[v2,3/4] seccomp: Audit attempts to modify the actions_logged sysctl
diff mbox

Message ID 1525276400-7161-4-git-send-email-tyhicks@canonical.com
State New
Headers show

Commit Message

Tyler Hicks May 2, 2018, 3:53 p.m. UTC
The decision to log a seccomp action will always be subject to the
value of the kernel.seccomp.actions_logged sysctl, even for processes
that are being inspected via the audit subsystem, in an upcoming patch.
Therefore, we need to emit an audit record on attempts at writing to the
actions_logged sysctl when auditing is enabled.

This patch updates the write handler for the actions_logged sysctl to
emit an audit record on attempts to write to the sysctl. Successful
writes to the sysctl will result in a record that includes a normalized
list of logged actions in the "actions" field and a "res" field equal to
0. Unsuccessful writes to the sysctl will result in a record that
doesn't include the "actions" field and has a "res" field equal to 1.

Not all unsuccessful writes to the sysctl are audited. For example, an
audit record will not be emitted if an unprivileged process attempts to
open the sysctl file for reading since that access control check is not
part of the sysctl's write handler.

Below are some example audit records when writing various strings to the
actions_logged sysctl.

Writing "not-a-real-action", when the kernel.seccomp.actions_logged
sysctl previously was "kill_process kill_thread trap errno trace log",
emits this audit record:

 type=CONFIG_CHANGE msg=audit(1525275273.537:130): op=seccomp-logging
 old-actions=kill_process,kill_thread,trap,errno,trace,log res=0

If you then write "kill_process kill_thread errno trace log", this audit
record is emitted:

 type=CONFIG_CHANGE msg=audit(1525275310.208:136): op=seccomp-logging
 actions=kill_process,kill_thread,errno,trace,log
 old-actions=kill_process,kill_thread,trap,errno,trace,log res=1

If you then write the string "log log errno trace kill_process
kill_thread", which is unordered and contains the log action twice,
it results in the same actions value as the previous record:

 type=CONFIG_CHANGE msg=audit(1525275325.613:142): op=seccomp-logging
 actions=kill_process,kill_thread,errno,trace,log
 old-actions=kill_process,kill_thread,errno,trace,log res=1

No audit records are generated when reading the actions_logged sysctl.

Suggested-by: Steve Grubb <sgrubb@redhat.com>
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
---
 include/linux/audit.h |  5 +++++
 kernel/auditsc.c      | 25 +++++++++++++++++++++++++
 kernel/seccomp.c      | 51 ++++++++++++++++++++++++++++++++++++++++++---------
 3 files changed, 72 insertions(+), 9 deletions(-)

Comments

Steve Grubb May 2, 2018, 6:18 p.m. UTC | #1
On Wednesday, May 2, 2018 11:53:19 AM EDT Tyler Hicks wrote:
> The decision to log a seccomp action will always be subject to the
> value of the kernel.seccomp.actions_logged sysctl, even for processes
> that are being inspected via the audit subsystem, in an upcoming patch.
> Therefore, we need to emit an audit record on attempts at writing to the
> actions_logged sysctl when auditing is enabled.
> 
> This patch updates the write handler for the actions_logged sysctl to
> emit an audit record on attempts to write to the sysctl. Successful
> writes to the sysctl will result in a record that includes a normalized
> list of logged actions in the "actions" field and a "res" field equal to
> 0. Unsuccessful writes to the sysctl will result in a record that
> doesn't include the "actions" field and has a "res" field equal to 1.
> 
> Not all unsuccessful writes to the sysctl are audited. For example, an
> audit record will not be emitted if an unprivileged process attempts to
> open the sysctl file for reading since that access control check is not
> part of the sysctl's write handler.
> 
> Below are some example audit records when writing various strings to the
> actions_logged sysctl.
> 
> Writing "not-a-real-action", when the kernel.seccomp.actions_logged
> sysctl previously was "kill_process kill_thread trap errno trace log",
> emits this audit record:
> 
>  type=CONFIG_CHANGE msg=audit(1525275273.537:130): op=seccomp-logging
>  old-actions=kill_process,kill_thread,trap,errno,trace,log res=0
> 
> If you then write "kill_process kill_thread errno trace log", this audit
> record is emitted:
> 
>  type=CONFIG_CHANGE msg=audit(1525275310.208:136): op=seccomp-logging
>  actions=kill_process,kill_thread,errno,trace,log
>  old-actions=kill_process,kill_thread,trap,errno,trace,log res=1
> 
> If you then write the string "log log errno trace kill_process
> kill_thread", which is unordered and contains the log action twice,
> it results in the same actions value as the previous record:
> 
>  type=CONFIG_CHANGE msg=audit(1525275325.613:142): op=seccomp-logging
>  actions=kill_process,kill_thread,errno,trace,log
>  old-actions=kill_process,kill_thread,errno,trace,log res=1
> 
> No audit records are generated when reading the actions_logged sysctl.

ACK for the format of the records.

-Steve

> Suggested-by: Steve Grubb <sgrubb@redhat.com>
> Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
> ---
>  include/linux/audit.h |  5 +++++
>  kernel/auditsc.c      | 25 +++++++++++++++++++++++++
>  kernel/seccomp.c      | 51
> ++++++++++++++++++++++++++++++++++++++++++--------- 3 files changed, 72
> insertions(+), 9 deletions(-)
> 
> diff --git a/include/linux/audit.h b/include/linux/audit.h
> index 75d5b03..d4e35e7 100644
> --- a/include/linux/audit.h
> +++ b/include/linux/audit.h
> @@ -233,6 +233,8 @@ extern void __audit_inode_child(struct inode *parent,
>  				const struct dentry *dentry,
>  				const unsigned char type);
>  extern void __audit_seccomp(unsigned long syscall, long signr, int code);
> +extern void audit_seccomp_actions_logged(const char *names,
> +					 const char *old_names, int res);
>  extern void __audit_ptrace(struct task_struct *t);
> 
>  static inline bool audit_dummy_context(void)
> @@ -502,6 +504,9 @@ static inline void __audit_seccomp(unsigned long
> syscall, long signr, int code) { }
>  static inline void audit_seccomp(unsigned long syscall, long signr, int
> code) { }
> +static inline void audit_seccomp_actions_logged(const char *names,
> +						const char *old_names, int res)
> +{ }
>  static inline int auditsc_get_stamp(struct audit_context *ctx,
>  			      struct timespec64 *t, unsigned int *serial)
>  {
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index 4e0a4ac..5a0b770 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -2478,6 +2478,31 @@ void __audit_seccomp(unsigned long syscall, long
> signr, int code) audit_log_end(ab);
>  }
> 
> +void audit_seccomp_actions_logged(const char *names, const char
> *old_names, +				  int res)
> +{
> +	struct audit_buffer *ab;
> +
> +	if (!audit_enabled)
> +		return;
> +
> +	ab = audit_log_start(current->audit_context, GFP_KERNEL,
> +			     AUDIT_CONFIG_CHANGE);
> +	if (unlikely(!ab))
> +		return;
> +
> +	audit_log_format(ab, "op=seccomp-logging");
> +
> +	if (names)
> +		audit_log_format(ab, " actions=%s", names);
> +
> +	if (old_names)
> +		audit_log_format(ab, " old-actions=%s", old_names);
> +
> +	audit_log_format(ab, " res=%d", res);
> +	audit_log_end(ab);
> +}
> +
>  struct list_head *audit_killed_trees(void)
>  {
>  	struct audit_context *ctx = current->audit_context;
> diff --git a/kernel/seccomp.c b/kernel/seccomp.c
> index b36ac1e..da78835 100644
> --- a/kernel/seccomp.c
> +++ b/kernel/seccomp.c
> @@ -1219,11 +1219,10 @@ static int read_actions_logged(struct ctl_table
> *ro_table, void __user *buffer, }
> 
>  static int write_actions_logged(struct ctl_table *ro_table, void __user
> *buffer, -				size_t *lenp, loff_t *ppos)
> +				size_t *lenp, loff_t *ppos, u32 *actions_logged)
>  {
>  	char names[sizeof(seccomp_actions_avail)];
>  	struct ctl_table table;
> -	u32 actions_logged;
>  	int ret;
> 
>  	if (!capable(CAP_SYS_ADMIN))
> @@ -1238,24 +1237,58 @@ static int write_actions_logged(struct ctl_table
> *ro_table, void __user *buffer, if (ret)
>  		return ret;
> 
> -	if (!seccomp_actions_logged_from_names(&actions_logged, table.data))
> +	if (!seccomp_actions_logged_from_names(actions_logged, table.data))
>  		return -EINVAL;
> 
> -	if (actions_logged & SECCOMP_LOG_ALLOW)
> +	if (*actions_logged & SECCOMP_LOG_ALLOW)
>  		return -EINVAL;
> 
> -	seccomp_actions_logged = actions_logged;
> +	seccomp_actions_logged = *actions_logged;
>  	return 0;
>  }
> 
> +static void audit_actions_logged(u32 actions_logged, u32
> old_actions_logged, +				 int ret)
> +{
> +	char names[sizeof(seccomp_actions_avail)];
> +	char old_names[sizeof(seccomp_actions_avail)];
> +	const char *new = names;
> +	const char *old = old_names;
> +
> +	if (!audit_enabled)
> +		return;
> +
> +	memset(names, 0, sizeof(names));
> +	memset(old_names, 0, sizeof(old_names));
> +
> +	if (ret || !seccomp_names_from_actions_logged(names, sizeof(names),
> +						      actions_logged, ","))
> +		new = NULL;
> +
> +	if (!seccomp_names_from_actions_logged(old_names, sizeof(old_names),
> +					       old_actions_logged, ","))
> +		old = NULL;
> +
> +	return audit_seccomp_actions_logged(new, old, !ret);
> +}
> +
>  static int seccomp_actions_logged_handler(struct ctl_table *ro_table, int
> write, void __user *buffer, size_t *lenp,
>  					  loff_t *ppos)
>  {
> -	if (write)
> -		return write_actions_logged(ro_table, buffer, lenp, ppos);
> -	else
> -		return read_actions_logged(ro_table, buffer, lenp, ppos);
> +	int ret;
> +
> +	if (write) {
> +		u32 actions_logged = 0;
> +		u32 old_actions_logged = seccomp_actions_logged;
> +
> +		ret = write_actions_logged(ro_table, buffer, lenp, ppos,
> +					   &actions_logged);
> +		audit_actions_logged(actions_logged, old_actions_logged, ret);
> +	} else
> +		ret = read_actions_logged(ro_table, buffer, lenp, ppos);
> +
> +	return ret;
>  }
> 
>  static struct ctl_path seccomp_sysctl_path[] = {




--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
James Morris May 2, 2018, 9:17 p.m. UTC | #2
On Wed, 2 May 2018, Tyler Hicks wrote:

>  type=CONFIG_CHANGE msg=audit(1525275325.613:142): op=seccomp-logging
>  actions=kill_process,kill_thread,errno,trace,log
>  old-actions=kill_process,kill_thread,errno,trace,log res=1
> 
> No audit records are generated when reading the actions_logged sysctl.
> 
> Suggested-by: Steve Grubb <sgrubb@redhat.com>
> Signed-off-by: Tyler Hicks <tyhicks@canonical.com>


Reviewed-by: James Morris <james.morris@microsoft.com>
Paul Moore May 3, 2018, 8:18 p.m. UTC | #3
On Wed, May 2, 2018 at 2:18 PM, Steve Grubb <sgrubb@redhat.com> wrote:
> On Wednesday, May 2, 2018 11:53:19 AM EDT Tyler Hicks wrote:
>> The decision to log a seccomp action will always be subject to the
>> value of the kernel.seccomp.actions_logged sysctl, even for processes
>> that are being inspected via the audit subsystem, in an upcoming patch.
>> Therefore, we need to emit an audit record on attempts at writing to the
>> actions_logged sysctl when auditing is enabled.
>>
>> This patch updates the write handler for the actions_logged sysctl to
>> emit an audit record on attempts to write to the sysctl. Successful
>> writes to the sysctl will result in a record that includes a normalized
>> list of logged actions in the "actions" field and a "res" field equal to
>> 0. Unsuccessful writes to the sysctl will result in a record that
>> doesn't include the "actions" field and has a "res" field equal to 1.
>>
>> Not all unsuccessful writes to the sysctl are audited. For example, an
>> audit record will not be emitted if an unprivileged process attempts to
>> open the sysctl file for reading since that access control check is not
>> part of the sysctl's write handler.
>>
>> Below are some example audit records when writing various strings to the
>> actions_logged sysctl.
>>
>> Writing "not-a-real-action", when the kernel.seccomp.actions_logged
>> sysctl previously was "kill_process kill_thread trap errno trace log",
>> emits this audit record:
>>
>>  type=CONFIG_CHANGE msg=audit(1525275273.537:130): op=seccomp-logging
>>  old-actions=kill_process,kill_thread,trap,errno,trace,log res=0
>>
>> If you then write "kill_process kill_thread errno trace log", this audit
>> record is emitted:
>>
>>  type=CONFIG_CHANGE msg=audit(1525275310.208:136): op=seccomp-logging
>>  actions=kill_process,kill_thread,errno,trace,log
>>  old-actions=kill_process,kill_thread,trap,errno,trace,log res=1
>>
>> If you then write the string "log log errno trace kill_process
>> kill_thread", which is unordered and contains the log action twice,
>> it results in the same actions value as the previous record:
>>
>>  type=CONFIG_CHANGE msg=audit(1525275325.613:142): op=seccomp-logging
>>  actions=kill_process,kill_thread,errno,trace,log
>>  old-actions=kill_process,kill_thread,errno,trace,log res=1
>>
>> No audit records are generated when reading the actions_logged sysctl.
>
> ACK for the format of the records.

I just wanted to clarify the record format with you Steve ... the
"actions" and "old-actions" fields may not be included in the record
in cases where there is an error building the action value string, are
you okay with that or would you prefer the fields to always be
included but with a "?" for the value?
Steve Grubb May 3, 2018, 8:42 p.m. UTC | #4
On Thursday, May 3, 2018 4:18:26 PM EDT Paul Moore wrote:
> On Wed, May 2, 2018 at 2:18 PM, Steve Grubb <sgrubb@redhat.com> wrote:
> > On Wednesday, May 2, 2018 11:53:19 AM EDT Tyler Hicks wrote:
> >> The decision to log a seccomp action will always be subject to the
> >> value of the kernel.seccomp.actions_logged sysctl, even for processes
> >> that are being inspected via the audit subsystem, in an upcoming patch.
> >> Therefore, we need to emit an audit record on attempts at writing to the
> >> actions_logged sysctl when auditing is enabled.
> >> 
> >> This patch updates the write handler for the actions_logged sysctl to
> >> emit an audit record on attempts to write to the sysctl. Successful
> >> writes to the sysctl will result in a record that includes a normalized
> >> list of logged actions in the "actions" field and a "res" field equal to
> >> 0. Unsuccessful writes to the sysctl will result in a record that
> >> doesn't include the "actions" field and has a "res" field equal to 1.
> >> 
> >> Not all unsuccessful writes to the sysctl are audited. For example, an
> >> audit record will not be emitted if an unprivileged process attempts to
> >> open the sysctl file for reading since that access control check is not
> >> part of the sysctl's write handler.
> >> 
> >> Below are some example audit records when writing various strings to the
> >> actions_logged sysctl.
> >> 
> >> Writing "not-a-real-action", when the kernel.seccomp.actions_logged
> >> sysctl previously was "kill_process kill_thread trap errno trace log",
> >> 
> >> emits this audit record:
> >>  type=CONFIG_CHANGE msg=audit(1525275273.537:130): op=seccomp-logging
> >>  old-actions=kill_process,kill_thread,trap,errno,trace,log res=0
> >> 
> >> If you then write "kill_process kill_thread errno trace log", this audit
> >> 
> >> record is emitted:
> >>  type=CONFIG_CHANGE msg=audit(1525275310.208:136): op=seccomp-logging
> >>  actions=kill_process,kill_thread,errno,trace,log
> >>  old-actions=kill_process,kill_thread,trap,errno,trace,log res=1
> >> 
> >> If you then write the string "log log errno trace kill_process
> >> kill_thread", which is unordered and contains the log action twice,
> >> 
> >> it results in the same actions value as the previous record:
> >>  type=CONFIG_CHANGE msg=audit(1525275325.613:142): op=seccomp-logging
> >>  actions=kill_process,kill_thread,errno,trace,log
> >>  old-actions=kill_process,kill_thread,errno,trace,log res=1
> >> 
> >> No audit records are generated when reading the actions_logged sysctl.
> > 
> > ACK for the format of the records.
> 
> I just wanted to clarify the record format with you Steve ... the
> "actions" and "old-actions" fields may not be included in the record
> in cases where there is an error building the action value string, are
> you okay with that or would you prefer the fields to always be
> included but with a "?" for the value?

A ? would be more in line with how other things are handled.

-Steve



--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Paul Moore May 3, 2018, 8:48 p.m. UTC | #5
On Thu, May 3, 2018 at 4:42 PM, Steve Grubb <sgrubb@redhat.com> wrote:
> On Thursday, May 3, 2018 4:18:26 PM EDT Paul Moore wrote:
>> On Wed, May 2, 2018 at 2:18 PM, Steve Grubb <sgrubb@redhat.com> wrote:
>> > On Wednesday, May 2, 2018 11:53:19 AM EDT Tyler Hicks wrote:
>> >> The decision to log a seccomp action will always be subject to the
>> >> value of the kernel.seccomp.actions_logged sysctl, even for processes
>> >> that are being inspected via the audit subsystem, in an upcoming patch.
>> >> Therefore, we need to emit an audit record on attempts at writing to the
>> >> actions_logged sysctl when auditing is enabled.
>> >>
>> >> This patch updates the write handler for the actions_logged sysctl to
>> >> emit an audit record on attempts to write to the sysctl. Successful
>> >> writes to the sysctl will result in a record that includes a normalized
>> >> list of logged actions in the "actions" field and a "res" field equal to
>> >> 0. Unsuccessful writes to the sysctl will result in a record that
>> >> doesn't include the "actions" field and has a "res" field equal to 1.
>> >>
>> >> Not all unsuccessful writes to the sysctl are audited. For example, an
>> >> audit record will not be emitted if an unprivileged process attempts to
>> >> open the sysctl file for reading since that access control check is not
>> >> part of the sysctl's write handler.
>> >>
>> >> Below are some example audit records when writing various strings to the
>> >> actions_logged sysctl.
>> >>
>> >> Writing "not-a-real-action", when the kernel.seccomp.actions_logged
>> >> sysctl previously was "kill_process kill_thread trap errno trace log",
>> >>
>> >> emits this audit record:
>> >>  type=CONFIG_CHANGE msg=audit(1525275273.537:130): op=seccomp-logging
>> >>  old-actions=kill_process,kill_thread,trap,errno,trace,log res=0
>> >>
>> >> If you then write "kill_process kill_thread errno trace log", this audit
>> >>
>> >> record is emitted:
>> >>  type=CONFIG_CHANGE msg=audit(1525275310.208:136): op=seccomp-logging
>> >>  actions=kill_process,kill_thread,errno,trace,log
>> >>  old-actions=kill_process,kill_thread,trap,errno,trace,log res=1
>> >>
>> >> If you then write the string "log log errno trace kill_process
>> >> kill_thread", which is unordered and contains the log action twice,
>> >>
>> >> it results in the same actions value as the previous record:
>> >>  type=CONFIG_CHANGE msg=audit(1525275325.613:142): op=seccomp-logging
>> >>  actions=kill_process,kill_thread,errno,trace,log
>> >>  old-actions=kill_process,kill_thread,errno,trace,log res=1
>> >>
>> >> No audit records are generated when reading the actions_logged sysctl.
>> >
>> > ACK for the format of the records.
>>
>> I just wanted to clarify the record format with you Steve ... the
>> "actions" and "old-actions" fields may not be included in the record
>> in cases where there is an error building the action value string, are
>> you okay with that or would you prefer the fields to always be
>> included but with a "?" for the value?
>
> A ? would be more in line with how other things are handled.

That's what I thought.

Would you mind putting together a v3 Tyler? :)
Tyler Hicks May 3, 2018, 8:51 p.m. UTC | #6
On 05/03/2018 03:48 PM, Paul Moore wrote:
> On Thu, May 3, 2018 at 4:42 PM, Steve Grubb <sgrubb@redhat.com> wrote:
>> On Thursday, May 3, 2018 4:18:26 PM EDT Paul Moore wrote:
>>> On Wed, May 2, 2018 at 2:18 PM, Steve Grubb <sgrubb@redhat.com> wrote:
>>>> On Wednesday, May 2, 2018 11:53:19 AM EDT Tyler Hicks wrote:
>>>>> The decision to log a seccomp action will always be subject to the
>>>>> value of the kernel.seccomp.actions_logged sysctl, even for processes
>>>>> that are being inspected via the audit subsystem, in an upcoming patch.
>>>>> Therefore, we need to emit an audit record on attempts at writing to the
>>>>> actions_logged sysctl when auditing is enabled.
>>>>>
>>>>> This patch updates the write handler for the actions_logged sysctl to
>>>>> emit an audit record on attempts to write to the sysctl. Successful
>>>>> writes to the sysctl will result in a record that includes a normalized
>>>>> list of logged actions in the "actions" field and a "res" field equal to
>>>>> 0. Unsuccessful writes to the sysctl will result in a record that
>>>>> doesn't include the "actions" field and has a "res" field equal to 1.
>>>>>
>>>>> Not all unsuccessful writes to the sysctl are audited. For example, an
>>>>> audit record will not be emitted if an unprivileged process attempts to
>>>>> open the sysctl file for reading since that access control check is not
>>>>> part of the sysctl's write handler.
>>>>>
>>>>> Below are some example audit records when writing various strings to the
>>>>> actions_logged sysctl.
>>>>>
>>>>> Writing "not-a-real-action", when the kernel.seccomp.actions_logged
>>>>> sysctl previously was "kill_process kill_thread trap errno trace log",
>>>>>
>>>>> emits this audit record:
>>>>>  type=CONFIG_CHANGE msg=audit(1525275273.537:130): op=seccomp-logging
>>>>>  old-actions=kill_process,kill_thread,trap,errno,trace,log res=0
>>>>>
>>>>> If you then write "kill_process kill_thread errno trace log", this audit
>>>>>
>>>>> record is emitted:
>>>>>  type=CONFIG_CHANGE msg=audit(1525275310.208:136): op=seccomp-logging
>>>>>  actions=kill_process,kill_thread,errno,trace,log
>>>>>  old-actions=kill_process,kill_thread,trap,errno,trace,log res=1
>>>>>
>>>>> If you then write the string "log log errno trace kill_process
>>>>> kill_thread", which is unordered and contains the log action twice,
>>>>>
>>>>> it results in the same actions value as the previous record:
>>>>>  type=CONFIG_CHANGE msg=audit(1525275325.613:142): op=seccomp-logging
>>>>>  actions=kill_process,kill_thread,errno,trace,log
>>>>>  old-actions=kill_process,kill_thread,errno,trace,log res=1
>>>>>
>>>>> No audit records are generated when reading the actions_logged sysctl.
>>>>
>>>> ACK for the format of the records.
>>>
>>> I just wanted to clarify the record format with you Steve ... the
>>> "actions" and "old-actions" fields may not be included in the record
>>> in cases where there is an error building the action value string, are
>>> you okay with that or would you prefer the fields to always be
>>> included but with a "?" for the value?
>>
>> A ? would be more in line with how other things are handled.
> 
> That's what I thought.
> 
> Would you mind putting together a v3 Tyler? :)

To be clear, "?" is only to be used when the call to
seccomp_names_from_actions_logged() fails, right?

If the sysctl write fails for some other reason, such as when an invalid
action name is specified, can you confirm that you still want *no*
"actions" field, the "old-actions" field to be the value prior to
attempting the update to the sysctl, and res to be 0?

Tyler
Steve Grubb May 3, 2018, 9:12 p.m. UTC | #7
On Thursday, May 3, 2018 4:51:36 PM EDT Tyler Hicks wrote:
> On 05/03/2018 03:48 PM, Paul Moore wrote:
> > On Thu, May 3, 2018 at 4:42 PM, Steve Grubb <sgrubb@redhat.com> wrote:
> >> On Thursday, May 3, 2018 4:18:26 PM EDT Paul Moore wrote:
> >>> On Wed, May 2, 2018 at 2:18 PM, Steve Grubb <sgrubb@redhat.com> wrote:
> >>>> On Wednesday, May 2, 2018 11:53:19 AM EDT Tyler Hicks wrote:
> >>>>> The decision to log a seccomp action will always be subject to the
> >>>>> value of the kernel.seccomp.actions_logged sysctl, even for processes
> >>>>> that are being inspected via the audit subsystem, in an upcoming
> >>>>> patch.
> >>>>> Therefore, we need to emit an audit record on attempts at writing to
> >>>>> the
> >>>>> actions_logged sysctl when auditing is enabled.
> >>>>> 
> >>>>> This patch updates the write handler for the actions_logged sysctl to
> >>>>> emit an audit record on attempts to write to the sysctl. Successful
> >>>>> writes to the sysctl will result in a record that includes a
> >>>>> normalized
> >>>>> list of logged actions in the "actions" field and a "res" field equal
> >>>>> to
> >>>>> 0. Unsuccessful writes to the sysctl will result in a record that
> >>>>> doesn't include the "actions" field and has a "res" field equal to 1.
> >>>>> 
> >>>>> Not all unsuccessful writes to the sysctl are audited. For example,
> >>>>> an
> >>>>> audit record will not be emitted if an unprivileged process attempts
> >>>>> to
> >>>>> open the sysctl file for reading since that access control check is
> >>>>> not
> >>>>> part of the sysctl's write handler.
> >>>>> 
> >>>>> Below are some example audit records when writing various strings to
> >>>>> the
> >>>>> actions_logged sysctl.
> >>>>> 
> >>>>> Writing "not-a-real-action", when the kernel.seccomp.actions_logged
> >>>>> sysctl previously was "kill_process kill_thread trap errno trace
> >>>>> log",
> >>>>> 
> >>>>> emits this audit record:
> >>>>>  type=CONFIG_CHANGE msg=audit(1525275273.537:130): op=seccomp-logging
> >>>>>  old-actions=kill_process,kill_thread,trap,errno,trace,log res=0
> >>>>> 
> >>>>> If you then write "kill_process kill_thread errno trace log", this
> >>>>> audit
> >>>>> 
> >>>>> record is emitted:
> >>>>>  type=CONFIG_CHANGE msg=audit(1525275310.208:136): op=seccomp-logging
> >>>>>  actions=kill_process,kill_thread,errno,trace,log
> >>>>>  old-actions=kill_process,kill_thread,trap,errno,trace,log res=1
> >>>>> 
> >>>>> If you then write the string "log log errno trace kill_process
> >>>>> kill_thread", which is unordered and contains the log action twice,
> >>>>> 
> >>>>> it results in the same actions value as the previous record:
> >>>>>  type=CONFIG_CHANGE msg=audit(1525275325.613:142): op=seccomp-logging
> >>>>>  actions=kill_process,kill_thread,errno,trace,log
> >>>>>  old-actions=kill_process,kill_thread,errno,trace,log res=1
> >>>>> 
> >>>>> No audit records are generated when reading the actions_logged
> >>>>> sysctl.
> >>>> 
> >>>> ACK for the format of the records.
> >>> 
> >>> I just wanted to clarify the record format with you Steve ... the
> >>> "actions" and "old-actions" fields may not be included in the record
> >>> in cases where there is an error building the action value string, are
> >>> you okay with that or would you prefer the fields to always be
> >>> included but with a "?" for the value?
> >> 
> >> A ? would be more in line with how other things are handled.
> > 
> > That's what I thought.
> > 
> > Would you mind putting together a v3 Tyler? :)
> 
> To be clear, "?" is only to be used when the call to
> seccomp_names_from_actions_logged() fails, right?

Yes and that is a question mark with no quotes in the audit record.

> If the sysctl write fails for some other reason, such as when an invalid
> action name is specified, can you confirm that you still want *no*
> "actions" field, 

Its best that fields do not disappear. In the case of invalid input, you can 
just leave the new value as ? so that nothing malicious can be injected into 
the logs

> the "old-actions" field to be the value prior to attempting the update to
> the sysctl, and res to be 0?

Yes

-Steve



--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Tyler Hicks May 3, 2018, 10:36 p.m. UTC | #8
On 05/03/2018 04:12 PM, Steve Grubb wrote:
> On Thursday, May 3, 2018 4:51:36 PM EDT Tyler Hicks wrote:
>> On 05/03/2018 03:48 PM, Paul Moore wrote:
>>> On Thu, May 3, 2018 at 4:42 PM, Steve Grubb <sgrubb@redhat.com> wrote:
>>>> On Thursday, May 3, 2018 4:18:26 PM EDT Paul Moore wrote:
>>>>> On Wed, May 2, 2018 at 2:18 PM, Steve Grubb <sgrubb@redhat.com> wrote:
>>>>>> On Wednesday, May 2, 2018 11:53:19 AM EDT Tyler Hicks wrote:
>>>>>>> The decision to log a seccomp action will always be subject to the
>>>>>>> value of the kernel.seccomp.actions_logged sysctl, even for processes
>>>>>>> that are being inspected via the audit subsystem, in an upcoming
>>>>>>> patch.
>>>>>>> Therefore, we need to emit an audit record on attempts at writing to
>>>>>>> the
>>>>>>> actions_logged sysctl when auditing is enabled.
>>>>>>>
>>>>>>> This patch updates the write handler for the actions_logged sysctl to
>>>>>>> emit an audit record on attempts to write to the sysctl. Successful
>>>>>>> writes to the sysctl will result in a record that includes a
>>>>>>> normalized
>>>>>>> list of logged actions in the "actions" field and a "res" field equal
>>>>>>> to
>>>>>>> 0. Unsuccessful writes to the sysctl will result in a record that
>>>>>>> doesn't include the "actions" field and has a "res" field equal to 1.
>>>>>>>
>>>>>>> Not all unsuccessful writes to the sysctl are audited. For example,
>>>>>>> an
>>>>>>> audit record will not be emitted if an unprivileged process attempts
>>>>>>> to
>>>>>>> open the sysctl file for reading since that access control check is
>>>>>>> not
>>>>>>> part of the sysctl's write handler.
>>>>>>>
>>>>>>> Below are some example audit records when writing various strings to
>>>>>>> the
>>>>>>> actions_logged sysctl.
>>>>>>>
>>>>>>> Writing "not-a-real-action", when the kernel.seccomp.actions_logged
>>>>>>> sysctl previously was "kill_process kill_thread trap errno trace
>>>>>>> log",
>>>>>>>
>>>>>>> emits this audit record:
>>>>>>>  type=CONFIG_CHANGE msg=audit(1525275273.537:130): op=seccomp-logging
>>>>>>>  old-actions=kill_process,kill_thread,trap,errno,trace,log res=0
>>>>>>>
>>>>>>> If you then write "kill_process kill_thread errno trace log", this
>>>>>>> audit
>>>>>>>
>>>>>>> record is emitted:
>>>>>>>  type=CONFIG_CHANGE msg=audit(1525275310.208:136): op=seccomp-logging
>>>>>>>  actions=kill_process,kill_thread,errno,trace,log
>>>>>>>  old-actions=kill_process,kill_thread,trap,errno,trace,log res=1
>>>>>>>
>>>>>>> If you then write the string "log log errno trace kill_process
>>>>>>> kill_thread", which is unordered and contains the log action twice,
>>>>>>>
>>>>>>> it results in the same actions value as the previous record:
>>>>>>>  type=CONFIG_CHANGE msg=audit(1525275325.613:142): op=seccomp-logging
>>>>>>>  actions=kill_process,kill_thread,errno,trace,log
>>>>>>>  old-actions=kill_process,kill_thread,errno,trace,log res=1
>>>>>>>
>>>>>>> No audit records are generated when reading the actions_logged
>>>>>>> sysctl.
>>>>>>
>>>>>> ACK for the format of the records.
>>>>>
>>>>> I just wanted to clarify the record format with you Steve ... the
>>>>> "actions" and "old-actions" fields may not be included in the record
>>>>> in cases where there is an error building the action value string, are
>>>>> you okay with that or would you prefer the fields to always be
>>>>> included but with a "?" for the value?
>>>>
>>>> A ? would be more in line with how other things are handled.
>>>
>>> That's what I thought.
>>>
>>> Would you mind putting together a v3 Tyler? :)
>>
>> To be clear, "?" is only to be used when the call to
>> seccomp_names_from_actions_logged() fails, right?
> 
> Yes and that is a question mark with no quotes in the audit record.
> 
>> If the sysctl write fails for some other reason, such as when an invalid
>> action name is specified, can you confirm that you still want *no*
>> "actions" field, 
> 
> Its best that fields do not disappear. In the case of invalid input, you can 
> just leave the new value as ? so that nothing malicious can be injected into 
> the logs
> 
>> the "old-actions" field to be the value prior to attempting the update to
>> the sysctl, and res to be 0?
> 
> Yes

I came up with one more question after hitting a corner case while testing.

It is valid to write an empty string to the sysctl. If the sysctl was
set to "errno" and then later set to "", you'd see this with the current
revision:

 type=CONFIG_CHANGE msg=audit(1525385824.643:173): op=seccomp-logging
 actions= old-actions=errno res=1

Is that what you want or should the value of the "actions" field be
something be something like this:

 actions=(none)

Tyler
Steve Grubb May 3, 2018, 11:18 p.m. UTC | #9
On Thursday, May 3, 2018 6:36:18 PM EDT Tyler Hicks wrote:
> On 05/03/2018 04:12 PM, Steve Grubb wrote:
> > On Thursday, May 3, 2018 4:51:36 PM EDT Tyler Hicks wrote:
> >> On 05/03/2018 03:48 PM, Paul Moore wrote:
> >>> On Thu, May 3, 2018 at 4:42 PM, Steve Grubb <sgrubb@redhat.com> wrote:
> >>>> On Thursday, May 3, 2018 4:18:26 PM EDT Paul Moore wrote:
> >>>>> On Wed, May 2, 2018 at 2:18 PM, Steve Grubb <sgrubb@redhat.com> 
wrote:
> >>>>>> On Wednesday, May 2, 2018 11:53:19 AM EDT Tyler Hicks wrote:
> >>>>>>> The decision to log a seccomp action will always be subject to the
> >>>>>>> value of the kernel.seccomp.actions_logged sysctl, even for
> >>>>>>> processes
> >>>>>>> that are being inspected via the audit subsystem, in an upcoming
> >>>>>>> patch.
> >>>>>>> Therefore, we need to emit an audit record on attempts at writing
> >>>>>>> to
> >>>>>>> the
> >>>>>>> actions_logged sysctl when auditing is enabled.
> >>>>>>> 
> >>>>>>> This patch updates the write handler for the actions_logged sysctl
> >>>>>>> to
> >>>>>>> emit an audit record on attempts to write to the sysctl. Successful
> >>>>>>> writes to the sysctl will result in a record that includes a
> >>>>>>> normalized
> >>>>>>> list of logged actions in the "actions" field and a "res" field
> >>>>>>> equal
> >>>>>>> to
> >>>>>>> 0. Unsuccessful writes to the sysctl will result in a record that
> >>>>>>> doesn't include the "actions" field and has a "res" field equal to
> >>>>>>> 1.
> >>>>>>> 
> >>>>>>> Not all unsuccessful writes to the sysctl are audited. For example,
> >>>>>>> an
> >>>>>>> audit record will not be emitted if an unprivileged process
> >>>>>>> attempts
> >>>>>>> to
> >>>>>>> open the sysctl file for reading since that access control check is
> >>>>>>> not
> >>>>>>> part of the sysctl's write handler.
> >>>>>>> 
> >>>>>>> Below are some example audit records when writing various strings
> >>>>>>> to
> >>>>>>> the
> >>>>>>> actions_logged sysctl.
> >>>>>>> 
> >>>>>>> Writing "not-a-real-action", when the kernel.seccomp.actions_logged
> >>>>>>> sysctl previously was "kill_process kill_thread trap errno trace
> >>>>>>> log",
> >>>>>>> 
> >>>>>>> emits this audit record:
> >>>>>>>  type=CONFIG_CHANGE msg=audit(1525275273.537:130):
> >>>>>>>  op=seccomp-logging
> >>>>>>>  old-actions=kill_process,kill_thread,trap,errno,trace,log res=0
> >>>>>>> 
> >>>>>>> If you then write "kill_process kill_thread errno trace log", this
> >>>>>>> audit
> >>>>>>> 
> >>>>>>> record is emitted:
> >>>>>>>  type=CONFIG_CHANGE msg=audit(1525275310.208:136):
> >>>>>>>  op=seccomp-logging
> >>>>>>>  actions=kill_process,kill_thread,errno,trace,log
> >>>>>>>  old-actions=kill_process,kill_thread,trap,errno,trace,log res=1
> >>>>>>> 
> >>>>>>> If you then write the string "log log errno trace kill_process
> >>>>>>> kill_thread", which is unordered and contains the log action twice,
> >>>>>>> 
> >>>>>>> it results in the same actions value as the previous record:
> >>>>>>>  type=CONFIG_CHANGE msg=audit(1525275325.613:142):
> >>>>>>>  op=seccomp-logging
> >>>>>>>  actions=kill_process,kill_thread,errno,trace,log
> >>>>>>>  old-actions=kill_process,kill_thread,errno,trace,log res=1
> >>>>>>> 
> >>>>>>> No audit records are generated when reading the actions_logged
> >>>>>>> sysctl.
> >>>>>> 
> >>>>>> ACK for the format of the records.
> >>>>> 
> >>>>> I just wanted to clarify the record format with you Steve ... the
> >>>>> "actions" and "old-actions" fields may not be included in the record
> >>>>> in cases where there is an error building the action value string,
> >>>>> are
> >>>>> you okay with that or would you prefer the fields to always be
> >>>>> included but with a "?" for the value?
> >>>> 
> >>>> A ? would be more in line with how other things are handled.
> >>> 
> >>> That's what I thought.
> >>> 
> >>> Would you mind putting together a v3 Tyler? :)
> >> 
> >> To be clear, "?" is only to be used when the call to
> >> seccomp_names_from_actions_logged() fails, right?
> > 
> > Yes and that is a question mark with no quotes in the audit record.
> > 
> >> If the sysctl write fails for some other reason, such as when an invalid
> >> action name is specified, can you confirm that you still want *no*
> >> "actions" field,
> > 
> > Its best that fields do not disappear. In the case of invalid input, you
> > can just leave the new value as ? so that nothing malicious can be
> > injected into the logs
> > 
> >> the "old-actions" field to be the value prior to attempting the update
> >> to the sysctl, and res to be 0?
> > 
> > Yes
> 
> I came up with one more question after hitting a corner case while testing.
> 
> It is valid to write an empty string to the sysctl. If the sysctl was
> set to "errno" and then later set to "", you'd see this with the current
> revision:
> 
>  type=CONFIG_CHANGE msg=audit(1525385824.643:173): op=seccomp-logging
>  actions= old-actions=errno res=1
> 
> Is that what you want or should the value of the "actions" field be
> something be something like this:
> 
>  actions=(none)

This ^^^ would be preferred. However, the parenthesis is not needed.

Thanks,
-Steve


--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch
diff mbox

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 75d5b03..d4e35e7 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -233,6 +233,8 @@  extern void __audit_inode_child(struct inode *parent,
 				const struct dentry *dentry,
 				const unsigned char type);
 extern void __audit_seccomp(unsigned long syscall, long signr, int code);
+extern void audit_seccomp_actions_logged(const char *names,
+					 const char *old_names, int res);
 extern void __audit_ptrace(struct task_struct *t);
 
 static inline bool audit_dummy_context(void)
@@ -502,6 +504,9 @@  static inline void __audit_seccomp(unsigned long syscall, long signr, int code)
 { }
 static inline void audit_seccomp(unsigned long syscall, long signr, int code)
 { }
+static inline void audit_seccomp_actions_logged(const char *names,
+						const char *old_names, int res)
+{ }
 static inline int auditsc_get_stamp(struct audit_context *ctx,
 			      struct timespec64 *t, unsigned int *serial)
 {
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 4e0a4ac..5a0b770 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -2478,6 +2478,31 @@  void __audit_seccomp(unsigned long syscall, long signr, int code)
 	audit_log_end(ab);
 }
 
+void audit_seccomp_actions_logged(const char *names, const char *old_names,
+				  int res)
+{
+	struct audit_buffer *ab;
+
+	if (!audit_enabled)
+		return;
+
+	ab = audit_log_start(current->audit_context, GFP_KERNEL,
+			     AUDIT_CONFIG_CHANGE);
+	if (unlikely(!ab))
+		return;
+
+	audit_log_format(ab, "op=seccomp-logging");
+
+	if (names)
+		audit_log_format(ab, " actions=%s", names);
+
+	if (old_names)
+		audit_log_format(ab, " old-actions=%s", old_names);
+
+	audit_log_format(ab, " res=%d", res);
+	audit_log_end(ab);
+}
+
 struct list_head *audit_killed_trees(void)
 {
 	struct audit_context *ctx = current->audit_context;
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index b36ac1e..da78835 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -1219,11 +1219,10 @@  static int read_actions_logged(struct ctl_table *ro_table, void __user *buffer,
 }
 
 static int write_actions_logged(struct ctl_table *ro_table, void __user *buffer,
-				size_t *lenp, loff_t *ppos)
+				size_t *lenp, loff_t *ppos, u32 *actions_logged)
 {
 	char names[sizeof(seccomp_actions_avail)];
 	struct ctl_table table;
-	u32 actions_logged;
 	int ret;
 
 	if (!capable(CAP_SYS_ADMIN))
@@ -1238,24 +1237,58 @@  static int write_actions_logged(struct ctl_table *ro_table, void __user *buffer,
 	if (ret)
 		return ret;
 
-	if (!seccomp_actions_logged_from_names(&actions_logged, table.data))
+	if (!seccomp_actions_logged_from_names(actions_logged, table.data))
 		return -EINVAL;
 
-	if (actions_logged & SECCOMP_LOG_ALLOW)
+	if (*actions_logged & SECCOMP_LOG_ALLOW)
 		return -EINVAL;
 
-	seccomp_actions_logged = actions_logged;
+	seccomp_actions_logged = *actions_logged;
 	return 0;
 }
 
+static void audit_actions_logged(u32 actions_logged, u32 old_actions_logged,
+				 int ret)
+{
+	char names[sizeof(seccomp_actions_avail)];
+	char old_names[sizeof(seccomp_actions_avail)];
+	const char *new = names;
+	const char *old = old_names;
+
+	if (!audit_enabled)
+		return;
+
+	memset(names, 0, sizeof(names));
+	memset(old_names, 0, sizeof(old_names));
+
+	if (ret || !seccomp_names_from_actions_logged(names, sizeof(names),
+						      actions_logged, ","))
+		new = NULL;
+
+	if (!seccomp_names_from_actions_logged(old_names, sizeof(old_names),
+					       old_actions_logged, ","))
+		old = NULL;
+
+	return audit_seccomp_actions_logged(new, old, !ret);
+}
+
 static int seccomp_actions_logged_handler(struct ctl_table *ro_table, int write,
 					  void __user *buffer, size_t *lenp,
 					  loff_t *ppos)
 {
-	if (write)
-		return write_actions_logged(ro_table, buffer, lenp, ppos);
-	else
-		return read_actions_logged(ro_table, buffer, lenp, ppos);
+	int ret;
+
+	if (write) {
+		u32 actions_logged = 0;
+		u32 old_actions_logged = seccomp_actions_logged;
+
+		ret = write_actions_logged(ro_table, buffer, lenp, ppos,
+					   &actions_logged);
+		audit_actions_logged(actions_logged, old_actions_logged, ret);
+	} else
+		ret = read_actions_logged(ro_table, buffer, lenp, ppos);
+
+	return ret;
 }
 
 static struct ctl_path seccomp_sysctl_path[] = {