[PATCH 1/1] audit: log binding and unbinding to netlink multicast

[Richard Guy Briggs]

On 2017-10-16 18:56, Richard Guy Briggs wrote:
> On 2017-10-13 19:58, Steve Grubb wrote:
> > Log information about programs connecting and disconnecting to the audit
> > netlink multicast socket. This is needed so that during investigations a
> > security officer can tell who or what had access to the audit trail. This
> > helps to meet the FAU_SAR.2 requirement for Common Criteria. Sample
> > event:
> > 
> > type=UNKNOWN[1332] msg=audit(1507924331.540:3): pid=1 uid=0
> > auid=4294967295 tty=(none) ses=4294967295 subj=kernel comm="systemd"
> > exe="/usr/lib/systemd/systemd" nlnk-grp=1 op=connect res=1

Please add the upstream issue tracker link to the commit description body:

See: https://github.com/linux-audit/audit-kernel/issues/28

> > Signed-off-by: sgrubb <sgrubb at redhat.com>
> 
> Reviewed-by: Richard Guy Briggs <rgb at redhat.com>
> 
> > ---
> >  include/uapi/linux/audit.h |  1 +
> >  kernel/audit.c             | 48 ++++++++++++++++++++++++++++++++++++++++++----
> >  2 files changed, 45 insertions(+), 4 deletions(-)
> > 
> > diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
> > index 0714a66f0e0c..892e63d9f2c1 100644
> > --- a/include/uapi/linux/audit.h
> > +++ b/include/uapi/linux/audit.h
> > @@ -112,6 +112,7 @@
> >  #define AUDIT_FEATURE_CHANGE	1328	/* audit log listing feature changes */
> >  #define AUDIT_REPLACE		1329	/* Replace auditd if this packet unanswerd */
> >  #define AUDIT_KERN_MODULE	1330	/* Kernel Module events */
> > +#define AUDIT_EVENT_LISTENER	1332	/* Task joined multicast read socket */
> 
> I assume this is waiting on another patch to be reviewed and merged...
> IIRC the maintainer prefers to deal with that merge conflict rather than
> accidentally leave a gap if the dependent patch doesn't get merged.
> 
> >  #define AUDIT_AVC		1400	/* SE Linux avc denial or grant */
> >  #define AUDIT_SELINUX_ERR	1401	/* Internal SE Linux Errors */
> > diff --git a/kernel/audit.c b/kernel/audit.c
> > index 1baabc9539b4..3d2461be83a8 100644
> > --- a/kernel/audit.c
> > +++ b/kernel/audit.c
> > @@ -1476,22 +1476,61 @@ static void audit_receive(struct sk_buff  *skb)
> >  	mutex_unlock(&audit_cmd_mutex);
> >  }
> >  
> > +/* Log information about who is connecting to the audit multicast socket */
> > +static void audit_log_multicast_bind(int group, const char *op, int err)
> > +{
> > +	const struct cred *cred;
> > +	struct tty_struct *tty;
> > +	char comm[sizeof(current->comm)];
> > +	struct audit_buffer *ab;
> > +
> > +	ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_EVENT_LISTENER);
> > +	if (!ab)
> > +		return;
> > +
> > +	cred = current_cred();
> > +	tty = audit_get_tty(current);
> > +
> > +	audit_log_format(ab, "pid=%u uid=%u auid=%u tty=%s ses=%u",
> > +			task_pid_nr(current),
> > +			from_kuid(&init_user_ns, cred->uid),
> > +			from_kuid(&init_user_ns, audit_get_loginuid(current)),
> > +			tty ? tty_name(tty) : "(none)",
> > +			audit_get_sessionid(current));
> > +	audit_put_tty(tty);
> > +	audit_log_task_context(ab); /* subj= */
> > +	audit_log_format(ab, " comm=");
> > +	audit_log_untrustedstring(ab, get_task_comm(comm, current));
> > +	audit_log_d_path_exe(ab, current->mm); /* exe= */
> > +	audit_log_format(ab, " nlnk-grp=%d op=%s res=%d", group, op, !err);
> > +	audit_log_end(ab);
> > +}
> > +
> >  /* Run custom bind function on netlink socket group connect or bind requests. */
> > -static int audit_bind(struct net *net, int group)
> > +static int audit_multicast_bind(struct net *net, int group)
> >  {
> > +	int err = 0;
> > +
> >  	if (!capable(CAP_AUDIT_READ))
> > -		return -EPERM;
> > +		err = -EPERM;
> > +	audit_log_multicast_bind(group, "connect", err);
> >  
> > -	return 0;
> > +	return err;
> > +}
> > +
> > +static void audit_multicast_unbind(struct net *net, int group)
> > +{
> > +	audit_log_multicast_bind(group, "disconnect", 0);
> >  }
> >  
> >  static int __net_init audit_net_init(struct net *net)
> >  {
> >  	struct netlink_kernel_cfg cfg = {
> >  		.input	= audit_receive,
> > -		.bind	= audit_bind,
> > +		.bind	= audit_multicast_bind,
> >  		.flags	= NL_CFG_F_NONROOT_RECV,
> >  		.groups	= AUDIT_NLGRP_MAX,
> > +		.unbind = audit_multicast_unbind,
> >  	};
> >  
> >  	struct audit_net *aunet = net_generic(net, audit_net_id);
> > -- 
> > 2.13.6
> > 
> > 
> > --
> > Linux-audit mailing list
> > Linux-audit at redhat.com
> > https://www.redhat.com/mailman/listinfo/linux-audit
> 
> - RGB
> 
> --
> Richard Guy Briggs <rgb at redhat.com>
> Sr. S/W Engineer, Kernel Security, Base Operating Systems
> Remote, Ottawa, Red Hat Canada
> IRC: rgb, SunRaycer
> Voice: +1.647.777.2635, Internal: (81) 32635

- RGB

--
Richard Guy Briggs <rgb at redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635