[RFC][PATCH] collect security labels on user processes generating audit messages

[Steve Grubb]

On Wednesday 15 February 2006 13:20, Steve Grubb wrote:
> > type=PATH msg=audit(1140192875.311:3789): name="(null)" flags=1
> > inode=6537222 dev=fd:01 mode=0100664 ouid=501 ogid=501 rdev=00:00
>
> Wait a second...notice the quote marks around (null). When you have a
> genuine (null) they are not there.
>
> type=PATH msg=audit(02/14/2006 08:54:27.096:24) : item=1 name=(null)
> inode=34681 dev=03:06 mode=dir,700 ouid=root ogid=root rdev=00:00
> obj=system_u:object_r:automount_tmp_t:s0

OK, I chased this down to make sure of what is happening. The audit working 
group has a test kernel, lspp.8, that has all the future audit and lspp 
patches in it for testing. (it can be found at 
http://people.redhat.com/sgrubb/files/lspp). There is a patch 
linux-2.6-audit-git.patch, which is not upstream, but should be in the next 
kernel. That changes the code in audit_log_exit of auditsc.c to:

                if (context->names[i].name)
                        audit_log_untrustedstring(ab, context->names[i].name);
                else
                        audit_log_format(ab, "(null)");

The code in audit_log_untrustedstring does this:

        while (*p) {
                if (*p == '"' || *p == '(' || *p < 0x21 || *p > 0x7f) {
                        audit_log_hex(ab, string, strlen(string));
                        return;
                }
                p++;
        }
        audit_log_format(ab, "\"%s\"", string);

This means that a real NULL will never have the double-quote marks around it, 
where a file named \(null\) will always have double-quote marks around it. I 
confirmed this by looking in the audit logs. 

However...ausearch does not make this distinction in its output. I will see 
what I can do to make the necessary adjustments to ausearch so that its more 
obvious. So, I think that puts this issue to bed...

-Steve