[RFC PATCH v1] audit: log AUDIT_TIME_* records only from rules

[Richard Guy Briggs]

On 2021-11-24 10:44, Paul Moore wrote:
> On Fri, Nov 19, 2021 at 1:02 PM Richard Guy Briggs <rgb at redhat.com> wrote:
> > On 2021-11-19 11:15, Paul Moore wrote:
> > > On Thu, Nov 4, 2021 at 5:53 PM Richard Guy Briggs <rgb at redhat.com> wrote:
> > > > On 2021-11-04 17:29, Paul Moore wrote:
> > > > > On Thu, Nov 4, 2021 at 5:00 PM Richard Guy Briggs <rgb at redhat.com> wrote:
> > > > > >
> > > > > > AUDIT_TIME_* events are generated when there are syscall rules present that are
> > > > > > not related to time keeping.  This will produce noisy log entries that could
> > > > > > flood the logs and hide events we really care about.
> > > > > >
> > > > > > Rather than immediately produce the AUDIT_TIME_* records, store the data and
> > > > > > log it at syscall exit time respecting the filter rules.
> > > > > >
> > > > > > Please see https://bugzilla.redhat.com/show_bug.cgi?id=1991919
> > > > >
> > > > > Unfortunately that URL isn't publicly accessible.  It might be helpful
> > > > > to simply add the relevant information to the commit description[1]
> > > > > and omit the link entirely.  Since this is just an RFC, please don't
> > > > > resend the patch just to include that information, you can simply
> > > > > reply to this thread with the additional info.
> > > >
> > > > Hmmm, sorry about that.  There isn't really anything in that bz that
> > > > shouldn't be public, but I'll check before openning it up...
> > > >
> > > > Basically it was a report that:
> > > > TIME_ADJNTPVAL audit events are not generated if there are no syscalls
> > > > rules, but that these events are generated when at least one unrelated
> > > > syscall rule is added.
> > > >
> > > > This behaviour was confirmed but the conclusion about what should be the
> > > > correct behaviour differed from that of the reporter.
> > >
> > > I'm still wondering about the best way to handle this situation, and I
> > > want to make sure I'm understanding the problem correctly.  So I'm
> > > clear on the problem, is the issue that the AUDIT_TIME records are
> > > being generated whenever at least one syscall filter is present,
> > > regardless of if that syscall is time related?  With the expected
> > > behavior being that AUDIT_TIME records are only generated when a time
> > > related syscall is being audited?
> >
> > Exactly.
> 
> In that case it seems pretty similar to the PATH record and I would
> think that handling it in a similar manner would be The Right Thing to
> do ... which looks like what you are doing.
> 
> You mentioned that you wanted to do some more work on this patch so
> I'll hold off further comments until the updated patch is posted.

I had a look at this patch and there is no further adjustment needed.
The only note is that the AUDIT_TIME_ADJNTPVAL record is printed at the
top of show_special() due to the need to potentially allocate multiple
records.  Do you think this requires a comment in the description or
in the code just above the call to __audit_ntp_log_()?

If not, please merge it at your convenience.  Sorry to have dropped this
ball.

> paul moore

- RGB

--
Richard Guy Briggs <rgb at redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635