briggs
` (4 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Richard Guy Briggs @ 2019-04-09 19:16 UTC (permalink / raw)
To: containers, Linux-Audit Mailing List, LKML
Cc: eparis, Steve Grubb, omosnace, Paul Moore, nhorman, Richard Guy Briggs
This defines the message number for the audit container identifier
information record should the kernel headers not be up to date and gives
the record number a name for printing.
See: https://github.com/linux-audit/audit-userspace/issues/51
See: https://github.com/linux-audit/audit-kernel/issues/90
See: https://github.com/linux-audit/audit-testsuite/issues/64
See: https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
---
lib/libaudit.h | 4 ++++
lib/msg_typetab.h | 1 +
2 files changed, 5 insertions(+)
diff --git a/lib/libaudit.h b/lib/libaudit.h
index 6cf20252e76f..b3ff8bdaa649 100644
--- a/lib/libaudit.h
+++ b/lib/libaudit.h
@@ -283,6 +283,10 @@ extern "C" {
#define AUDIT_FANOTIFY 1331 /* Fanotify access decision */
#endif
+#ifndef AUDIT_CONTAINER_ID
+#define AUDIT_CONTAINER_ID 1332 /* Container ID */
+#endif
+
#ifndef AUDIT_MAC_CALIPSO_ADD
#define AUDIT_MAC_CALIPSO_ADD 1418 /* NetLabel: add CALIPSO DOI entry */
#endif
diff --git a/lib/msg_typetab.h b/lib/msg_typetab.h
index f9fa46dcfa67..44d594d46de8 100644
--- a/lib/msg_typetab.h
+++ b/lib/msg_typetab.h
@@ -124,6 +124,7 @@ _S(AUDIT_PROCTITLE, "PROCTITLE" )
_S(AUDIT_FEATURE_CHANGE, "FEATURE_CHANGE" )
_S(AUDIT_KERN_MODULE, "KERN_MODULE" )
_S(AUDIT_FANOTIFY, "FANOTIFY" )
+_S(AUDIT_CONTAINER_ID, "CONTAINER_ID" )
_S(AUDIT_AVC, "AVC" )
_S(AUDIT_SELINUX_ERR, "SELINUX_ERR" )
_S(AUDIT_AVC_PATH, "AVC_PATH" )
--
1.8.3.1
^ permalink raw reply [flat|nested] 8+ messages in thread* [PATCH ghau51/ghau40 v6 3/7] auditctl: add support for AUDIT_CONTID filter
2019-04-09 19:16 [PATCH ghau51/ghau40 v6 0/7] add support for audit container identifier Richard Guy Briggs
2019-04-09 19:16 ` [PATCH ghau51/ghau40 v6 1/7] AUDIT_CONTAINER_OP message type basic support Richard Guy Briggs
2019-04-09 19:16 ` [PATCH ghau51/ghau40 v6 2/7] AUDIT_CONTAINER_ID " Richard Guy Briggs
@ 2019-04-09 19:16 ` Richard Guy Briggs
2019-04-09 19:16 ` [PATCH ghau51/ghau40 v6 4/7] add ausearch containerid support Richard Guy Briggs
` (3 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Richard Guy Briggs @ 2019-04-09 19:16 UTC (permalink / raw)
To: containers, Linux-Audit Mailing List, LKML
Cc: eparis, Steve Grubb, omosnace, Paul Moore, nhorman, Richard Guy Briggs
A u64 container identifier has been added to the kernel view of tasks.
This allows container orchestrators to label tasks with a unique
tamperproof identifier that gets inherited by its children to be able to
track the provenance of actions by a container.
Add support to libaudit and auditctl for the AUDIT_CONTID field to
filter based on audit container identifier. This field is specified
with the "contid" field name on the command line.
Since it is a u64 and larger than any other numeric field, send it as a
string but do the appropriate conversions on each end in each direction.
See: https://github.com/linux-audit/audit-userspace/issues/40
See: https://github.com/linux-audit/audit-kernel/issues/91
See: https://github.com/linux-audit/audit-testsuite/issues/64
See: https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
---
docs/auditctl.8 | 3 +++
lib/fieldtab.h | 1 +
lib/libaudit.c | 36 ++++++++++++++++++++++++++++++++++++
lib/libaudit.h | 7 +++++++
src/auditctl-listing.c | 21 +++++++++++++++++++++
5 files changed, 68 insertions(+)
diff --git a/docs/auditctl.8 b/docs/auditctl.8
index 2c970cf3d54d..a5327e839861 100644
--- a/docs/auditctl.8
+++ b/docs/auditctl.8
@@ -213,6 +213,9 @@ Parent's Process ID
.B sessionid
User's login session ID
.TP
+.B contid
+Process' audit container ID
+.TP
.B subj_user
Program's SE Linux User
.TP
diff --git a/lib/fieldtab.h b/lib/fieldtab.h
index c425d5b86049..4224e60bb37b 100644
--- a/lib/fieldtab.h
+++ b/lib/fieldtab.h
@@ -47,6 +47,7 @@ _S(AUDIT_OBJ_TYPE, "obj_type" )
_S(AUDIT_OBJ_LEV_LOW, "obj_lev_low" )
_S(AUDIT_OBJ_LEV_HIGH, "obj_lev_high" )
_S(AUDIT_SESSIONID, "sessionid" )
+_S(AUDIT_CONTID, "contid" )
_S(AUDIT_DEVMAJOR, "devmajor" )
_S(AUDIT_DEVMINOR, "devminor" )
diff --git a/lib/libaudit.c b/lib/libaudit.c
index 393d5bcdc030..5df5ddf85430 100644
--- a/lib/libaudit.c
+++ b/lib/libaudit.c
@@ -1742,6 +1742,42 @@ int audit_rule_fieldpair_data(struct audit_rule_data **rulep, const char *pair,
else if (strcmp(v, "unset") == 0)
rule->values[rule->field_count] = UINT_MAX;
break;
+ case AUDIT_CONTID: {
+ unsigned long long val;
+
+ if ((audit_get_features() &
+ AUDIT_FEATURE_BITMAP_CONTAINERID) == 0)
+ return -EAU_FIELDNOSUPPORT;
+ if (flags != AUDIT_FILTER_EXCLUDE &&
+ flags != AUDIT_FILTER_USER &&
+ flags != AUDIT_FILTER_EXIT)
+ return -EAU_FIELDNOFILTER;
+ if (isdigit((char)*(v)))
+ val = strtoull(v, NULL, 0);
+ else if (strlen(v) >= 2 && *(v)=='-' &&
+ (isdigit((char)*(v+1))))
+ val = strtoll(v, NULL, 0);
+ else if (strcmp(v, "unset") == 0)
+ val = ULLONG_MAX;
+ else
+ return -EAU_FIELDVALNUM;
+ if (errno)
+ return -EAU_FIELDVALNUM;
+ vlen = sizeof(unsigned long long);
+ rule->values[rule->field_count] = vlen;
+ offset = rule->buflen;
+ rule->buflen += vlen;
+ *rulep = realloc(rule, sizeof(*rule) + rule->buflen);
+ if (*rulep == NULL) {
+ free(rule);
+ audit_msg(LOG_ERR, "Cannot realloc memory!\n");
+ return -3;
+ } else {
+ rule = *rulep;
+ }
+ *(unsigned long long*)(&rule->buf[offset]) = val;
+ break;
+ }
case AUDIT_DEVMAJOR...AUDIT_INODE:
case AUDIT_SUCCESS:
if (flags != AUDIT_FILTER_EXIT)
diff --git a/lib/libaudit.h b/lib/libaudit.h
index b3ff8bdaa649..e7256a328c45 100644
--- a/lib/libaudit.h
+++ b/lib/libaudit.h
@@ -339,6 +339,9 @@ extern "C" {
#ifndef AUDIT_FEATURE_BITMAP_FILTER_FS
#define AUDIT_FEATURE_BITMAP_FILTER_FS 0x00000040
#endif
+#ifndef AUDIT_FEATURE_BITMAP_CONTAINERID
+#define AUDIT_FEATURE_BITMAP_CONTAINERID 0x00000080
+#endif
/* Defines for interfield comparison update */
#ifndef AUDIT_OBJ_UID
@@ -362,6 +365,10 @@ extern "C" {
#define AUDIT_FSTYPE 26
#endif
+#ifndef AUDIT_CONTID
+#define AUDIT_CONTID 27
+#endif
+
#ifndef AUDIT_COMPARE_UID_TO_OBJ_UID
#define AUDIT_COMPARE_UID_TO_OBJ_UID 1
#endif
diff --git a/src/auditctl-listing.c b/src/auditctl-listing.c
index f670ff9bd6e8..a62454f88b2c 100644
--- a/src/auditctl-listing.c
+++ b/src/auditctl-listing.c
@@ -25,6 +25,7 @@
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
+#include <limits.h>
#include "auditctl-listing.h"
#include "private.h"
#include "auditctl-llist.h"
@@ -460,6 +461,26 @@ static void print_rule(const struct audit_rule_data *r)
audit_operator_to_symbol(op),
audit_fstype_to_name(
r->values[i]));
+ } else if (field == AUDIT_CONTID) {
+ unsigned long long val;
+
+ if (r->values[i] == sizeof(unsigned long long)) {
+ val = *(unsigned long long*)(&r->buf[boffset]);
+
+ if (val != ULLONG_MAX)
+ printf(" -F %s%s%llu", name,
+ audit_operator_to_symbol(op),
+ val);
+ else
+ printf(" -F %s%s%s", name,
+ audit_operator_to_symbol(op),
+ "unset");
+ } else {
+ printf(" -F %s%s%s", name,
+ audit_operator_to_symbol(op),
+ "inval");
+ }
+ boffset += r->values[i];
} else {
// The default is signed decimal
printf(" -F %s%s%d", name,
--
1.8.3.1
^ permalink raw reply [flat|nested] 8+ messages in thread* [PATCH ghau51/ghau40 v6 4/7] add ausearch containerid support
2019-04-09 19:16 [PATCH ghau51/ghau40 v6 0/7] add support for audit container identifier Richard Guy Briggs
` (2 preceding siblings ...)
2019-04-09 19:16 ` [PATCH ghau51/ghau40 v6 3/7] auditctl: add support for AUDIT_CONTID filter Richard Guy Briggs
@ 2019-04-09 19:16 ` Richard Guy Briggs
2019-04-09 19:16 ` [PATCH ghau51/ghau40 v6 5/7] start normalization " Richard Guy Briggs
` (2 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Richard Guy Briggs @ 2019-04-09 19:16 UTC (permalink / raw)
To: containers, Linux-Audit Mailing List, LKML
Cc: eparis, Steve Grubb, omosnace, Paul Moore, nhorman, Richard Guy Briggs
Add support to ausearch for searching on the containerid field in
records.
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
---
src/aureport-options.c | 1 +
src/ausearch-llist.c | 2 +
src/ausearch-llist.h | 1 +
src/ausearch-match.c | 3 +
src/ausearch-options.c | 47 +++++++++++-
src/ausearch-options.h | 1 +
src/ausearch-parse.c | 197 +++++++++++++++++++++++++++++++++++++++++++++++++
7 files changed, 251 insertions(+), 1 deletion(-)
diff --git a/src/aureport-options.c b/src/aureport-options.c
index bd847d7d57f0..679c36c00985 100644
--- a/src/aureport-options.c
+++ b/src/aureport-options.c
@@ -62,6 +62,7 @@ const char *event_vmname = NULL;
long long event_exit = 0;
int event_exit_is_set = 0;
int event_ppid = -1, event_session_id = -2;
+unsigned long long int event_contid = -1;
int event_debug = 0, event_machine = -1;
/* These are used by aureport */
diff --git a/src/ausearch-llist.c b/src/ausearch-llist.c
index ef5503c34fd9..ade727a9e102 100644
--- a/src/ausearch-llist.c
+++ b/src/ausearch-llist.c
@@ -60,6 +60,7 @@ void list_create(llist *l)
l->s.arch = 0;
l->s.syscall = 0;
l->s.session_id = -2;
+ l->s.contid = -1;
l->s.uuid = NULL;
l->s.vmname = NULL;
l->s.tuid = NULL;
@@ -211,6 +212,7 @@ void list_clear(llist* l)
l->s.arch = 0;
l->s.syscall = 0;
l->s.session_id = -2;
+ l->s.contid = -1;
free(l->s.uuid);
l->s.uuid = NULL;
free(l->s.vmname);
diff --git a/src/ausearch-llist.h b/src/ausearch-llist.h
index 64e4ee1f3694..2d1f52237ce6 100644
--- a/src/ausearch-llist.h
+++ b/src/ausearch-llist.h
@@ -56,6 +56,7 @@ typedef struct
int arch; // arch
int syscall; // syscall
uint32_t session_id; // Login session id
+ __u64 contid; // Container id
long long exit; // Syscall exit code
int exit_is_set; // Syscall exit code is valid
char *hostname; // remote hostname
diff --git a/src/ausearch-match.c b/src/ausearch-match.c
index 61a11d30a09b..47c12581a963 100644
--- a/src/ausearch-match.c
+++ b/src/ausearch-match.c
@@ -113,6 +113,9 @@ int match(llist *l)
if ((event_session_id != -2) &&
(event_session_id != l->s.session_id))
return 0;
+ if ((event_contid != -1) &&
+ (event_contid != l->s.contid))
+ return 0;
if (event_exit_is_set) {
if (l->s.exit_is_set == 0)
return 0;
diff --git a/src/ausearch-options.c b/src/ausearch-options.c
index eb483e670957..609718657775 100644
--- a/src/ausearch-options.c
+++ b/src/ausearch-options.c
@@ -60,6 +60,7 @@ int event_syscall = -1, event_machine = -1;
int event_ua = 0, event_ga = 0, event_se = 0;
int just_one = 0;
uint32_t event_session_id = -2;
+unsigned long long int event_contid = -1;
long long event_exit = 0;
int event_exit_is_set = 0;
int line_buffered = 0;
@@ -88,7 +89,7 @@ struct nv_pair {
enum { S_EVENT, S_COMM, S_FILENAME, S_ALL_GID, S_EFF_GID, S_GID, S_HELP,
S_HOSTNAME, S_INTERP, S_INFILE, S_MESSAGE_TYPE, S_PID, S_SYSCALL, S_OSUCCESS,
-S_TIME_END, S_TIME_START, S_TERMINAL, S_ALL_UID, S_EFF_UID, S_UID, S_LOGINID,
+S_TIME_END, S_TIME_START, S_TERMINAL, S_ALL_UID, S_EFF_UID, S_UID, S_LOGINID, S_CONTID,
S_VERSION, S_EXACT_MATCH, S_EXECUTABLE, S_CONTEXT, S_SUBJECT, S_OBJECT,
S_PPID, S_KEY, S_RAW, S_NODE, S_IN_LOGS, S_JUST_ONE, S_SESSION, S_EXIT,
S_LINEBUFFERED, S_UUID, S_VMNAME, S_DEBUG, S_CHECKPOINT, S_ARCH, S_FORMAT,
@@ -100,6 +101,7 @@ static struct nv_pair optiontab[] = {
{ S_EVENT, "--event" },
{ S_COMM, "-c" },
{ S_COMM, "--comm" },
+ { S_CONTID, "--contid" },
{ S_CHECKPOINT, "--checkpoint" },
{ S_DEBUG, "--debug" },
{ S_EXIT, "-e" },
@@ -197,6 +199,7 @@ static void usage(void)
"\t-a,--event <Audit event id>\tsearch based on audit event id\n"
"\t--arch <CPU>\t\t\tsearch based on the CPU architecture\n"
"\t-c,--comm <Comm name>\t\tsearch based on command line name\n"
+ "\t--contid <audit container id>\tsearch based on the task's audit container id\n"
"\t--checkpoint <checkpoint file>\tsearch from last complete event\n"
"\t--debug\t\t\tWrite malformed events that are skipped to stderr\n"
"\t-e,--exit <Exit code or errno>\tsearch based on syscall exit code\n"
@@ -1182,6 +1185,48 @@ int check_params(int count, char *vars[])
}
c++;
break;
+ case S_CONTID:
+ if (!optarg) {
+ if ((c+1 < count) && vars[c+1])
+ optarg = vars[c+1];
+ else {
+ fprintf(stderr,
+ "Argument is required for %s\n",
+ vars[c]);
+ retval = -1;
+ break;
+ }
+ }
+ {
+ size_t len = strlen(optarg);
+ if (isdigit(optarg[0])) {
+ errno = 0;
+ event_contid = strtoull(optarg,NULL,0);
+ if (errno) {
+ fprintf(stderr,
+ "Numeric container ID conversion error (%s) for %s\n",
+ strerror(errno), optarg);
+ retval = -1;
+ }
+ } else if (len >= 2 && *(optarg)=='-' &&
+ (isdigit(optarg[1]))) {
+ errno = 0;
+ event_contid = strtoll(optarg, NULL, 0);
+ if (errno) {
+ retval = -1;
+ fprintf(stderr, "Error converting %s\n",
+ optarg);
+ }
+ } else {
+ fprintf(stderr,
+ "Container ID is non-numeric and unknown (%s)\n",
+ optarg);
+ retval = -1;
+ break;
+ }
+ }
+ c++;
+ break;
case S_UUID:
if (!optarg) {
fprintf(stderr,
diff --git a/src/ausearch-options.h b/src/ausearch-options.h
index 1372762b4b3e..c03256e36495 100644
--- a/src/ausearch-options.h
+++ b/src/ausearch-options.h
@@ -40,6 +40,7 @@ extern int line_buffered;
extern int event_debug;
extern pid_t event_ppid;
extern uint32_t event_session_id;
+extern unsigned long long int event_contid;
extern ilist *event_type;
/* Data type to govern output format */
diff --git a/src/ausearch-parse.c b/src/ausearch-parse.c
index cc2a06cfd2e7..931f4afd5d98 100644
--- a/src/ausearch-parse.c
+++ b/src/ausearch-parse.c
@@ -52,6 +52,8 @@ static int parse_path(const lnode *n, search_items *s);
static int parse_user(const lnode *n, search_items *s);
static int parse_obj(const lnode *n, search_items *s);
static int parse_login(const lnode *n, search_items *s);
+static int parse_container_op(const lnode *n, search_items *s);
+static int parse_container_id(const lnode *n, search_items *s);
static int parse_daemon1(const lnode *n, search_items *s);
static int parse_daemon2(const lnode *n, search_items *s);
static int parse_sockaddr(const lnode *n, search_items *s);
@@ -113,6 +115,9 @@ int extract_search_items(llist *l)
case AUDIT_LOGIN:
ret = parse_login(n, s);
break;
+ case AUDIT_CONTAINER_OP:
+ ret = parse_container_op(n, s);
+ break;
case AUDIT_IPC:
case AUDIT_OBJ_PID:
ret = parse_obj(n, s);
@@ -179,6 +184,9 @@ int extract_search_items(llist *l)
case AUDIT_TTY:
ret = parse_tty(n, s);
break;
+ case AUDIT_CONTAINER_ID:
+ ret = parse_container_id(n, s);
+ break;
default:
if (event_debug)
fprintf(stderr,
@@ -1414,6 +1422,195 @@ static int parse_login(const lnode *n, search_items *s)
return 0;
}
+static int parse_container_op(const lnode *n, search_items *s)
+{
+ char *ptr, *str, *term = n->message;
+
+ // skip op
+ // skip opid
+ // get contid
+ if (event_contid != -1) {
+ str = strstr(term, "contid=");
+ if (str == NULL)
+ return 45;
+ ptr = str + 7;
+ term = strchr(ptr, ' ');
+ if (term == NULL)
+ return 46;
+ *term = 0;
+ errno = 0;
+ s->contid = strtoull(ptr, NULL, 10);
+ if (errno)
+ return 47;
+ *term = ' ';
+ }
+ // skip old-contid
+ // get pid
+ if (event_pid != -1) {
+ str = strstr(term, "pid=");
+ if (str == NULL)
+ return 48;
+ ptr = str + 4;
+ term = strchr(ptr, ' ');
+ if (term == NULL)
+ return 49;
+ *term = 0;
+ errno = 0;
+ s->pid = strtoul(ptr, NULL, 10);
+ if (errno)
+ return 50;
+ *term = ' ';
+ }
+ // get loginuid
+ if (event_loginuid != -2 || event_tauid) {
+ str = strstr(term, "auid=");
+ if (str == NULL) {
+ return 51;
+ } else
+ ptr = str + 5;
+ term = strchr(ptr, ' ');
+ if (term == NULL)
+ return 52;
+ *term = 0;
+ errno = 0;
+ s->loginuid = strtoul(ptr, NULL, 10);
+ if (errno)
+ return 53;
+ *term = ' ';
+ s->tauid = lookup_uid("auid", s->loginuid);
+ }
+ // get uid
+ if (event_uid != -1 || event_tuid) {
+ str = strstr(term, "uid=");
+ if (str == NULL)
+ return 54;
+ ptr = str + 4;
+ term = strchr(ptr, ' ');
+ if (term == NULL)
+ return 55;
+ *term = 0;
+ errno = 0;
+ s->uid = strtoul(ptr, NULL, 10);
+ if (errno)
+ return 56;
+ *term = ' ';
+ s->tuid = lookup_uid("uid", s->uid);
+ }
+ // skip tty
+ // ses
+ if (event_session_id != -2 ) {
+ str = strstr(term, "ses=");
+ if (str == NULL)
+ return 57;
+ else
+ ptr = str + 4;
+ term = strchr(ptr, ' ');
+ if (term == NULL)
+ return 58;
+ *term = 0;
+ errno = 0;
+ s->session_id = strtoul(ptr, NULL, 10);
+ if (errno)
+ return 59;
+ *term = ' ';
+ }
+ // get subj
+ if (event_subject) {
+ str = strstr(term, "subj=");
+ if (str == NULL)
+ return 60;
+ ptr = str + 5;
+ term = strchr(ptr, ' ');
+ if (term == NULL)
+ return 61;
+ *term = 0;
+ if (audit_avc_init(s) == 0) {
+ anode an;
+
+ anode_init(&an);
+ an.scontext = strdup(str);
+ alist_append(s->avc, &an);
+ *term = ' ';
+ } else
+ return 62;
+ *term = ' ';
+ }
+ // get comm
+ if (event_comm) {
+ str = strstr(ptr, "comm=");
+ if (str == NULL)
+ return 63;
+ str += 5;
+ if (*str == '"') {
+ str++;
+ term = strchr(str, '"');
+ if (term == NULL)
+ return 64;
+ *term = 0;
+ s->comm = strdup(str);
+ *term = '"';
+ } else
+ s->comm = unescape(str);
+ }
+ // get exe
+ if (event_exe) {
+ str = strstr(term, "exe=");
+ if (str == NULL)
+ return 65;
+ str += 4;
+ if (*str == '"') {
+ str++;
+ term = strchr(str, '"');
+ if (term == NULL)
+ return 66;
+ *term = 0;
+ s->exe = strdup(str);
+ *term = '"';
+ } else
+ s->exe = unescape(str);
+ }
+ // success
+ if (event_success != S_UNSET) {
+ str = strstr(term, "res=");
+ if (str == NULL)
+ return 67;
+ ptr = str + 4;
+ term = strchr(ptr, ' ');
+ if (term)
+ return 68;
+ *term = 0;
+ errno = 0;
+ s->success = strtoul(ptr, NULL, 10);
+ if (errno)
+ return 69;
+ *term = ' ';
+ }
+ return 0;
+}
+
+static int parse_container_id(const lnode *n, search_items *s)
+{
+ char *ptr, *str, *term = n->message;
+
+ // get contid
+ if (event_contid != -1) {
+ str = strstr(term, "contid=");
+ if (str == NULL)
+ return 70;
+ ptr = str + 7;
+ term = strchr(ptr, ' ');
+ if (term == NULL)
+ return 71;
+ *term = 0;
+ errno = 0;
+ s->contid = strtoull(ptr, NULL, 10);
+ if (errno)
+ return 72;
+ *term = ' ';
+ }
+ return 0;
+}
+
static int parse_daemon1(const lnode *n, search_items *s)
{
char *ptr, *str, *term, saved, *mptr;
--
1.8.3.1
^ permalink raw reply [flat|nested] 8+ messages in thread* [PATCH ghau51/ghau40 v6 5/7] start normalization containerid support
2019-04-09 19:16 [PATCH ghau51/ghau40 v6 0/7] add support for audit container identifier Richard Guy Briggs
` (3 preceding siblings ...)
2019-04-09 19:16 ` [PATCH ghau51/ghau40 v6 4/7] add ausearch containerid support Richard Guy Briggs
@ 2019-04-09 19:16 ` Richard Guy Briggs
2019-04-09 19:16 ` [PATCH ghau51/ghau40 v6 6/7] libaudit: add support to get the task audit container identifier Richard Guy Briggs
2019-04-09 19:16 ` [PATCH ghau51/ghau40 v6 7/7] add support for audit_signal_info2 Richard Guy Briggs
6 siblings, 0 replies; 8+ messages in thread
From: Richard Guy Briggs @ 2019-04-09 19:16 UTC (permalink / raw)
To: containers, Linux-Audit Mailing List, LKML
Cc: eparis, Steve Grubb, omosnace, Paul Moore, nhorman, Richard Guy Briggs
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
---
auparse/auparse-defs.h | 3 ++-
auparse/interpret.c | 10 ++++++++++
auparse/normalize_record_map.h | 2 ++
auparse/typetab.h | 2 ++
bindings/python/auparse_python.c | 1 +
5 files changed, 17 insertions(+), 1 deletion(-)
diff --git a/auparse/auparse-defs.h b/auparse/auparse-defs.h
index 27bfa943612c..a9b144df3462 100644
--- a/auparse/auparse-defs.h
+++ b/auparse/auparse-defs.h
@@ -87,7 +87,8 @@ typedef enum { AUPARSE_TYPE_UNCLASSIFIED, AUPARSE_TYPE_UID, AUPARSE_TYPE_GID,
AUPARSE_TYPE_PROCTITLE, AUPARSE_TYPE_HOOK,
AUPARSE_TYPE_NETACTION, AUPARSE_TYPE_MACPROTO,
AUPARSE_TYPE_IOCTL_REQ, AUPARSE_TYPE_ESCAPED_KEY,
- AUPARSE_TYPE_ESCAPED_FILE, AUPARSE_TYPE_FANOTIFY } auparse_type_t;
+ AUPARSE_TYPE_ESCAPED_FILE, AUPARSE_TYPE_FANOTIFY, AUPARSE_TYPE_CONTID
+} auparse_type_t;
/* This type determines what escaping if any gets applied to interpreted fields */
typedef enum { AUPARSE_ESC_RAW, AUPARSE_ESC_TTY, AUPARSE_ESC_SHELL,
diff --git a/auparse/interpret.c b/auparse/interpret.c
index f19ee854fad6..675c804529d7 100644
--- a/auparse/interpret.c
+++ b/auparse/interpret.c
@@ -2832,6 +2832,13 @@ static const char *print_seccomp_code(const char *val)
return out;
}
+static const char *print_contid(const char *val)
+{
+ if (strcmp(val, "18446744073709551615") == 0)
+ return strdup("unset");
+ return strdup(val);
+}
+
int lookup_type(const char *name)
{
int i;
@@ -3061,6 +3068,9 @@ unknown:
case AUPARSE_TYPE_FANOTIFY:
out = print_fanotify(id->val);
break;
+ case AUPARSE_TYPE_CONTID:
+ out = print_contid(id->val);
+ break;
case AUPARSE_TYPE_MAC_LABEL:
case AUPARSE_TYPE_UNCLASSIFIED:
default:
diff --git a/auparse/normalize_record_map.h b/auparse/normalize_record_map.h
index 085437f67724..e0135c65ae85 100644
--- a/auparse/normalize_record_map.h
+++ b/auparse/normalize_record_map.h
@@ -25,6 +25,7 @@
_S(AUDIT_USER, "sent-message")
_S(AUDIT_LOGIN, "changed-login-id-to")
+_S(AUDIT_CONTAINER_OP, "changed-container-id-to")
_S(AUDIT_USER_AUTH, "authenticated")
_S(AUDIT_USER_ACCT, "was-authorized")
_S(AUDIT_USER_MGMT, "modified-user-account")
@@ -84,6 +85,7 @@ _S(AUDIT_FEATURE_CHANGE, "changed-audit-feature")
//_S(AUDIT_REPLACE,"")
_S(AUDIT_KERN_MODULE, "loaded-kernel-module")
_S(AUDIT_FANOTIFY, "accessed-policy-controlled-file")
+_S(AUDIT_CONTAINER_ID, "has-container-id")
_S(AUDIT_AVC, "accessed-mac-policy-controlled-object")
_S(AUDIT_MAC_POLICY_LOAD, "loaded-selinux-policy")
_S(AUDIT_MAC_STATUS, "changed-selinux-enforcement-to")
diff --git a/auparse/typetab.h b/auparse/typetab.h
index 0391e87f731c..0c160bb56c3b 100644
--- a/auparse/typetab.h
+++ b/auparse/typetab.h
@@ -142,3 +142,5 @@ _S(AUPARSE_TYPE_IOCTL_REQ, "ioctlcmd" )
_S(AUPARSE_TYPE_FANOTIFY, "resp" )
_S(AUPARSE_TYPE_ESCAPED, "sw" )
_S(AUPARSE_TYPE_ESCAPED, "root_dir" )
+_S(AUPARSE_TYPE_CONTID, "contid" )
+_S(AUPARSE_TYPE_CONTID, "old-contid" )
diff --git a/bindings/python/auparse_python.c b/bindings/python/auparse_python.c
index 0099ca2ceb82..9f53b6d373a1 100644
--- a/bindings/python/auparse_python.c
+++ b/bindings/python/auparse_python.c
@@ -2391,6 +2391,7 @@ initauparse(void)
PyModule_AddIntConstant(m, "AUPARSE_ESC_TTY", AUPARSE_ESC_TTY);
PyModule_AddIntConstant(m, "AUPARSE_ESC_SHELL", AUPARSE_ESC_SHELL);
PyModule_AddIntConstant(m, "AUPARSE_ESC_SHELL_QUOTE", AUPARSE_ESC_SHELL_QUOTE);
+ PyModule_AddIntConstant(m, "AUPARSE_TYPE_CONTID", AUPARSE_TYPE_CONTID);
#ifdef IS_PY3K
return m;
--
1.8.3.1
^ permalink raw reply [flat|nested] 8+ messages in thread* [PATCH ghau51/ghau40 v6 6/7] libaudit: add support to get the task audit container identifier
2019-04-09 19:16 [PATCH ghau51/ghau40 v6 0/7] add support for audit container identifier Richard Guy Briggs
` (4 preceding siblings ...)
2019-04-09 19:16 ` [PATCH ghau51/ghau40 v6 5/7] start normalization " Richard Guy Briggs
@ 2019-04-09 19:16 ` Richard Guy Briggs
2019-04-09 19:16 ` [PATCH ghau51/ghau40 v6 7/7] add support for audit_signal_info2 Richard Guy Briggs
6 siblings, 0 replies; 8+ messages in thread
From: Richard Guy Briggs @ 2019-04-09 19:16 UTC (permalink / raw)
To: containers, Linux-Audit Mailing List, LKML
Cc: eparis, Steve Grubb, omosnace, Paul Moore, nhorman, Richard Guy Briggs
Add the audit_get_containerid() call analogous to audit_getloginuid()
and audit_get_session() calls to get our own audit container identifier.
This is intended as a debug patch, not to be upstreamed.
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
---
docs/Makefile.am | 2 +-
docs/audit_get_containerid.3 | 25 +++++++++++++++++++++++++
lib/libaudit.c | 29 +++++++++++++++++++++++++++++
lib/libaudit.h | 1 +
4 files changed, 56 insertions(+), 1 deletion(-)
create mode 100644 docs/audit_get_containerid.3
diff --git a/docs/Makefile.am b/docs/Makefile.am
index 8fb030c6e5e4..209789bb2051 100644
--- a/docs/Makefile.am
+++ b/docs/Makefile.am
@@ -28,7 +28,7 @@ man_MANS = audit_add_rule_data.3 audit_add_watch.3 auditctl.8 auditd.8 \
auditd.conf.5 auditd-plugins.5 \
audit_delete_rule_data.3 audit_detect_machine.3 \
audit_encode_nv_string.3 audit_getloginuid.3 \
-audit_get_reply.3 audit_get_session.3 \
+audit_get_reply.3 audit_get_session.3 audit_get_containerid.3 \
audit_log_acct_message.3 audit_log_user_avc_message.3 \
audit_log_user_command.3 audit_log_user_comm_message.3 \
audit_log_user_message.3 audit_log_semanage_message.3 \
diff --git a/docs/audit_get_containerid.3 b/docs/audit_get_containerid.3
new file mode 100644
index 000000000000..7d11b9fa747b
--- /dev/null
+++ b/docs/audit_get_containerid.3
@@ -0,0 +1,25 @@
+.TH "AUDIT_GET_CONTAINERID" "3" "Feb 2018" "Red Hat" "Linux Audit API"
+.SH NAME
+audit_get_containerid \- Get a program's container id value
+.SH SYNOPSIS
+.B #include <libaudit.h>
+.sp
+uin32_t audit_get_containerid(void);
+
+.SH DESCRIPTION
+This function returns the task's audit container identifier attribute.
+
+.SH "RETURN VALUE"
+
+This function returns the audit container identifier value if it was set. It will return a \-1 if the audit container identifier is unset. However, since uint64_t is an unsigned type, you will see the converted value instead of \-1.
+
+.SH "ERRORS"
+
+This function returns \-2 on failure. Additionally, in the event of a real error, errno would be set. The function can set errno based on failures of open, read, or strtoul.
+
+.SH "SEE ALSO"
+
+.BR audit_getloginuid (3).
+
+.SH AUTHOR
+Steve Grubb
diff --git a/lib/libaudit.c b/lib/libaudit.c
index 5df5ddf85430..a1727f1a321a 100644
--- a/lib/libaudit.c
+++ b/lib/libaudit.c
@@ -931,6 +931,35 @@ uint32_t audit_get_session(void)
return ses;
}
+/*
+ * This function will retrieve the audit container identifier or -2 if
+ * there is an error.
+ */
+uint64_t audit_get_containerid(void)
+{
+ uint64_t containerid;
+ int len, in;
+ char buf[32];
+
+ errno = 0;
+ in = open("/proc/self/audit_containerid", O_NOFOLLOW|O_RDONLY);
+ if (in < 0)
+ return -2;
+ do {
+ len = read(in, buf, sizeof(buf));
+ } while (len < 0 && errno == EINTR);
+ close(in);
+ if (len < 0 || len >= sizeof(buf))
+ return -2;
+ buf[len] = 0;
+ errno = 0;
+ containerid = strtoull(buf, 0, 10);
+ if (errno)
+ return -2;
+ else
+ return containerid;
+}
+
int audit_rule_syscall_data(struct audit_rule_data *rule, int scall)
{
int word = AUDIT_WORD(scall);
diff --git a/lib/libaudit.h b/lib/libaudit.h
index e7256a328c45..348b50b525be 100644
--- a/lib/libaudit.h
+++ b/lib/libaudit.h
@@ -575,6 +575,7 @@ extern int audit_get_reply(int fd, struct audit_reply *rep, reply_t block,
extern uid_t audit_getloginuid(void);
extern int audit_setloginuid(uid_t uid);
extern uint32_t audit_get_session(void);
+extern uint64_t audit_get_containerid(void);
extern int audit_detect_machine(void);
extern int audit_determine_machine(const char *arch);
--
1.8.3.1
^ permalink raw reply [flat|nested] 8+ messages in thread* [PATCH ghau51/ghau40 v6 7/7] add support for audit_signal_info2
2019-04-09 19:16 [PATCH ghau51/ghau40 v6 0/7] add support for audit container identifier Richard Guy Briggs
` (5 preceding siblings ...)
2019-04-09 19:16 ` [PATCH ghau51/ghau40 v6 6/7] libaudit: add support to get the task audit container identifier Richard Guy Briggs
@ 2019-04-09 19:16 ` Richard Guy Briggs
6 siblings, 0 replies; 8+ messages in thread
From: Richard Guy Briggs @ 2019-04-09 19:16 UTC (permalink / raw)
To: containers, Linux-Audit Mailing List, LKML
Cc: eparis, Steve Grubb, omosnace, Paul Moore, nhorman, Richard Guy Briggs
Since a process in a container could potentially signal the audit daemon
(reconfig, terminate, roll log, resume), that audit container identifier
information should be made available to the audit daemon to report the
full provenance of the signal. It is not possible to add it to the
existing audit_signal_info struct without causing a kABI change.
Introduce a new audit message type AUDIT_SIGNAL_INFO2 using a new
audit_sig_info2 struct to be able to transfer this information from
kernel to userspace.
struct audit_sig_info2 {
uid_t uid;
pid_t pid;
uint64_t cid;
char ctx[0];
};
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
---
auparse/auditd-config.c | 1 +
docs/audit_request_signal_info.3 | 3 ++-
lib/libaudit.c | 53 +++++++++++++++++++++++++++++++++++++++-
lib/libaudit.h | 15 ++++++++++++
lib/msg_typetab.h | 1 +
lib/netlink.c | 4 +++
src/auditd-config.c | 1 +
src/auditd-config.h | 1 +
src/auditd-event.c | 23 ++++++++++++-----
src/auditd-reconfig.c | 32 +++++++++++++++---------
src/auditd.c | 33 ++++++++++---------------
11 files changed, 127 insertions(+), 40 deletions(-)
diff --git a/auparse/auditd-config.c b/auparse/auditd-config.c
index 59984b47bd5a..b328f3523c02 100644
--- a/auparse/auditd-config.c
+++ b/auparse/auditd-config.c
@@ -77,6 +77,7 @@ void clear_config(struct daemon_conf *config)
config->sender_uid = 0;
config->sender_pid = 0;
config->sender_ctx = NULL;
+ config->sender_cid = 0;
config->write_logs = 1;
config->log_file = strdup("/var/log/audit/audit.log");
config->log_format = LF_RAW;
diff --git a/docs/audit_request_signal_info.3 b/docs/audit_request_signal_info.3
index 873deb58bef3..2461940f6622 100644
--- a/docs/audit_request_signal_info.3
+++ b/docs/audit_request_signal_info.3
@@ -8,12 +8,13 @@ int audit_request_signal_info(int fd);
.SH "DESCRIPTION"
-audit_request_signal_info requests that the kernel send information about the sender of a signal to the audit daemon. The sinal info structure is as follows:
+audit_request_signal_info requests that the kernel send information about the sender of a signal to the audit daemon. The signal info structure is as follows:
.nf
struct audit_sig_info {
uid_t uid;
pid_t pid;
+ uint64_t cid;
char ctx[0];
};
.fi
diff --git a/lib/libaudit.c b/lib/libaudit.c
index a1727f1a321a..63273ab5bbb1 100644
--- a/lib/libaudit.c
+++ b/lib/libaudit.c
@@ -25,6 +25,7 @@
#include "config.h"
#include <stdio.h>
#include <stdarg.h>
+#include <stdbool.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
@@ -666,7 +667,11 @@ int audit_request_rules_list_data(int fd)
int audit_request_signal_info(int fd)
{
- int rc = audit_send(fd, AUDIT_SIGNAL_INFO, NULL, 0);
+ int rc;
+ if (audit_get_containerid() == (long long)-2)
+ rc = audit_send(fd, AUDIT_SIGNAL_INFO, NULL, 0);
+ else
+ rc = audit_send(fd, AUDIT_SIGNAL_INFO2, NULL, 0);
if (rc < 0)
audit_msg(LOG_WARNING,
"Error sending signal_info request (%s)",
@@ -674,6 +679,52 @@ int audit_request_signal_info(int fd)
return rc;
}
+bool audit_signal_info_is_baremsg(struct audit_reply *rep)
+{
+ if (rep->type == AUDIT_SIGNAL_INFO) {
+ if (rep->len == 24)
+ return true;
+ } else {
+ if(rep->len == 24 + sizeof(uint64_t))
+ return true;
+ }
+ return false;
+}
+
+char *audit_format_signal_info(char *buf, int len, char *op, struct audit_reply *rep, char *res)
+{
+ if (rep->type == AUDIT_SIGNAL_INFO)
+ snprintf(buf, len,
+ "op=%s auid=%u pid=%d subj=%s res=%s",
+ op,
+ rep->signal_info->uid,
+ rep->signal_info->pid,
+ audit_signal_info_is_baremsg(rep) ? "?" :
+ rep->signal_info->ctx,
+ res);
+ else
+ if (rep->signal_info2->cid == (uint64_t)-1)
+ snprintf(buf, len,
+ "op=%s auid=%u pid=%d subj=%s res=%s",
+ op,
+ rep->signal_info2->uid,
+ rep->signal_info2->pid,
+ audit_signal_info_is_baremsg(rep) ? "?" :
+ rep->signal_info2->ctx,
+ res);
+ else
+ snprintf(buf, len,
+ "op=%s auid=%u pid=%d subj=%s res=%s contid=%llu",
+ op,
+ rep->signal_info2->uid,
+ rep->signal_info2->pid,
+ audit_signal_info_is_baremsg(rep) ? "?" :
+ rep->signal_info2->ctx,
+ res,
+ (unsigned long long)rep->signal_info2->cid);
+ return buf;
+}
+
int audit_update_watch_perms(struct audit_rule_data *rule, int perms)
{
unsigned int i, done=0;
diff --git a/lib/libaudit.h b/lib/libaudit.h
index 348b50b525be..a473c8d46d51 100644
--- a/lib/libaudit.h
+++ b/lib/libaudit.h
@@ -34,6 +34,7 @@ extern "C" {
#include <linux/netlink.h>
#include <linux/audit.h>
#include <stdarg.h>
+#include <stdbool.h>
#include <syslog.h>
@@ -247,6 +248,10 @@ extern "C" {
#define AUDIT_CONTAINER_OP 1020 /* Container creation notice */
#endif
+#ifndef AUDIT_SIGNAL_INFO2
+#define AUDIT_SIGNAL_INFO2 1021 /* auditd signal sender info */
+#endif
+
#ifndef AUDIT_MMAP
#define AUDIT_MMAP 1323 /* Descriptor and flags in mmap */
#endif
@@ -476,6 +481,13 @@ struct audit_sig_info {
char ctx[0];
};
+struct audit_sig_info2 {
+ uid_t uid;
+ pid_t pid;
+ uint64_t cid;
+ char ctx[0];
+};
+
/* defines for audit subsystem */
#define MAX_AUDIT_MESSAGE_LENGTH 8970 // PATH_MAX*2+CONTEXT_SIZE*2+11+256+1
struct audit_message {
@@ -501,6 +513,7 @@ struct audit_reply {
char *message;
struct nlmsgerr *error;
struct audit_sig_info *signal_info;
+ struct audit_sig_info2 *signal_info2;
struct daemon_conf *conf;
#ifdef AUDIT_FEATURE_BITMAP_ALL
struct audit_features *features;
@@ -578,6 +591,8 @@ extern uint32_t audit_get_session(void);
extern uint64_t audit_get_containerid(void);
extern int audit_detect_machine(void);
extern int audit_determine_machine(const char *arch);
+extern bool audit_signal_info_is_baremsg(struct audit_reply *rep);
+extern char *audit_format_signal_info(char *buf, int len, char *op, struct audit_reply *rep, char *res);
/* Translation functions */
extern int audit_name_to_field(const char *field);
diff --git a/lib/msg_typetab.h b/lib/msg_typetab.h
index 44d594d46de8..5c8f991f9516 100644
--- a/lib/msg_typetab.h
+++ b/lib/msg_typetab.h
@@ -44,6 +44,7 @@ _S(AUDIT_LOGIN, "LOGIN" )
//_S(AUDIT_TTY_SET, "TTY_SET" )
//_S(AUDIT_SET_FEATURE, "SET_FEATURE" )
//_S(AUDIT_GET_FEATURE, "GET_FEATURE" )
+//_S(AUDIT_SIGNAL_INFO2, "SIGNAL_INFO2" )
_S(AUDIT_CONTAINER_OP, "CONTAINER_OP" )
_S(AUDIT_USER_AUTH, "USER_AUTH" )
_S(AUDIT_USER_ACCT, "USER_ACCT" )
diff --git a/lib/netlink.c b/lib/netlink.c
index caa963b1ddb2..66a3a3b7e83c 100644
--- a/lib/netlink.c
+++ b/lib/netlink.c
@@ -146,6 +146,7 @@ static int adjust_reply(struct audit_reply *rep, int len)
rep->message = NULL;
rep->error = NULL;
rep->signal_info = NULL;
+ rep->signal_info2 = NULL;
rep->conf = NULL;
#if defined(HAVE_DECL_AUDIT_FEATURE_VERSION) && \
defined(HAVE_STRUCT_AUDIT_STATUS_FEATURE_BITMAP)
@@ -194,6 +195,9 @@ static int adjust_reply(struct audit_reply *rep, int len)
case AUDIT_SIGNAL_INFO:
rep->signal_info = NLMSG_DATA(rep->nlh);
break;
+ case AUDIT_SIGNAL_INFO2:
+ rep->signal_info2 = NLMSG_DATA(rep->nlh);
+ break;
}
return len;
}
diff --git a/src/auditd-config.c b/src/auditd-config.c
index ce260de5025a..931bbed22199 100644
--- a/src/auditd-config.c
+++ b/src/auditd-config.c
@@ -307,6 +307,7 @@ void clear_config(struct daemon_conf *config)
config->sender_uid = 0;
config->sender_pid = 0;
config->sender_ctx = NULL;
+ config->sender_cid = 0;
config->write_logs = 1;
config->log_file = strdup("/var/log/audit/audit.log");
config->log_format = LF_ENRICHED;
diff --git a/src/auditd-config.h b/src/auditd-config.h
index 50ed3507d34c..c3f8941713e2 100644
--- a/src/auditd-config.h
+++ b/src/auditd-config.h
@@ -49,6 +49,7 @@ struct daemon_conf
uid_t sender_uid; /* the uid for sender of sighup */
pid_t sender_pid; /* the pid for sender of sighup */
const char *sender_ctx; /* the context for the sender of sighup */
+ uint64_t sender_cid; /* the contid for sender of sighup */
unsigned int write_logs;
const char *log_file;
logging_formats log_format;
diff --git a/src/auditd-event.c b/src/auditd-event.c
index ef2828d8df94..016e96d8fe1b 100644
--- a/src/auditd-event.c
+++ b/src/auditd-event.c
@@ -1315,15 +1315,21 @@ static void reconfigure(struct auditd_event *e)
uid_t uid = nconf->sender_uid;
pid_t pid = nconf->sender_pid;
const char *ctx = nconf->sender_ctx;
+ uint64_t cid = nconf->sender_cid;
struct timeval tv;
char txt[MAX_AUDIT_MESSAGE_LENGTH];
char date[40];
unsigned int seq_num;
int need_size_check = 0, need_reopen = 0, need_space_check = 0;
- snprintf(txt, sizeof(txt),
- "config change requested by pid=%d auid=%u subj=%s",
- pid, uid, ctx);
+ if (cid == -1)
+ snprintf(txt, sizeof(txt),
+ "config change requested by pid=%d auid=%u subj=%s",
+ pid, uid, ctx);
+ else
+ snprintf(txt, sizeof(txt),
+ "config change requested by pid=%d auid=%u subj=%s contid=%llu",
+ pid, uid, ctx, (unsigned long long)cid);
audit_msg(LOG_NOTICE, "%s", txt);
/* Do the reconfiguring. These are done in a specific
@@ -1571,9 +1577,14 @@ static void reconfigure(struct auditd_event *e)
}
e->reply.type = AUDIT_DAEMON_CONFIG;
- e->reply.len = snprintf(e->reply.msg.data, MAX_AUDIT_MESSAGE_LENGTH-2,
- "%s op=reconfigure state=changed auid=%u pid=%d subj=%s res=success",
- date, uid, pid, ctx );
+ if (cid == -1)
+ e->reply.len = snprintf(e->reply.msg.data, MAX_AUDIT_MESSAGE_LENGTH-2,
+ "%s op=reconfigure state=changed auid=%u pid=%d subj=%s res=success",
+ date, uid, pid, ctx);
+ else
+ e->reply.len = snprintf(e->reply.msg.data, MAX_AUDIT_MESSAGE_LENGTH-2,
+ "%s op=reconfigure state=changed auid=%u pid=%d subj=%s res=success contid=%llu",
+ date, uid, pid, ctx, (unsigned long long)cid);
e->reply.message = e->reply.msg.data;
free((char *)ctx);
}
diff --git a/src/auditd-reconfig.c b/src/auditd-reconfig.c
index a03e29aa57ab..490400de5bd3 100644
--- a/src/auditd-reconfig.c
+++ b/src/auditd-reconfig.c
@@ -101,13 +101,24 @@ static void *config_thread_main(void *arg)
if (load_config(&new_config, TEST_AUDITD) == 0) {
/* We will re-use the current reply */
- new_config.sender_uid = e->reply.signal_info->uid;
- new_config.sender_pid = e->reply.signal_info->pid;
- if (e->reply.len > 24)
- new_config.sender_ctx =
- strdup(e->reply.signal_info->ctx);
- else
+ if (e->reply.type == AUDIT_SIGNAL_INFO) {
+ new_config.sender_uid = e->reply.signal_info->uid;
+ new_config.sender_pid = e->reply.signal_info->pid;
+ new_config.sender_cid = (uint64_t)-1;
+ } else {
+ new_config.sender_uid = e->reply.signal_info2->uid;
+ new_config.sender_pid = e->reply.signal_info2->pid;
+ new_config.sender_cid = e->reply.signal_info2->cid;
+ }
+ if (audit_signal_info_is_baremsg(&e->reply)) {
new_config.sender_ctx = strdup("?");
+ } else if (e->reply.type == AUDIT_SIGNAL_INFO)
+ new_config.sender_ctx =
+ strdup(e->reply.signal_info->ctx);
+ else {
+ new_config.sender_ctx =
+ strdup(e->reply.signal_info2->ctx);
+ }
memcpy(e->reply.msg.data, &new_config, sizeof(new_config));
e->reply.conf = (struct daemon_conf *)e->reply.msg.data;
e->reply.type = AUDIT_DAEMON_RECONFIG;
@@ -115,12 +126,9 @@ static void *config_thread_main(void *arg)
} else {
// need to send a failed event message
char txt[MAX_AUDIT_MESSAGE_LENGTH];
- snprintf(txt, sizeof(txt),
- "op=reconfigure state=no-change auid=%u pid=%d subj=%s res=failed",
- e->reply.signal_info->uid,
- e->reply.signal_info->pid,
- (e->reply.len > 24) ?
- e->reply.signal_info->ctx : "?");
+ audit_format_signal_info(txt, sizeof(txt),
+ "reconfigure-no-change",
+ &e->reply, "failed");
// FIXME: need to figure out sending this
//send_audit_event(AUDIT_DAEMON_CONFIG, txt);
free_config(&new_config);
diff --git a/src/auditd.c b/src/auditd.c
index 8aa5be9b88a9..f03ed7505676 100644
--- a/src/auditd.c
+++ b/src/auditd.c
@@ -514,6 +514,7 @@ static void netlink_handler(struct ev_loop *loop, struct ev_io *io,
case AUDIT_FIRST_DAEMON...AUDIT_LAST_DAEMON:
break;
case AUDIT_SIGNAL_INFO:
+ case AUDIT_SIGNAL_INFO2:
if (hup_info_requested) {
audit_msg(LOG_DEBUG,
"HUP detected, starting config manager");
@@ -528,31 +529,28 @@ static void netlink_handler(struct ev_loop *loop, struct ev_io *io,
hup_info_requested = 0;
} else if (usr1_info_requested) {
char usr1[MAX_AUDIT_MESSAGE_LENGTH];
- if (cur_event->reply.len == 24) {
+ if (audit_signal_info_is_baremsg(&cur_event->reply)) {
snprintf(usr1, sizeof(usr1),
"op=rotate-logs auid=-1 pid=-1 subj=?");
} else {
- snprintf(usr1, sizeof(usr1),
- "op=rotate-logs auid=%u pid=%d subj=%s",
- cur_event->reply.signal_info->uid,
- cur_event->reply.signal_info->pid,
- cur_event->reply.signal_info->ctx);
+ audit_format_signal_info(usr1, sizeof(usr1),
+ "rotate-logs",
+ &cur_event->reply,
+ "success");
}
send_audit_event(AUDIT_DAEMON_ROTATE, usr1);
usr1_info_requested = 0;
} else if (usr2_info_requested) {
char usr2[MAX_AUDIT_MESSAGE_LENGTH];
- if (cur_event->reply.len == 24) {
+ if (audit_signal_info_is_baremsg(&cur_event->reply)) {
snprintf(usr2, sizeof(usr2),
"op=resume-logging auid=-1 "
"pid=-1 subj=? res=success");
} else {
- snprintf(usr2, sizeof(usr2),
- "op=resume-logging "
- "auid=%u pid=%d subj=%s res=success",
- cur_event->reply.signal_info->uid,
- cur_event->reply.signal_info->pid,
- cur_event->reply.signal_info->ctx);
+ audit_format_signal_info(usr2, sizeof(usr2),
+ "resume-logging",
+ &cur_event->reply,
+ "success");
}
resume_logging();
libdisp_resume();
@@ -993,12 +991,7 @@ int main(int argc, char *argv[])
rc = get_reply(fd, &trep, rc);
if (rc > 0) {
char txt[MAX_AUDIT_MESSAGE_LENGTH];
- snprintf(txt, sizeof(txt),
- "op=terminate auid=%u "
- "pid=%d subj=%s res=success",
- trep.signal_info->uid,
- trep.signal_info->pid,
- trep.signal_info->ctx);
+ audit_format_signal_info(txt, sizeof(txt), "terminate", &trep, "success");
send_audit_event(AUDIT_DAEMON_END, txt);
}
}
@@ -1091,7 +1084,7 @@ static int get_reply(int fd, struct audit_reply *rep, int seq)
continue;
/* If its not what we are expecting, keep looping */
- if (rep->type == AUDIT_SIGNAL_INFO)
+ if (rep->type == AUDIT_SIGNAL_INFO || rep->type == AUDIT_SIGNAL_INFO2)
return 1;
/* If we get done or error, break out */
--
1.8.3.1
^ permalink raw reply [flat|nested] 8+ messages in thread