[PATCH 3/6 RFC] netfilter: audit only on xtables and ebtables syscall rule or standalone

[Pablo Neira Ayuso]

On Thu, May 18, 2017 at 01:21:49PM -0400, Richard Guy Briggs wrote:
> There were syscall events unsolicited by any audit rule caused by a missing
> !audit_dummy_context() check before creating an
> iptables/ip6tables/arptables/ebtables NETFILTER_CFG record.  Check
> !audit_dummy_context() before creating the NETFILTER_CFG record.
> 
> The vast majority of observed unaccompanied records are caused by the fedora
> default rule: "-a never,task" and the occasional early startup one is I believe
> caused by the iptables filter table module hard linked into the kernel rather
> than a loadable module. The !audit_dummy_context() check above should avoid
> them.  Audit only when there is an existing syscall audit rule, otherwise issue
> a standalone record only on table modification rather than empty table
> creation.
> 
> Add subject attributes to the new standalone NETFILTER_CFGSOLO record using
> a newly exported audit_log_task().

This new NETFILTER_CFGSOLO looks like audit infra is missing some way
to export a revision / context to userspace? It's duplicating quite a
bit of the code from what I can see in this patch.

> diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
> index 0714a66..8bee3f5 100644
> --- a/include/uapi/linux/audit.h
> +++ b/include/uapi/linux/audit.h
> @@ -112,6 +112,7 @@
>  #define AUDIT_FEATURE_CHANGE	1328	/* audit log listing feature changes */
>  #define AUDIT_REPLACE		1329	/* Replace auditd if this packet unanswerd */
>  #define AUDIT_KERN_MODULE	1330	/* Kernel Module events */
> +#define AUDIT_NETFILTER_CFGSOLO	1331	/* Netfilter chain modifications standalone */
>  
>  #define AUDIT_AVC		1400	/* SE Linux avc denial or grant */
>  #define AUDIT_SELINUX_ERR	1401	/* Internal SE Linux Errors */
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index b2dcbe6..8ac38e6 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -2383,7 +2383,7 @@ void __audit_log_kern_module(char *name)
>  	context->type = AUDIT_KERN_MODULE;
>  }
>  
> -static void audit_log_task(struct audit_buffer *ab)
> +void audit_log_task(struct audit_buffer *ab)
>  {
>  	kuid_t auid, uid;
>  	kgid_t gid;
> @@ -2404,6 +2404,7 @@ static void audit_log_task(struct audit_buffer *ab)
>  	audit_log_untrustedstring(ab, get_task_comm(comm, current));
>  	audit_log_d_path_exe(ab, current->mm);
>  }
> +EXPORT_SYMBOL_GPL(audit_log_task);
>  
>  /**
>   * audit_core_dumps - record information about processes that end abnormally
> diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
> index 13d7fe2..743f9e6 100644
> --- a/net/bridge/netfilter/ebtables.c
> +++ b/net/bridge/netfilter/ebtables.c
> @@ -1071,12 +1071,25 @@ static int do_replace_finish(struct net *net, struct ebt_replace *repl,
>  	if (audit_enabled) {
>  		struct audit_buffer *ab;
>  
> -		ab = audit_log_start(current->audit_context, GFP_KERNEL,
> -				     AUDIT_NETFILTER_CFG);
> -		if (ab) {
> -			audit_log_format(ab, "table=%s family=%u entries=%u",
> -					 repl->name, AF_BRIDGE, repl->nentries);
> -			audit_log_end(ab);
> +		if(!audit_dummy_context()) {
> +			ab = audit_log_start(current->audit_context, GFP_KERNEL,
> +					     AUDIT_NETFILTER_CFG);
> +			if (ab) {
> +				audit_log_format(ab, "family=%u table=%s entries=%u",
> +						 AF_BRIDGE, repl->name,
> +						 repl->nentries);
> +				audit_log_end(ab);
> +			}
> +		} else if(repl->nentries) {
> +			ab = audit_log_start(NULL, GFP_KERNEL,
> +					     AUDIT_NETFILTER_CFGSOLO);
> +			if (ab) {
> +				audit_log_task(ab);
> +				audit_log_format(ab, " family=%u table=%s entries=%u",
> +						 AF_BRIDGE, repl->name,
> +						 repl->nentries);
> +				audit_log_end(ab);
> +			}

If you have no other way, probably it is a good idea to wrap this code 
around a function, eg. ebt_audit_replace_finish() ?