proposed interface changes for filesystem audit

[Amy Griffis]

Hello,

The current approach to filesystem auditing requires some changes to
the kernel-userspace interface.  We've discussed these in various
conversations on IRC, but Steve asked me to summarize the changes here
so we can review them collectively.

Comments appreciated.

Thanks,
Amy


Kernel-Userspace Interface Changes
----------------------------------
Following are the proposed changes to the kernel-userspace interface:

(1) A new version of struct audit_rule that supports string fields.

    struct audit_rule_xprt {
        uint32_t                flags;
        uint32_t                action;
        uint32_t                field_count;
        uint32_t                mask[AUDIT_BITMASK_SIZE];
        uint32_t                fields[AUDIT_MAX_FIELDS];
        uint32_t                values[AUDIT_MAX_FIELDS];
        uint32_t                buflen;
        char                    buf[0];
    };

    This struct adds two fields, buf and buflen, to the fields
    currently defined in struct audit_rule.  The field buf is a
    variable length string that could potentially hold any number of
    null-delimited string fields.  When defining a string field, the
    fields[] element specifies the field type and the values[] element
    specifies the length of the string field.  String fields in the
    buffer are processed in the order in which they occur in the
    fields[],values[] arrays.

    In the case of filesystem watches, the string path is converted to
    an inode number for use in the actual filter.  If we decide to
    support other string fields in filters, the performance impact of
    doing a strcmp() should be understood.

(2) New netlink message types for adding, removing and listing rules
    with a string field, i.e.:  

    AUDIT_ADD_RULE
    AUDIT_DEL_RULE
    AUDIT_LIST_RULES

    When the kernel receives a message type of AUDIT_ADD, AUDIT_DEL,
    or AUDIT_LIST, it will interpret the data using the older
    audit_rule struct.
    
(3) A new rule field type, i.e.:

    AUDIT_PATHNAME
    
(4) To accommodate these changes, libaudit must provide new routines
    for adding, removing and listing rules using the new struct and
    message types, i.e.:

    extern int  audit_req_rules_buf(int fd);
    extern int  audit_add_rule_buf(int fd, struct audit_rule_xprt *rule);
    extern int  audit_del_rule_buf(int fd, struct audit_rule_xprt *rule);

(5) Libaudit must add struct audit_rule_xprt to the union in
    struct audit_reply.


Command Line Changes
--------------------
The following changes would be necessary for the auditctl command to
support the proposed changes to the kernel-userspace interface:

(1) A new field allowed for the -F option, i.e.:

    -F path=/home/watchme

    Additionally, the inode and path fields should not be specified in
    the same rule, as the inode field would be ignored.

(2) A set of filesystem-related aliases for groups of system calls.
    Currently, one alias "all" is provided that maps to the full set
    of system calls on a given arch.

    Here are some examples of other aliases that could be provided:

    fs-create:  creat,link,mkdir,mknod,open,rename,symlink
    fs-remove:  rename,rmdir,unlink
    fs-attr:    chmod,chown,fchmod,fchown,fremovexattr,fsetxattr,lchown,
                lremovexattr,lsetxattr,removexattr,setxattr,truncate,utime(s)
    fs-all:     all filesystem-related syscalls

(3) If backward compatibility with the -w,-W, and -p options is
    desired, auditctl could be modified to populate an audit_rule_xprt
    struct with the provided path string and a set of syscalls that
    maps to the previous behavior.  For example, "-p w" would map to
    the syscalls specified by the fs-create, fs-remove and fs-attr
    aliases above, while -w by itself would map to the fs-all alias.