[redhat-lspp] Re: [PATCH 2/2] audit: support for object context filters
Stephen Smalley
sds at tycho.nsa.gov
Fri Jun 30 14:44:30 UTC 2006
On Thu, 2006-06-29 at 16:57 -0500, Darrel Goeddel wrote:
> This patch introduces object audit filters based on the elements
> of the SELinux context.
>
> Signed-off-by: Darrel Goeddel <dgoeddel at trustedcs.com>
Acked-by: Stephen Smalley <sds at tycho.nsa.gov>
>
> kernel/auditfilter.c | 25 +++++++++++++++++++++++++
> kernel/auditsc.c | 40 ++++++++++++++++++++++++++++++++++++++++
> security/selinux/ss/services.c | 18 +++++++++++++++++-
> 3 files changed, 82 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
> index 40a9931..7f2ea8b 100644
> --- a/kernel/auditfilter.c
> +++ b/kernel/auditfilter.c
> @@ -475,6 +475,11 @@ static struct audit_entry *audit_data_to
> case AUDIT_SUBJ_TYPE:
> case AUDIT_SUBJ_SEN:
> case AUDIT_SUBJ_CLR:
> + case AUDIT_OBJ_USER:
> + case AUDIT_OBJ_ROLE:
> + case AUDIT_OBJ_TYPE:
> + case AUDIT_OBJ_LEV_LOW:
> + case AUDIT_OBJ_LEV_HIGH:
> str = audit_unpack_string(&bufp, &remain, f->val);
> if (IS_ERR(str))
> goto exit_free;
> @@ -616,6 +621,11 @@ static struct audit_rule_data *audit_kru
> case AUDIT_SUBJ_TYPE:
> case AUDIT_SUBJ_SEN:
> case AUDIT_SUBJ_CLR:
> + case AUDIT_OBJ_USER:
> + case AUDIT_OBJ_ROLE:
> + case AUDIT_OBJ_TYPE:
> + case AUDIT_OBJ_LEV_LOW:
> + case AUDIT_OBJ_LEV_HIGH:
> data->buflen += data->values[i] =
> audit_pack_string(&bufp, f->se_str);
> break;
> @@ -659,6 +669,11 @@ static int audit_compare_rule(struct aud
> case AUDIT_SUBJ_TYPE:
> case AUDIT_SUBJ_SEN:
> case AUDIT_SUBJ_CLR:
> + case AUDIT_OBJ_USER:
> + case AUDIT_OBJ_ROLE:
> + case AUDIT_OBJ_TYPE:
> + case AUDIT_OBJ_LEV_LOW:
> + case AUDIT_OBJ_LEV_HIGH:
> if (strcmp(a->fields[i].se_str, b->fields[i].se_str))
> return 1;
> break;
> @@ -779,6 +794,11 @@ static struct audit_entry *audit_dupe_ru
> case AUDIT_SUBJ_TYPE:
> case AUDIT_SUBJ_SEN:
> case AUDIT_SUBJ_CLR:
> + case AUDIT_OBJ_USER:
> + case AUDIT_OBJ_ROLE:
> + case AUDIT_OBJ_TYPE:
> + case AUDIT_OBJ_LEV_LOW:
> + case AUDIT_OBJ_LEV_HIGH:
> err = audit_dupe_selinux_field(&new->fields[i],
> &old->fields[i]);
> break;
> @@ -1542,6 +1562,11 @@ static inline int audit_rule_has_selinux
> case AUDIT_SUBJ_TYPE:
> case AUDIT_SUBJ_SEN:
> case AUDIT_SUBJ_CLR:
> + case AUDIT_OBJ_USER:
> + case AUDIT_OBJ_ROLE:
> + case AUDIT_OBJ_TYPE:
> + case AUDIT_OBJ_LEV_LOW:
> + case AUDIT_OBJ_LEV_HIGH:
> return 1;
> }
> }
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index e183a6f..b171c1f 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -342,6 +342,46 @@ static int audit_filter_rules(struct tas
> ctx);
> }
> break;
> + case AUDIT_OBJ_USER:
> + case AUDIT_OBJ_ROLE:
> + case AUDIT_OBJ_TYPE:
> + case AUDIT_OBJ_LEV_LOW:
> + case AUDIT_OBJ_LEV_HIGH:
> + /* The above note for AUDIT_SUBJ_USER...AUDIT_SUBJ_CLR
> + also applies here */
> + if (f->se_rule) {
> + /* Find files that match */
> + if (name) {
> + result = selinux_audit_rule_match(
> + name->osid, f->type, f->op,
> + f->se_rule, ctx);
> + } else if (ctx) {
> + for (j = 0; j < ctx->name_count; j++) {
> + if (selinux_audit_rule_match(
> + ctx->names[j].osid,
> + f->type, f->op,
> + f->se_rule, ctx)) {
> + ++result;
> + break;
> + }
> + }
> + }
> + /* Find ipc objects that match */
> + if (ctx) {
> + struct audit_aux_data *aux;
> + for (aux = ctx->aux; aux;
> + aux = aux->next) {
> + if (aux->type == AUDIT_IPC) {
> + struct audit_aux_data_ipcctl *axi = (void *)aux;
> + if (selinux_audit_rule_match(axi->osid, f->type, f->op, f->se_rule, ctx)) {
> + ++result;
> + break;
> + }
> + }
> + }
> + }
> + }
> + break;
> case AUDIT_ARG0:
> case AUDIT_ARG1:
> case AUDIT_ARG2:
> diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
> index 112484f..5132002 100644
> --- a/security/selinux/ss/services.c
> +++ b/security/selinux/ss/services.c
> @@ -1858,12 +1858,17 @@ int selinux_audit_rule_init(u32 field, u
> case AUDIT_SUBJ_USER:
> case AUDIT_SUBJ_ROLE:
> case AUDIT_SUBJ_TYPE:
> + case AUDIT_OBJ_USER:
> + case AUDIT_OBJ_ROLE:
> + case AUDIT_OBJ_TYPE:
> /* only 'equals' and 'not equals' fit user, role, and type */
> if (op != AUDIT_EQUAL && op != AUDIT_NOT_EQUAL)
> return -EINVAL;
> break;
> case AUDIT_SUBJ_SEN:
> case AUDIT_SUBJ_CLR:
> + case AUDIT_OBJ_LEV_LOW:
> + case AUDIT_OBJ_LEV_HIGH:
> /* we do not allow a range, indicated by the presense of '-' */
> if (strchr(rulestr, '-'))
> return -EINVAL;
> @@ -1885,6 +1890,7 @@ int selinux_audit_rule_init(u32 field, u
>
> switch (field) {
> case AUDIT_SUBJ_USER:
> + case AUDIT_OBJ_USER:
> userdatum = hashtab_search(policydb.p_users.table, rulestr);
> if (!userdatum)
> rc = -EINVAL;
> @@ -1892,6 +1898,7 @@ int selinux_audit_rule_init(u32 field, u
> tmprule->au_ctxt.user = userdatum->value;
> break;
> case AUDIT_SUBJ_ROLE:
> + case AUDIT_OBJ_ROLE:
> roledatum = hashtab_search(policydb.p_roles.table, rulestr);
> if (!roledatum)
> rc = -EINVAL;
> @@ -1899,6 +1906,7 @@ int selinux_audit_rule_init(u32 field, u
> tmprule->au_ctxt.role = roledatum->value;
> break;
> case AUDIT_SUBJ_TYPE:
> + case AUDIT_OBJ_TYPE:
> typedatum = hashtab_search(policydb.p_types.table, rulestr);
> if (!typedatum)
> rc = -EINVAL;
> @@ -1907,6 +1915,8 @@ int selinux_audit_rule_init(u32 field, u
> break;
> case AUDIT_SUBJ_SEN:
> case AUDIT_SUBJ_CLR:
> + case AUDIT_OBJ_LEV_LOW:
> + case AUDIT_OBJ_LEV_HIGH:
> rc = mls_from_string(rulestr, &tmprule->au_ctxt, GFP_ATOMIC);
> break;
> }
> @@ -1959,6 +1969,7 @@ int selinux_audit_rule_match(u32 ctxid,
> without a match */
> switch (field) {
> case AUDIT_SUBJ_USER:
> + case AUDIT_OBJ_USER:
> switch (op) {
> case AUDIT_EQUAL:
> match = (ctxt->user == rule->au_ctxt.user);
> @@ -1969,6 +1980,7 @@ int selinux_audit_rule_match(u32 ctxid,
> }
> break;
> case AUDIT_SUBJ_ROLE:
> + case AUDIT_OBJ_ROLE:
> switch (op) {
> case AUDIT_EQUAL:
> match = (ctxt->role == rule->au_ctxt.role);
> @@ -1979,6 +1991,7 @@ int selinux_audit_rule_match(u32 ctxid,
> }
> break;
> case AUDIT_SUBJ_TYPE:
> + case AUDIT_OBJ_TYPE:
> switch (op) {
> case AUDIT_EQUAL:
> match = (ctxt->type == rule->au_ctxt.type);
> @@ -1990,7 +2003,10 @@ int selinux_audit_rule_match(u32 ctxid,
> break;
> case AUDIT_SUBJ_SEN:
> case AUDIT_SUBJ_CLR:
> - level = (field == AUDIT_SUBJ_SEN ?
> + case AUDIT_OBJ_LEV_LOW:
> + case AUDIT_OBJ_LEV_HIGH:
> + level = ((field == AUDIT_SUBJ_SEN ||
> + field == AUDIT_OBJ_LEV_LOW) ?
> &ctxt->range.level[0] : &ctxt->range.level[1]);
> switch (op) {
> case AUDIT_EQUAL:
--
Stephen Smalley
National Security Agency
More information about the redhat-lspp
mailing list