[PATCH 4/6 RFC] netfilter: ebtables: audit table registration

[Richard Guy Briggs]

Generate audit NETFILTER_CFG records on ebtables table registration.

Previously this was only being done for all x_tables operations and ebtables
table replacement.

Audit only when there is an existing syscall audit rule, otherwise issue a
standalone record only on table modification rather than empty table creation.
Include subject attributes to the new standalone NETFILTER_CFGSOLO record using
audit_log_task().

Here is a sample accompanied record:
  type=NETFILTER_CFG msg=audit(1494907217.558:5403): family=7 table=filter entries=0

and unaccompanied case:
  type=UNKNOWN[1331] msg=audit(1494723394.832:111): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=system_u:system_r:iptables_t:s0 pid=556 comm="ebtables-restor" exe="/usr/sbin/ebtables-restore" family=7 table=broute entries=1

See: https://github.com/linux-audit/audit-kernel/issues/43

Signed-off-by: Richard Guy Briggs <rgb at redhat.com>
---
 net/bridge/netfilter/ebtables.c |   26 ++++++++++++++++++++++++++
 1 files changed, 26 insertions(+), 0 deletions(-)

diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 743f9e6..7499232 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1251,6 +1251,32 @@ struct ebt_table * ebt_register_table(struct net *net,
 	}
 	list_add(&table->list, &net->xt.tables[NFPROTO_BRIDGE]);
 	mutex_unlock(&ebt_mutex);
+#ifdef CONFIG_AUDIT
+	if (audit_enabled) {
+		struct audit_buffer *ab;
+
+		if(!audit_dummy_context()) {
+			ab = audit_log_start(current->audit_context, GFP_KERNEL,
+					     AUDIT_NETFILTER_CFG);
+			if (ab) {
+				audit_log_format(ab, "family=%u table=%s entries=%u",
+						 AF_BRIDGE, repl->name,
+						 repl->nentries);
+				audit_log_end(ab);
+			}
+		} else if(repl->nentries) {
+			ab = audit_log_start(NULL, GFP_KERNEL,
+					     AUDIT_NETFILTER_CFGSOLO);
+			if (ab) {
+				audit_log_task(ab);
+				audit_log_format(ab, " family=%u table=%s entries=%u",
+						 AF_BRIDGE, repl->name,
+						 repl->nentries);
+				audit_log_end(ab);
+			}
+		}
+	}
+#endif
 	return table;
 free_unlock:
 	mutex_unlock(&ebt_mutex);
-- 
1.7.1