| Message ID | CAHC9VhRMJq1gJPoR79AxM1JphmGtxhGMYBkd=Ptuaq3WBjX2Bw@mail.gmail.com (mailing list archive) |
|---|---|
| State | Handled Elsewhere |
| Delegated to: | Paul Moore |
| Headers | show |
| Series | audit userspace problems with io_uring async ops | expand |
On Tue, Feb 28, 2023 at 5:04 PM Paul Moore <paul@paul-moore.com> wrote: > > Hi all, > > We just recently started picking up audit-testsuite failures with the > latest upstream kernels and I tracked it down to a change in how the > IORING_OP_OPENAT operation is handled, and how Steve's audit userspace > displays async io_uring ops. It appears that when ausearch is used to > look for events it doesn't display async io_uring events (URINGOP > records/events without an associated SYSCALL record/event). Take the > following snippet from /var/log/audit/audit.log ... Hi Steve, Before I start working around this in the audit-testsuite I just wanted to check and see if you already had a fix for ausearch?
Hello Paul, On Monday, March 6, 2023 3:07:37 PM EST Paul Moore wrote: > On Tue, Feb 28, 2023 at 5:04 PM Paul Moore <paul@paul-moore.com> wrote: > > Hi all, > > > > We just recently started picking up audit-testsuite failures with the > > latest upstream kernels and I tracked it down to a change in how the > > IORING_OP_OPENAT operation is handled, and how Steve's audit userspace > > displays async io_uring ops. It appears that when ausearch is used to > > look for events it doesn't display async io_uring events (URINGOP > > records/events without an associated SYSCALL record/event). Take the > > following snippet from /var/log/audit/audit.log ... > > Hi Steve, > > Before I start working around this in the audit-testsuite I just > wanted to check and see if you already had a fix for ausearch? Thanks for the bug report. I have been out for the last 8 days and now have ~3600 unread emails. I will try look into this tomorrow. -Steve -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit
On Mon, Mar 6, 2023 at 3:58 PM Steve Grubb <sgrubb@redhat.com> wrote: > > Hello Paul, > > On Monday, March 6, 2023 3:07:37 PM EST Paul Moore wrote: > > On Tue, Feb 28, 2023 at 5:04 PM Paul Moore <paul@paul-moore.com> wrote: > > > Hi all, > > > > > > We just recently started picking up audit-testsuite failures with the > > > latest upstream kernels and I tracked it down to a change in how the > > > IORING_OP_OPENAT operation is handled, and how Steve's audit userspace > > > displays async io_uring ops. It appears that when ausearch is used to > > > look for events it doesn't display async io_uring events (URINGOP > > > records/events without an associated SYSCALL record/event). Take the > > > following snippet from /var/log/audit/audit.log ... > > > > Hi Steve, > > > > Before I start working around this in the audit-testsuite I just > > wanted to check and see if you already had a fix for ausearch? > > Thanks for the bug report. I have been out for the last 8 days and now have > ~3600 unread emails. I will try look into this tomorrow. Great thanks. I'll hold off an a workaround.
Hello Paul, On Tuesday, February 28, 2023 5:04:04 PM EST Paul Moore wrote: > ... if you look closely you'll notice that the #289 event (the async > URINGOP) is missing from the ausearch output. Thanks for the bug report. Let me know if you see anything else. Upstream commit 7d35e14 should fix parsing URINGOP and DM_CTRL records. Btw, has anyone ever seen a DM_CTRL record? I don't think they are following our guidelines. -Steve -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit
On Tue, Mar 7, 2023 at 4:17 PM Steve Grubb <sgrubb@redhat.com> wrote: > > Hello Paul, > > On Tuesday, February 28, 2023 5:04:04 PM EST Paul Moore wrote: > > ... if you look closely you'll notice that the #289 event (the async > > URINGOP) is missing from the ausearch output. > > Thanks for the bug report. Let me know if you see anything else. > > Upstream commit 7d35e14 should fix parsing URINGOP and DM_CTRL records. Thanks Steve. I'm working through the post merge window batch of reviews/merging, but I'll give that commit a shot and let you know how it goes. > Btw, has anyone ever seen a DM_CTRL record? I don't think they are following our > guidelines. They were added back in the v5.16 timeframe: * https://www.paul-moore.com/blog/d/2022/01/linux_v516.html ... with patches first being posted to the linux-audit@redhat list in August 2021: * https://lore.kernel.org/linux-audit/20210812145748.4460-1-michael.weiss@aisec.fraunhofer.de
On Tue, Mar 7, 2023 at 4:17 PM Steve Grubb <sgrubb@redhat.com> wrote: > > Hello Paul, > > On Tuesday, February 28, 2023 5:04:04 PM EST Paul Moore wrote: > > ... if you look closely you'll notice that the #289 event (the async > > URINGOP) is missing from the ausearch output. > > Thanks for the bug report. Let me know if you see anything else. > > Upstream commit 7d35e14 should fix parsing URINGOP and DM_CTRL records. Finally got a chance to try the fix, and it looks like it solves the problem for me. Thanks. In case anyone wants a hacky patched source RPM, I put the copy I'm using at the link below: * https://drop.paul-moore.com/120.OH1C/audit-3.1-2.1.secnext.fc39.src.rpm [The link above should work for the next 120 days]
diff --git a/tests/io_uring/test b/tests/io_uring/test index 9eb427a..df13af0 100755 --- a/tests/io_uring/test +++ b/tests/io_uring/test @@ -49,6 +49,7 @@ system("auditctl -D >& /dev/null"); # set our io_uring filters system("auditctl -a exit,always -F arch=b$abi_bits -S io_uring_setup -k $key"); system("auditctl -a exit,always -F arch=b$abi_bits -S io_uring_enter -k $key"); +system("auditctl -a io_uring,always -S openat -k $key"); # run the "t1" test system("$basedir/iouring t1");