From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752388AbbGQU1a (ORCPT ); Fri, 17 Jul 2015 16:27:30 -0400 Received: from mx1.redhat.com ([209.132.183.28]:39150 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750863AbbGQU13 (ORCPT ); Fri, 17 Jul 2015 16:27:29 -0400 Date: Fri, 17 Jul 2015 16:27:23 -0400 From: Richard Guy Briggs To: Paul Moore Cc: peter@hda3.com, linux-audit@redhat.com, linux-kernel@vger.kernel.org Subject: Re: [PATCH V6 1/4] audit: implement audit by executable Message-ID: <20150717202723.GA28281@madcap2.tricolour.ca> References: <1935273.GTuYxx5kcM@sifl> <20150717153317.GH32473@madcap2.tricolour.ca> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20150717153317.GH32473@madcap2.tricolour.ca> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 15/07/17, Richard Guy Briggs wrote: > On 15/07/16, Paul Moore wrote: > > On Tuesday, July 14, 2015 11:50:23 AM Richard Guy Briggs wrote: > > > From: Eric Paris > > > > > > This patch implements the ability to filter on the executable. It is > > > clearly incomplete! This patch adds the inode/dev of the executable at > > > the moment the rule is loaded. It does not update if the executable is > > > updated/moved/whatever. That should be added. But at this moment, this > > > patch works. > > > diff --git a/kernel/auditsc.c b/kernel/auditsc.c > > > index 9fb9d1c..bf745c7 100644 > > > --- a/kernel/auditsc.c > > > +++ b/kernel/auditsc.c > > > @@ -71,6 +72,7 @@ > > > #include > > > #include > > > #include > > > +#include > > > #include > > > #include > > > #include > > > @@ -466,6 +468,20 @@ static int audit_filter_rules(struct task_struct *tsk, > > > result = audit_comparator(ctx->ppid, f->op, f->val); > > > } > > > break; > > > + case AUDIT_EXE: > > > + result = audit_exe_compare(tsk, rule->exe); > > > + break; > > > + case AUDIT_EXE_CHILDREN: > > > + { > > > + struct task_struct *ptsk; > > > + for (ptsk = tsk; ptsk->parent->pid > 0; ptsk = > > > find_task_by_vpid(ptsk->parent->pid)) { > > > + if (audit_exe_compare(ptsk, rule->exe)) { > > > + ++result; > > > + break; > > > + } > > > + } > > > + } > > > + break; > > > > I don't completely understand the point of AUDIT_EXE_CHILDREN filter, what > > problem are we trying to solve? It checks to see if there is an executable > > match starting with the current process and walking up the process' parents in > > the current pid namespace? > > Say we want to monitor /usr/sbin/apache2 and all its spawned processes. > Set up a rule that uses AUDIT_EXE_CHILDREN with /usr/sbin/apache2, then > when it spawns a cgi running perl or php, those actions will be caught. > > > Help me understand what this accomplishes, I'm a little tried right now and I > > just don't get it. > > This was Peter Moody's idea and it made sense, so we kept it. Peter, do you have anything to add to justify keeping AUDIT_EXE_CHILDREN? > > paul moore > > - RGB - RGB -- Richard Guy Briggs Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat Remote, Ottawa, Canada Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545