[PATCH ghak64 V3] audit: add saddr_fam filter field

[Richard Guy Briggs]

On 2019-05-10 11:28, Paul Moore wrote:
> On Thu, May 9, 2019 at 8:02 PM Richard Guy Briggs <rgb at redhat.com> wrote:
> >
> > Provide a method to filter out sockaddr and bind calls by network
> > address family.
> >
> > Existing SOCKADDR records are listed for any network activity.
> > Implement the AUDIT_SADDR_FAM field selector to be able to classify or
> > limit records to specific network address families, such as AF_INET or
> > AF_INET6.
> >
> > An example of a network record that is unlikely to be useful and flood
> > the logs:
> >
> > type=SOCKADDR msg=audit(07/27/2017 12:18:27.019:845) : saddr={ fam=local
> > path=/var/run/nscd/socket }
> > type=SYSCALL msg=audit(07/27/2017 12:18:27.019:845) : arch=x86_64
> > syscall=connect success=no exit=ENOENT(No such file or directory) a0=0x3
> > a1=0x7fff229c4980 a2=0x6e a3=0x6 items=1 ppid=3301 pid=6145 auid=sgrubb
> > uid=sgrubb gid=sgrubb euid=sgrubb suid=sgrubb fsuid=sgrubb egid=sgrubb
> > sgid=sgrubb fsgid=sgrubb tty=pts3 ses=4 comm=bash exe=/usr/bin/bash
> > subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
> > key=network-test
> >
> > Please see the audit-testsuite PR at
> > https://github.com/linux-audit/audit-testsuite/pull/87
> > Please see the github issue
> > https://github.com/linux-audit/audit-kernel/issues/64
> > Please see the github issue for the accompanying userspace support
> > https://github.com/linux-audit/audit-userspace/issues/93
> >
> > Signed-off-by: Richard Guy Briggs <rgb at redhat.com>
> > ---
> > Changelog:
> > v2:
> > - rebase on ghak73 v2
> > - check for valid range of saddr_fam value
> > v3:
> > - eliminate AF_UNSPEC check
> >
> >  include/uapi/linux/audit.h | 1 +
> >  kernel/auditfilter.c       | 5 +++++
> >  kernel/auditsc.c           | 5 +++++
> >  3 files changed, 11 insertions(+)
> >
> > diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
> > index a1280af20336..c89c6495983d 100644
> > --- a/include/uapi/linux/audit.h
> > +++ b/include/uapi/linux/audit.h
> > @@ -281,6 +281,7 @@
> >  #define AUDIT_OBJ_GID  110
> >  #define AUDIT_FIELD_COMPARE    111
> >  #define AUDIT_EXE      112
> > +#define AUDIT_SADDR_FAM        113
> >
> >  #define AUDIT_ARG0      200
> >  #define AUDIT_ARG1      (AUDIT_ARG0+1)
> > diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
> > index 5beb2244d5ba..df8a7d6184dc 100644
> > --- a/kernel/auditfilter.c
> > +++ b/kernel/auditfilter.c
> > @@ -387,6 +387,7 @@ static int audit_field_valid(struct audit_entry *entry, struct audit_field *f)
> >         case AUDIT_SUCCESS:
> >         case AUDIT_INODE:
> >         case AUDIT_SESSIONID:
> > +       case AUDIT_SADDR_FAM:
> >                 /* bit ops are only useful on syscall args */
> >                 if (f->op == Audit_bitmask || f->op == Audit_bittest)
> >                         return -EINVAL;
> > @@ -438,6 +439,10 @@ static int audit_field_valid(struct audit_entry *entry, struct audit_field *f)
> >                 if (f->val > AUDIT_MAX_FIELD_COMPARE)
> >                         return -EINVAL;
> >                 break;
> > +       case AUDIT_SADDR_FAM:
> > +               if (f->val >= AF_MAX)
> > +                       return -EINVAL;
> > +               break;
> 
> The f->val check looks better, thank you.  However, I just noticed
> that it appears you've added two AUDIT_SADDR_FAM cases to the switch
> statement?

They are in seperate switch statements that depend on the ghak73
refactoring patch to separate out field/op validity from a few value
checks.

> >         default:
> >                 break;
> >         }
> > diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> > index 4bd0ec60a0e8..aab364804b9b 100644
> > --- a/kernel/auditsc.c
> > +++ b/kernel/auditsc.c
> > @@ -623,6 +623,11 @@ static int audit_filter_rules(struct task_struct *tsk,
> >                 case AUDIT_LOGINUID_SET:
> >                         result = audit_comparator(audit_loginuid_set(tsk), f->op, f->val);
> >                         break;
> > +               case AUDIT_SADDR_FAM:
> > +                       if (ctx->sockaddr)
> > +                               result = audit_comparator(ctx->sockaddr->ss_family,
> > +                                                         f->op, f->val);
> > +                       break;
> >                 case AUDIT_SUBJ_USER:
> >                 case AUDIT_SUBJ_ROLE:
> >                 case AUDIT_SUBJ_TYPE:
> 
> -- 
> paul moore
> www.paul-moore.com

- RGB

--
Richard Guy Briggs <rgb at redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635