From patchwork Thu Aug 12 14:57:42 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Michael_Wei=C3=9F?= X-Patchwork-Id: 12434863 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 77959C4338F for ; Fri, 13 Aug 2021 06:41:12 +0000 (UTC) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id E3FA560E93 for ; Fri, 13 Aug 2021 06:41:11 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org E3FA560E93 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=aisec.fraunhofer.de Authentication-Results: mail.kernel.org; spf=tempfail smtp.mailfrom=redhat.com Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-554-6kPgpzuWMwuaV4WqLv2DMA-1; Fri, 13 Aug 2021 02:41:09 -0400 X-MC-Unique: 6kPgpzuWMwuaV4WqLv2DMA-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 10E311082922; Fri, 13 Aug 2021 06:41:05 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 7E67360C9D; Fri, 13 Aug 2021 06:41:04 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id F29E5181A0F2; Fri, 13 Aug 2021 06:41:03 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.rdu2.redhat.com [10.11.54.6]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 17CF3e2i011480 for ; Thu, 12 Aug 2021 11:03:40 -0400 Received: by smtp.corp.redhat.com (Postfix) id 55B7420AE82B; Thu, 12 Aug 2021 15:03:42 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast06.extmail.prod.ext.rdu2.redhat.com [10.11.55.22]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 50B6520AE835 for ; Thu, 12 Aug 2021 15:03:38 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-2.mimecast.com [207.211.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id CF80118A6534 for ; Thu, 12 Aug 2021 15:03:38 +0000 (UTC) Received: from mout.kundenserver.de (mout.kundenserver.de [212.227.126.187]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-113-84hih3YZM-28Hvm1kGbGVA-1; Thu, 12 Aug 2021 11:03:35 -0400 X-MC-Unique: 84hih3YZM-28Hvm1kGbGVA-1 Received: from weisslap.aisec.fraunhofer.de ([178.27.102.95]) by mrelayeu.kundenserver.de (mreue009 [212.227.15.167]) with ESMTPSA (Nemesis) id 1M3lgJ-1mET0X338V-000uGk; Thu, 12 Aug 2021 16:58:14 +0200 From: =?utf-8?q?Michael_Wei=C3=9F?= To: michael.weiss@aisec.fraunhofer.de Date: Thu, 12 Aug 2021 16:57:42 +0200 Message-Id: <20210812145748.4460-2-michael.weiss@aisec.fraunhofer.de> In-Reply-To: <20210812145748.4460-1-michael.weiss@aisec.fraunhofer.de> References: <20210812145748.4460-1-michael.weiss@aisec.fraunhofer.de> MIME-Version: 1.0 X-Provags-ID: V03:K1:VRlAlfDB5Lnf+BVBMonU0Eg2eot1RoGDcs0IiBT5nDnqj9aaHft dcSLO6WONK888uP9aJqK6Aqb7ZQiPNlpUJu7M7xc4+bfDDsm3kxMGF1syUIKvVExAOAS0zo nwfgdVRl4NvB4ox9dfl4dEhENW7JEr4Vv4lV6bu39wfwADLoMcUIPK0LFtBy2DC9O/Mppvk /3X0q9IUYsRk56eLtLtbA== X-UI-Out-Filterresults: notjunk:1;V03:K0:DnlpQKNvJJQ=:KffVPKphi5VzcyJXqM25G7 w78eYYosa3qJNrzWTt6CA7LDELC4HrQRaZPJNNkVAMLQXRBfXMFPgOneB78KaD3tNYWHRjZ5J tGjJlq95R5T9Apkkaw9wWK4neeaJLzCCG1pvWUcROb0ysQdljZIx8nm6AjBbCcWELTQHy0exV 32lD7nDWDdSKsafgqJiw9u28OpsLszm3ObJpDLu5XKjaS6Co2PWDdvgzZYeMUdHdz6ag0LqX6 MK0WoqHrOmGE5UIuWUPV0m9I0DS8UZOLcEOUJWeVb1abpV25TWICO4TTVhweiUEjVjC5qDN1/ w3WMxy2skgKR5+XREXSG+pybsDIkYhTTJZJ/FmmwAqkeJ+aObL+fZz1SxMHcG+hHTElhcUfyk 1MtSnbzkV7PiVh2vr2WLAnksb/almelqdjipa1CkEkr967qjS17+atHbLkGbKvAkLC8Og58MW VGmLlx4P24uaWw45P988VPjYrAPFyiaxdMiV5u06RxUPS5WqwzDPhFgNkXi4vcx878UDZX7Tn PTJ9zaYg/k9FXZrwKJM+49kqUQZk11DNUglKDvdkMsesOnz2G9sHoyBV4oiqNjHTQf3+4xWpZ L/fQWGS74Hc+vsgNdOYHpl78wpCu3tOwis5N7KQ1xxeKGOlKeE60ZpTlp6FrAx6/SD3BfU6R3 CfUDAkNAI7EC1DW6g8HzfEaudCHcj3VlONH22BBf9mVnEjt8y+pQHxcbitCn0Xl7fY6KTlt0Y 9Ptu+JqYaH2/hqyXNORxQzpehGLmAPIRNL/wtwK3HNRQsdbRQanTYv49AtkAFSyNrDLScXZgK lL+IJtOMq9w86AOT85ZYJTRYFhQ8fKbIc+PysZOYZVT8shZP6fuSenAjXZoLfQ0kZTqfODvmB 3/rSnJWUdhY5t/INAgIQ== X-Mimecast-Impersonation-Protect: Policy=CLT - Impersonation Protection Definition; Similar Internal Domain=false; Similar Monitored External Domain=false; Custom External Domain=false; Mimecast External Domain=false; Newly Observed Domain=false; Internal User Name=false; Custom Display Name List=false; Reply-to Address Mismatch=false; Targeted Threat Dictionary=false; Mimecast Threat Dictionary=false; Custom Threat Dictionary=false X-Scanned-By: MIMEDefang 2.78 on 10.11.54.6 X-loop: dm-devel@redhat.com X-Mailman-Approved-At: Fri, 13 Aug 2021 02:36:56 -0400 Cc: Paul Moore , Mike Snitzer , linux-kernel@vger.kernel.org, Eric Paris , linux-raid@vger.kernel.org, Song Liu , dm-devel@redhat.com, linux-audit@redhat.com, Alasdair Kergon Subject: [dm-devel] [PATCH 1/3] dm: introduce audit event module for device mapper X-BeenThere: dm-devel@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: device-mapper development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: dm-devel-bounces@redhat.com Errors-To: dm-devel-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=dm-devel-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com To be able to send auditing events to user space, we introduce a generic dm-audit module. It provides helper functions to emit audit events through the kernel audit subsystem. We claim the AUDIT_DM type=1336 out of the audit event messages range in the corresponding userspace api in 'include/uapi/linux/audit.h' for those events. Following commits to device mapper targets actually will make use of this to emit those events in relevant cases. Signed-off-by: Michael Weiß --- drivers/md/Kconfig | 10 +++++++ drivers/md/Makefile | 4 +++ drivers/md/dm-audit.c | 59 ++++++++++++++++++++++++++++++++++++++ drivers/md/dm-audit.h | 33 +++++++++++++++++++++ include/uapi/linux/audit.h | 2 ++ 5 files changed, 108 insertions(+) create mode 100644 drivers/md/dm-audit.c create mode 100644 drivers/md/dm-audit.h diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig index 0602e82a9516..fd54c713a03e 100644 --- a/drivers/md/Kconfig +++ b/drivers/md/Kconfig @@ -608,6 +608,7 @@ config DM_INTEGRITY select CRYPTO select CRYPTO_SKCIPHER select ASYNC_XOR + select DM_AUDIT if AUDIT help This device-mapper target emulates a block device that has additional per-sector tags that can be used for storing @@ -640,4 +641,13 @@ config DM_ZONED If unsure, say N. +config DM_AUDIT + bool "DM audit events" + depends on AUDIT + help + Generate audit events for device-mapper. + + Enables audit loging of several security relevant events in the + particular device-mapper targets, especially the integrity target. + endif # MD diff --git a/drivers/md/Makefile b/drivers/md/Makefile index a74aaf8b1445..4cd47623c742 100644 --- a/drivers/md/Makefile +++ b/drivers/md/Makefile @@ -103,3 +103,7 @@ endif ifeq ($(CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG),y) dm-verity-objs += dm-verity-verify-sig.o endif + +ifeq ($(CONFIG_DM_AUDIT),y) +dm-mod-objs += dm-audit.o +endif diff --git a/drivers/md/dm-audit.c b/drivers/md/dm-audit.c new file mode 100644 index 000000000000..c7e5824821bb --- /dev/null +++ b/drivers/md/dm-audit.c @@ -0,0 +1,59 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Creating audit records for mapped devices. + * + * Copyright (C) 2021 Fraunhofer AISEC. All rights reserved. + * + * Authors: Michael Weiß + */ + +#include +#include +#include +#include +#include + +#include "dm-audit.h" +#include "dm-core.h" + +void dm_audit_log_bio(const char *dm_msg_prefix, const char *op, + struct bio *bio, sector_t sector, int result) +{ + struct audit_buffer *ab; + + if (audit_enabled == AUDIT_OFF) + return; + + ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_DM); + if (unlikely(!ab)) + return; + + audit_log_format(ab, "module=%s dev=%d:%d op=%s sector=%llu res=%d", + dm_msg_prefix, MAJOR(bio->bi_bdev->bd_dev), + MINOR(bio->bi_bdev->bd_dev), op, sector, result); + audit_log_end(ab); +} +EXPORT_SYMBOL_GPL(dm_audit_log_bio); + +void dm_audit_log_target(const char *dm_msg_prefix, const char *op, + struct dm_target *ti, int result) +{ + struct audit_buffer *ab; + struct mapped_device *md = dm_table_get_md(ti->table); + + if (audit_enabled == AUDIT_OFF) + return; + + ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_DM); + if (unlikely(!ab)) + return; + + audit_log_format(ab, "module=%s dev=%s op=%s", + dm_msg_prefix, dm_device_name(md), op); + + if (!result && !strcmp("ctr", op)) + audit_log_format(ab, " error_msg='%s'", ti->error); + audit_log_format(ab, " res=%d", result); + audit_log_end(ab); +} +EXPORT_SYMBOL_GPL(dm_audit_log_target); diff --git a/drivers/md/dm-audit.h b/drivers/md/dm-audit.h new file mode 100644 index 000000000000..9db4955d32e1 --- /dev/null +++ b/drivers/md/dm-audit.h @@ -0,0 +1,33 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Creating audit records for mapped devices. + * + * Copyright (C) 2021 Fraunhofer AISEC. All rights reserved. + * + * Authors: Michael Weiß + */ + +#ifndef DM_AUDIT_H +#define DM_AUDIT_H + +#include + +#ifdef CONFIG_DM_AUDIT +void dm_audit_log_bio(const char *dm_msg_prefix, const char *op, + struct bio *bio, sector_t sector, int result); +void dm_audit_log_target(const char *dm_msg_prefix, const char *op, + struct dm_target *ti, int result); +#else +static inline void dm_audit_log_bio(const char *dm_msg_prefix, const char *op, + struct bio *bio, sector_t sector, + int result); +{ +} +static inline void dm_audit_log_target(const char *dm_msg_prefix, + const char *op, struct dm_target *ti, + int result); +{ +} +#endif + +#endif diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h index daa481729e9b..9d766fcbcf62 100644 --- a/include/uapi/linux/audit.h +++ b/include/uapi/linux/audit.h @@ -118,6 +118,7 @@ #define AUDIT_TIME_ADJNTPVAL 1333 /* NTP value adjustment */ #define AUDIT_BPF 1334 /* BPF subsystem */ #define AUDIT_EVENT_LISTENER 1335 /* Task joined multicast read socket */ +#define AUDIT_DM 1336 /* Device Mapper events */ #define AUDIT_AVC 1400 /* SE Linux avc denial or grant */ #define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */ @@ -140,6 +141,7 @@ #define AUDIT_MAC_CALIPSO_ADD 1418 /* NetLabel: add CALIPSO DOI entry */ #define AUDIT_MAC_CALIPSO_DEL 1419 /* NetLabel: del CALIPSO DOI entry */ + #define AUDIT_FIRST_KERN_ANOM_MSG 1700 #define AUDIT_LAST_KERN_ANOM_MSG 1799 #define AUDIT_ANOM_PROMISCUOUS 1700 /* Device changed promiscuous mode */