| Message ID | 162871480969.63873.9434591871437326374.stgit@olly (mailing list archive) |
|---|---|
| Headers | show |
| Series | Add LSM access controls and auditing to io_uring | expand |
On 2021-08-11 16:48, Paul Moore wrote: > Draft #2 of the patchset which brings auditing and proper LSM access > controls to the io_uring subsystem. The original patchset was posted > in late May and can be found via lore using the link below: > > https://lore.kernel.org/linux-security-module/162163367115.8379.8459012634106035341.stgit@sifl/ > > This draft should incorporate all of the feedback from the original > posting as well as a few smaller things I noticed while playing > further with the code. The big change is of course the selective > auditing in the io_uring op servicing, but that has already been > discussed quite a bit in the original thread so I won't go into > detail here; the important part is that we found a way to move > forward and this draft captures that. For those of you looking to > play with these patches, they are based on Linus' v5.14-rc5 tag and > on my test system they boot and appear to function without problem; > they pass the selinux-testsuite and audit-testsuite and I have not > noticed any regressions in the normal use of the system. If you want > to get a copy of these patches straight from git you can use the > "working-io_uring" branch in the repo below: > > git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git > https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git > > Beyond the existing test suite tests mentioned above, I've cobbled > together some very basic, very crude tests to exercise some of the > things I care about from a LSM/audit perspective. These tests are > pretty awful (I'm not kidding), but they might be helpful for the > other LSM/audit developers who want to test things: > > https://drop.paul-moore.com/90.kUgq > > There are currently two tests: 'iouring.2' and 'iouring.3'; > 'iouring.1' was lost in a misguided and overzealous 'rm' command. > The first test is standalone and basically tests the SQPOLL > functionality while the second tests sharing io_urings across process > boundaries and the credential/personality sharing mechanism. The > console output of both tests isn't particularly useful, the more > interesting bits are in the audit and LSM specific logs. The > 'iouring.2' command requires no special arguments to run but the > 'iouring.3' test is split into a "server" and "client"; the server > should be run without argument: > > % ./iouring.3s > >>> server started, pid = 11678 > >>> memfd created, fd = 3 > >>> io_uring created; fd = 5, creds = 1 > > ... while the client should be run with two arguments: the first is > the PID of the server process, the second is the "memfd" fd number: > > % ./iouring.3c 11678 3 > >>> client started, server_pid = 11678 server_memfd = 3 > >>> io_urings = 5 (server) / 5 (client) > >>> io_uring ops using creds = 1 > >>> async op result: 36 > >>> async op result: 36 > >>> async op result: 36 > >>> async op result: 36 > >>> START file contents > What is this life if, full of care, > we have no time to stand and stare. > >>> END file contents > > The tests were hacked together from various sources online, > attribution and links to additional info can be found in the test > sources, but I expect these tests to die a fiery death in the not > to distant future as I work to add some proper tests to the SELinux > and audit test suites. > > As I believe these patches should spend a full -rcX cycle in > linux-next, my current plan is to continue to solicit feedback on > these patches while they undergo additional testing (next up is > verification of the audit filter code for io_uring). Assuming no > critical issues are found on the mailing lists or during testing, I > will post a proper patchset later with the idea of merging it into > selinux/next after the upcoming merge window closes. > > Any comments, feedback, etc. are welcome. Thanks for the tests. I have a bunch of userspace patches to add to the last set I posted and these tests will help exercise them. I also have one more kernel patch to post... I'll dive back into that now. I had wanted to post them before now but got distracted with AUDIT_TRIM breakage. > --- > > Casey Schaufler (1): > Smack: Brutalist io_uring support with debug > > Paul Moore (8): > audit: prepare audit_context for use in calling contexts beyond > syscalls > audit,io_uring,io-wq: add some basic audit support to io_uring > audit: dev/test patch to force io_uring auditing > audit: add filtering for io_uring records > fs: add anon_inode_getfile_secure() similar to > anon_inode_getfd_secure() > io_uring: convert io_uring to the secure anon inode interface > lsm,io_uring: add LSM hooks to io_uring > selinux: add support for the io_uring access controls > > > fs/anon_inodes.c | 29 ++ > fs/io-wq.c | 4 + > fs/io_uring.c | 69 +++- > include/linux/anon_inodes.h | 4 + > include/linux/audit.h | 26 ++ > include/linux/lsm_hook_defs.h | 5 + > include/linux/lsm_hooks.h | 13 + > include/linux/security.h | 16 + > include/uapi/linux/audit.h | 4 +- > kernel/audit.h | 7 +- > kernel/audit_tree.c | 3 +- > kernel/audit_watch.c | 3 +- > kernel/auditfilter.c | 15 +- > kernel/auditsc.c | 483 +++++++++++++++++++----- > security/security.c | 12 + > security/selinux/hooks.c | 34 ++ > security/selinux/include/classmap.h | 2 + > security/smack/smack_lsm.c | 64 ++++ > 18 files changed, 678 insertions(+), 115 deletions(-) > - RGB -- Richard Guy Briggs <rgb@redhat.com> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635
On Tue, Aug 24, 2021 at 4:57 PM Richard Guy Briggs <rgb@redhat.com> wrote: > Thanks for the tests. I have a bunch of userspace patches to add to the > last set I posted and these tests will help exercise them. I also have > one more kernel patch to post... I'll dive back into that now. I had > wanted to post them before now but got distracted with AUDIT_TRIM > breakage. If it helps, last week I started working on a little test tool for the audit-testsuite and selinux-testsuite (see attached). It may not be final, but I don't expect too many changes to it before I post the test suite patches; it is definitely usable now. It's inspired by the previous tests, but it uses a much more test suite friendly fork/exec model for testing the sharing of io_urings across process boundaries. Would you mind sharing your latest userspace patches, if not publicly I would be okay with privately off-list; I'm putting together the test suite patches this week and it would be good to make sure I'm using your latest take on the userspace changes. Also, what is the kernel patch? Did you find a bug or is this some new functionality you think might be useful? Both can be important, but the bug is *really* important; even if you don't have a fix for that, just a description of the problem would be good.
On 2021-08-24 18:27, Paul Moore wrote: > On Tue, Aug 24, 2021 at 4:57 PM Richard Guy Briggs <rgb@redhat.com> wrote: > > Thanks for the tests. I have a bunch of userspace patches to add to the > > last set I posted and these tests will help exercise them. I also have > > one more kernel patch to post... I'll dive back into that now. I had > > wanted to post them before now but got distracted with AUDIT_TRIM > > breakage. > > If it helps, last week I started working on a little test tool for the > audit-testsuite and selinux-testsuite (see attached). It may not be > final, but I don't expect too many changes to it before I post the > test suite patches; it is definitely usable now. It's inspired by the > previous tests, but it uses a much more test suite friendly fork/exec > model for testing the sharing of io_urings across process boundaries. > > Would you mind sharing your latest userspace patches, if not publicly > I would be okay with privately off-list; I'm putting together the test > suite patches this week and it would be good to make sure I'm using > your latest take on the userspace changes. I intend to publish them but they need squashing and some documentation first. And a run through with io_uring specific tests would be good to catch anything obvious... > Also, what is the kernel patch? Did you find a bug or is this some > new functionality you think might be useful? Both can be important, > but the bug is *really* important; even if you don't have a fix for > that, just a description of the problem would be good. It was a very small patch that I realize I had already talked about and you justified not including sessionid along with auid. That was addressed in a reply tacked on to your v1 patchset just now. > paul moore > /* > * io_uring test tool to exercise LSM/SELinux and audit kernel code paths > * Author: Paul Moore <paul@paul-moore.com> > * > * Copyright 2021 Microsoft Corporation > * > * At the time this code was written the best, and most current, source of info > * on io_uring seemed to be the liburing sources themselves (link below). The > * code below is based on the lessons learned from looking at the liburing > * code. > * > * -> https://github.com/axboe/liburing > * > * The liburing LICENSE file contains the following: > * > * Copyright 2020 Jens Axboe > * > * Permission is hereby granted, free of charge, to any person obtaining a copy > * of this software and associated documentation files (the "Software"), to > * deal in the Software without restriction, including without limitation the > * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or > * sell copies of the Software, and to permit persons to whom the Software is > * furnished to do so, subject to the following conditions: > * > * The above copyright notice and this permission notice shall be included in > * all copies or substantial portions of the Software. > * > * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR > * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, > * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE > * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER > * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING > * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER > * DEALINGS IN THE SOFTWARE. > * > */ > > /* > * BUILDING: > * > * gcc -o <binary> -g -O0 -luring -lrt <source> > * > * RUNNING: > * > * The program can be run using the following command lines: > * > * % prog sqpoll > * ... this invocation runs the io_uring SQPOLL test. > * > * % prog t1 > * ... this invocation runs the parent/child io_uring sharing test. > * > * % prog t1 <domain> > * ... this invocation runs the parent/child io_uring sharing test with the > * child process run in the specified SELinux domain. > * > */ > > #include <stdlib.h> > #include <stdio.h> > #include <errno.h> > #include <string.h> > #include <fcntl.h> > #include <unistd.h> > #include <sys/mman.h> > #include <sys/stat.h> > #include <sys/wait.h> > > #include <liburing.h> > > struct urt_config { > struct io_uring ring; > struct io_uring_params ring_params; > int ring_creds; > }; > > #define URING_ENTRIES 8 > #define URING_SHM_NAME "/iouring_test_4" > > int selinux_state = -1; > #define SELINUX_CTX_MAX 512 > char selinux_ctx[SELINUX_CTX_MAX] = "\0"; > > /** > * Display an error message and exit > * @param msg the error message > * > * Output @msg to stderr and exit with errno as the exit value. > */ > void fatal(const char *msg) > { > const char *str = (msg ? msg : "unknown"); > > if (!errno) { > errno = 1; > fprintf(stderr, "%s: unknown error\n", msg); > } else > perror(str); > > if (errno < 0) > exit(-errno); > exit(errno); > } > > /** > * Determine if SELinux is enabled and set the internal state > * > * Attempt to read from /proc/self/attr/current and determine if SELinux is > * enabled, store the current context/domain in @selinux_ctx if SELinux is > * enabled. We avoid using the libselinux API in order to increase portability > * and make it easier for other LSMs to adopt this test. > */ > int selinux_enabled(void) > { > int fd = -1; > ssize_t ctx_len; > char ctx[SELINUX_CTX_MAX]; > > if (selinux_state >= 0) > return selinux_state; > > /* attempt to get the current context */ > fd = open("/proc/self/attr/current", O_RDONLY); > if (fd < 0) > goto err; > ctx_len = read(fd, ctx, SELINUX_CTX_MAX - 1); > if (ctx_len <= 0) > goto err; > close(fd); > > /* save the current context */ > ctx[ctx_len] = '\0'; > strcpy(selinux_ctx, ctx); > > selinux_state = 1; > return selinux_state; > > err: > if (fd >= 0) > close(fd); > > selinux_state = 0; > return selinux_state; > } > > /** > * Return the current SELinux domain or "DISABLED" if SELinux is not enabled > * > * The returned string should not be free()'d. > */ > const char *selinux_current(void) > { > int rc; > > rc = selinux_enabled(); > if (!rc) > return "DISABLED"; > > return selinux_ctx; > } > > /** > * Set the SELinux domain for the next exec()'d process > * @param ctx the SELinux domain > * > * This is similar to the setexeccon() libselinux API but we do it manually to > * help increase portability and make it easier for other LSMs to adopt this > * test. > */ > int selinux_exec(const char *ctx) > { > int fd = -1; > ssize_t len; > > if (!ctx) > return -EINVAL; > > fd = open("/proc/self/attr/exec", O_WRONLY); > if (fd < 0) > return -errno; > len = write(fd, ctx, strlen(ctx) + 1); > close(fd); > > return len; > } > > /** > * Setup the io_uring > * @param ring the io_uring pointer > * @param params the io_uring parameters > * @param creds pointer to the current process' registered io_uring personality > * > * Create a new io_uring using @params and return it in @ring with the > * registered personality returned in @creds. Returns 0 on success, negative > * values on failure. > */ > int uring_setup(struct io_uring *ring, > struct io_uring_params *params, int *creds) > { > int rc; > > /* call into liburing to do the setup heavy lifting */ > rc = io_uring_queue_init_params(URING_ENTRIES, ring, params); > if (rc < 0) > fatal("io_uring_queue_init_params"); > > /* register our creds/personality */ > rc = io_uring_register_personality(ring); > if (rc < 0) > fatal("io_uring_register_personality()"); > *creds = rc; > rc = 0; > > printf(">>> io_uring created; fd = %d, personality = %d\n", > ring->ring_fd, *creds); > > return rc; > } > > /** > * Import an existing io_uring based on the given file descriptor > * @param fd the io_uring's file descriptor > * @param ring the io_uring pointer > * @param params the io_uring parameters > * > * This function takes an io_uring file descriptor in @fd as well as the > * io_uring parameters in @params and creates a valid io_uring in @ring. > * Returns 0 on success, negative values on failure. > */ > int uring_import(int fd, struct io_uring *ring, struct io_uring_params *params) > { > int rc; > > memset(ring, 0, sizeof(*ring)); > ring->flags = params->flags; > ring->features = params->features; > ring->ring_fd = fd; > > ring->sq.ring_sz = params->sq_off.array + > params->sq_entries * sizeof(unsigned); > ring->cq.ring_sz = params->cq_off.cqes + > params->cq_entries * sizeof(struct io_uring_cqe); > > ring->sq.ring_ptr = mmap(NULL, ring->sq.ring_sz, PROT_READ | PROT_WRITE, > MAP_SHARED | MAP_POPULATE, fd, > IORING_OFF_SQ_RING); > if (ring->sq.ring_ptr == MAP_FAILED) > fatal("import mmap(ring)"); > > ring->cq.ring_ptr = mmap(0, ring->cq.ring_sz, PROT_READ | PROT_WRITE, > MAP_SHARED | MAP_POPULATE, > fd, IORING_OFF_CQ_RING); > if (ring->cq.ring_ptr == MAP_FAILED) { > ring->cq.ring_ptr = NULL; > goto err; > } > > ring->sq.khead = ring->sq.ring_ptr + params->sq_off.head; > ring->sq.ktail = ring->sq.ring_ptr + params->sq_off.tail; > ring->sq.kring_mask = ring->sq.ring_ptr + params->sq_off.ring_mask; > ring->sq.kring_entries = ring->sq.ring_ptr + > params->sq_off.ring_entries; > ring->sq.kflags = ring->sq.ring_ptr + params->sq_off.flags; > ring->sq.kdropped = ring->sq.ring_ptr + params->sq_off.dropped; > ring->sq.array = ring->sq.ring_ptr + params->sq_off.array; > > ring->sq.sqes = mmap(NULL, > params->sq_entries * sizeof(struct io_uring_sqe), > PROT_READ | PROT_WRITE, MAP_SHARED | MAP_POPULATE, > fd, IORING_OFF_SQES); > if (ring->sq.sqes == MAP_FAILED) > goto err; > > ring->cq.khead = ring->cq.ring_ptr + params->cq_off.head; > ring->cq.ktail = ring->cq.ring_ptr + params->cq_off.tail; > ring->cq.kring_mask = ring->cq.ring_ptr + params->cq_off.ring_mask; > ring->cq.kring_entries = ring->cq.ring_ptr + > params->cq_off.ring_entries; > ring->cq.koverflow = ring->cq.ring_ptr + params->cq_off.overflow; > ring->cq.cqes = ring->cq.ring_ptr + params->cq_off.cqes; > if (params->cq_off.flags) > ring->cq.kflags = ring->cq.ring_ptr + params->cq_off.flags; > > return 0; > > err: > if (ring->sq.ring_ptr) > munmap(ring->sq.ring_ptr, ring->sq.ring_sz); > if (ring->cq.ring_ptr); > munmap(ring->cq.ring_ptr, ring->cq.ring_sz); > fatal("import mmap"); > } > > void uring_shutdown(struct io_uring *ring) > { > if (!ring) > return; > io_uring_queue_exit(ring); > } > > /** > * An io_uring test > * @param ring the io_uring pointer > * @param personality the registered personality to use or 0 > * @param path the file path to use for the test > * > * This function executes an io_uring test, see the function body for more > * details. Returns 0 on success, negative values on failure. > */ > int uring_op_a(struct io_uring *ring, int personality, const char *path) > { > > #define __OP_A_BSIZE 512 > #define __OP_A_STR "Lorem ipsum dolor sit amet.\n" > > int rc; > int fds[1]; > char buf1[__OP_A_BSIZE]; > char buf2[__OP_A_BSIZE]; > struct io_uring_sqe *sqe; > struct io_uring_cqe *cqe; > int str_sz = strlen(__OP_A_STR); > > memset(buf1, 0, __OP_A_BSIZE); > memset(buf2, 0, __OP_A_BSIZE); > strncpy(buf1, __OP_A_STR, str_sz); > > if (personality > 0) > printf(">>> io_uring ops using personality = %d\n", > personality); > > /* > * open > */ > > sqe = io_uring_get_sqe(ring); > if (!sqe) > fatal("io_uring_get_sqe(open)"); > io_uring_prep_openat(sqe, AT_FDCWD, path, > O_RDWR | O_TRUNC | O_CREAT, 0644); > if (personality > 0) > sqe->personality = personality; > > rc = io_uring_submit(ring); > if (rc < 0) > fatal("io_uring_submit(open)"); > > rc = io_uring_wait_cqe(ring, &cqe); > fds[0] = cqe->res; > if (rc < 0) > fatal("io_uring_wait_cqe(open)"); > if (fds[0] < 0) > fatal("uring_open"); > io_uring_cqe_seen(ring, cqe); > > rc = io_uring_register_files(ring, fds, 1); > if(rc) > fatal("io_uring_register_files"); > > printf(">>> io_uring open(): OK\n"); > > /* > * write > */ > > sqe = io_uring_get_sqe(ring); > if (!sqe) > fatal("io_uring_get_sqe(write1)"); > io_uring_prep_write(sqe, 0, buf1, str_sz, 0); > io_uring_sqe_set_flags(sqe, IOSQE_FIXED_FILE); > if (personality > 0) > sqe->personality = personality; > > rc = io_uring_submit(ring); > if (rc < 0) > fatal("io_uring_submit(write)"); > > rc = io_uring_wait_cqe(ring, &cqe); > if (rc < 0) > fatal("io_uring_wait_cqe(write)"); > if (cqe->res < 0) > fatal("uring_write"); > if (cqe->res != str_sz) > fatal("uring_write(length)"); > io_uring_cqe_seen(ring, cqe); > > printf(">>> io_uring write(): OK\n"); > > /* > * read > */ > > sqe = io_uring_get_sqe(ring); > if (!sqe) > fatal("io_uring_get_sqe(read1)"); > io_uring_prep_read(sqe, 0, buf2,__OP_A_BSIZE, 0); > io_uring_sqe_set_flags(sqe, IOSQE_FIXED_FILE); > if (personality > 0) > sqe->personality = personality; > > rc = io_uring_submit(ring); > if (rc < 0) > fatal("io_uring_submit(read)"); > > rc = io_uring_wait_cqe(ring, &cqe); > if (rc < 0) > fatal("io_uring_wait_cqe(read)"); > if (cqe->res < 0) > fatal("uring_read"); > if (cqe->res != str_sz) > fatal("uring_read(length)"); > io_uring_cqe_seen(ring, cqe); > > if (strncmp(buf1, buf2, str_sz)) > fatal("strncmp(buf1,buf2)"); > > printf(">>> io_uring read(): OK\n"); > > /* > * close > */ > > sqe = io_uring_get_sqe(ring); > if (!sqe) > fatal("io_uring_get_sqe(close)"); > io_uring_prep_close(sqe, 0); > if (personality > 0) > sqe->personality = personality; > > rc = io_uring_submit(ring); > if (rc < 0) > fatal("io_uring_submit(close)"); > > rc = io_uring_wait_cqe(ring, &cqe); > if (rc < 0) > fatal("io_uring_wait_cqe(close)"); > if (cqe->res < 0) > fatal("uring_close"); > io_uring_cqe_seen(ring, cqe); > > rc = io_uring_unregister_files(ring); > if (rc < 0) > fatal("io_uring_unregister_files"); > > printf(">>> io_uring close(): OK\n"); > > return 0; > } > > /** > * The main entrypoint to the test program > * @param argc number of command line options > * @param argv the command line options array > */ > int main(int argc, char *argv[]) > { > int rc = 1; > int ring_shm_fd; > struct io_uring ring_storage, *ring; > struct urt_config *cfg_p; > > enum { TST_UNKNOWN, > TST_SQPOLL, > TST_T1_PARENT, TST_T1_CHILD } tst_method; > > /* parse the command line and do some sanity checks */ > tst_method = TST_UNKNOWN; > if (argc >= 2) { > if (!strcmp(argv[1], "sqpoll")) > tst_method = TST_SQPOLL; > else if (!strcmp(argv[1], "t1") || > !strcmp(argv[1], "t1_parent")) > tst_method = TST_T1_PARENT; > else if (!strcmp(argv[1], "t1_child")) > tst_method = TST_T1_CHILD; > } > if (tst_method == TST_UNKNOWN) { > fprintf(stderr, "usage: %s <method> ... \n", argv[0]); > exit(EINVAL); > } > > /* simple header */ > printf(">>> running as PID = %d\n", getpid()); > printf(">>> LSM/SELinux = %s\n", selinux_current()); > > /* > * test setup (if necessary) > */ > if (tst_method == TST_SQPOLL || tst_method == TST_T1_PARENT) { > /* create an io_uring and prepare it for optional sharing */ > int flags; > > /* create a shm segment to hold the io_uring info */ > ring_shm_fd = shm_open(URING_SHM_NAME, O_CREAT | O_RDWR, > S_IRUSR | S_IWUSR); > if (ring_shm_fd < 0) > fatal("shm_open(create)"); > > rc = ftruncate(ring_shm_fd, sizeof(struct urt_config)); > if (rc < 0) > fatal("ftruncate(shm)"); > > cfg_p = mmap(NULL, sizeof(*cfg_p), PROT_READ | PROT_WRITE, > MAP_SHARED, ring_shm_fd, 0); > if (!cfg_p) > fatal("mmap(shm)"); > > /* create the io_uring */ > memset(&cfg_p->ring, 0, sizeof(cfg_p->ring)); > memset(&cfg_p->ring_params, 0, sizeof(cfg_p->ring_params)); > if (tst_method == TST_SQPOLL) > cfg_p->ring_params.flags |= IORING_SETUP_SQPOLL; > rc = uring_setup(&cfg_p->ring, &cfg_p->ring_params, > &cfg_p->ring_creds); > if (rc) > fatal("uring_setup"); > ring = &cfg_p->ring; > > /* explicitly clear FD_CLOEXEC on the io_uring */ > flags = fcntl(cfg_p->ring.ring_fd, F_GETFD, 0); > if (flags < 0) > fatal("fcntl(ring_shm_fd,getfd)"); > flags &= ~FD_CLOEXEC; > rc = fcntl(cfg_p->ring.ring_fd, F_SETFD, flags); > if (rc) > fatal("fcntl(ring_shm_fd,setfd)"); > } else if (tst_method = TST_T1_CHILD) { > /* import a previously created and shared io_uring */ > > /* open the existing shm segment with the io_uring info */ > ring_shm_fd = shm_open(URING_SHM_NAME, O_RDWR, 0); > if (ring_shm_fd < 0) > fatal("shm_open(existing)"); > cfg_p = mmap(NULL, sizeof(*cfg_p), PROT_READ | PROT_WRITE, > MAP_SHARED, ring_shm_fd, 0); > if (!cfg_p) > fatal("mmap(shm)"); > > /* import the io_uring */ > ring = &ring_storage; > rc = uring_import(cfg_p->ring.ring_fd, > ring, &cfg_p->ring_params); > if (rc < 0) > fatal("uring_import"); > } > > /* > * fork/exec a child process (if necessary) > */ > if (tst_method == TST_T1_PARENT) { > pid_t pid; > > /* set the ctx for the next exec */ > if (argc >= 3) { > printf(">>> set LSM/SELinux exec: %s\n", > (selinux_exec(argv[2]) > 0 ? "OK" : "FAILED")); > } > > /* fork/exec */ > pid = fork(); > if (!pid) { > /* start the child */ > rc = execl(argv[0], argv[0], "t1_child", (char *)NULL); > if (rc < 0) > fatal("exec"); > } else { > /* wait for the child to exit */ > int status; > waitpid(pid, &status, 0); > if (WIFEXITED(status)) > rc = WEXITSTATUS(status); > } > } > > /* > * run test(s) > */ > if (tst_method == TST_SQPOLL || tst_method == TST_T1_CHILD) { > rc = uring_op_a(ring, cfg_p->ring_creds, "/tmp/iouring.4.txt"); > if (rc < 0) > fatal("uring_op_a(\"/tmp/iouring.4.txt\")"); > } > > /* > * cleanup > */ > if (tst_method == TST_SQPOLL || tst_method == TST_T1_PARENT) { > printf(">>> shutdown\n"); > uring_shutdown(&cfg_p->ring); > shm_unlink(URING_SHM_NAME); > } else if (tst_method == TST_T1_CHILD) { > shm_unlink(URING_SHM_NAME); > } > > return rc; > } - RGB -- Richard Guy Briggs <rgb@redhat.com> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635
On 2021-08-24 16:57, Richard Guy Briggs wrote: > On 2021-08-11 16:48, Paul Moore wrote: > > Draft #2 of the patchset which brings auditing and proper LSM access > > controls to the io_uring subsystem. The original patchset was posted > > in late May and can be found via lore using the link below: > > > > https://lore.kernel.org/linux-security-module/162163367115.8379.8459012634106035341.stgit@sifl/ > > > > This draft should incorporate all of the feedback from the original > > posting as well as a few smaller things I noticed while playing > > further with the code. The big change is of course the selective > > auditing in the io_uring op servicing, but that has already been > > discussed quite a bit in the original thread so I won't go into > > detail here; the important part is that we found a way to move > > forward and this draft captures that. For those of you looking to > > play with these patches, they are based on Linus' v5.14-rc5 tag and > > on my test system they boot and appear to function without problem; > > they pass the selinux-testsuite and audit-testsuite and I have not > > noticed any regressions in the normal use of the system. If you want > > to get a copy of these patches straight from git you can use the > > "working-io_uring" branch in the repo below: > > > > git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git > > https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git > > > > Beyond the existing test suite tests mentioned above, I've cobbled > > together some very basic, very crude tests to exercise some of the > > things I care about from a LSM/audit perspective. These tests are > > pretty awful (I'm not kidding), but they might be helpful for the > > other LSM/audit developers who want to test things: > > > > https://drop.paul-moore.com/90.kUgq > > > > There are currently two tests: 'iouring.2' and 'iouring.3'; > > 'iouring.1' was lost in a misguided and overzealous 'rm' command. > > The first test is standalone and basically tests the SQPOLL > > functionality while the second tests sharing io_urings across process > > boundaries and the credential/personality sharing mechanism. The > > console output of both tests isn't particularly useful, the more > > interesting bits are in the audit and LSM specific logs. The > > 'iouring.2' command requires no special arguments to run but the > > 'iouring.3' test is split into a "server" and "client"; the server > > should be run without argument: > > > > % ./iouring.3s > > >>> server started, pid = 11678 > > >>> memfd created, fd = 3 > > >>> io_uring created; fd = 5, creds = 1 > > > > ... while the client should be run with two arguments: the first is > > the PID of the server process, the second is the "memfd" fd number: > > > > % ./iouring.3c 11678 3 > > >>> client started, server_pid = 11678 server_memfd = 3 > > >>> io_urings = 5 (server) / 5 (client) > > >>> io_uring ops using creds = 1 > > >>> async op result: 36 > > >>> async op result: 36 > > >>> async op result: 36 > > >>> async op result: 36 > > >>> START file contents > > What is this life if, full of care, > > we have no time to stand and stare. > > >>> END file contents > > > > The tests were hacked together from various sources online, > > attribution and links to additional info can be found in the test > > sources, but I expect these tests to die a fiery death in the not > > to distant future as I work to add some proper tests to the SELinux > > and audit test suites. > > > > As I believe these patches should spend a full -rcX cycle in > > linux-next, my current plan is to continue to solicit feedback on > > these patches while they undergo additional testing (next up is > > verification of the audit filter code for io_uring). Assuming no > > critical issues are found on the mailing lists or during testing, I > > will post a proper patchset later with the idea of merging it into > > selinux/next after the upcoming merge window closes. > > > > Any comments, feedback, etc. are welcome. > > Thanks for the tests. I have a bunch of userspace patches to add to the > last set I posted and these tests will help exercise them. I also have > one more kernel patch to post... I'll dive back into that now. I had > wanted to post them before now but got distracted with AUDIT_TRIM > breakage. Please tell me about liburing.h that is needed for these. There is one in tools/io_uring/liburing.h but I don't think that one is right. The next obvious one would be include/uapi/linux/io_uring.h I must be missing something obvious here... > > --- > > > > Casey Schaufler (1): > > Smack: Brutalist io_uring support with debug > > > > Paul Moore (8): > > audit: prepare audit_context for use in calling contexts beyond > > syscalls > > audit,io_uring,io-wq: add some basic audit support to io_uring > > audit: dev/test patch to force io_uring auditing > > audit: add filtering for io_uring records > > fs: add anon_inode_getfile_secure() similar to > > anon_inode_getfd_secure() > > io_uring: convert io_uring to the secure anon inode interface > > lsm,io_uring: add LSM hooks to io_uring > > selinux: add support for the io_uring access controls > > > > > > fs/anon_inodes.c | 29 ++ > > fs/io-wq.c | 4 + > > fs/io_uring.c | 69 +++- > > include/linux/anon_inodes.h | 4 + > > include/linux/audit.h | 26 ++ > > include/linux/lsm_hook_defs.h | 5 + > > include/linux/lsm_hooks.h | 13 + > > include/linux/security.h | 16 + > > include/uapi/linux/audit.h | 4 +- > > kernel/audit.h | 7 +- > > kernel/audit_tree.c | 3 +- > > kernel/audit_watch.c | 3 +- > > kernel/auditfilter.c | 15 +- > > kernel/auditsc.c | 483 +++++++++++++++++++----- > > security/security.c | 12 + > > security/selinux/hooks.c | 34 ++ > > security/selinux/include/classmap.h | 2 + > > security/smack/smack_lsm.c | 64 ++++ > > 18 files changed, 678 insertions(+), 115 deletions(-) > > > > - RGB > > -- > Richard Guy Briggs <rgb@redhat.com> > Sr. S/W Engineer, Kernel Security, Base Operating Systems > Remote, Ottawa, Red Hat Canada > IRC: rgb, SunRaycer > Voice: +1.647.777.2635, Internal: (81) 32635 > - RGB -- Richard Guy Briggs <rgb@redhat.com> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635
On Wed, Aug 25, 2021 at 9:16 PM Richard Guy Briggs <rgb@redhat.com> wrote: > > On 2021-08-24 16:57, Richard Guy Briggs wrote: > > On 2021-08-11 16:48, Paul Moore wrote: > > > Draft #2 of the patchset which brings auditing and proper LSM access > > > controls to the io_uring subsystem. The original patchset was posted > > > in late May and can be found via lore using the link below: > > > > > > https://lore.kernel.org/linux-security-module/162163367115.8379.8459012634106035341.stgit@sifl/ > > > > > > This draft should incorporate all of the feedback from the original > > > posting as well as a few smaller things I noticed while playing > > > further with the code. The big change is of course the selective > > > auditing in the io_uring op servicing, but that has already been > > > discussed quite a bit in the original thread so I won't go into > > > detail here; the important part is that we found a way to move > > > forward and this draft captures that. For those of you looking to > > > play with these patches, they are based on Linus' v5.14-rc5 tag and > > > on my test system they boot and appear to function without problem; > > > they pass the selinux-testsuite and audit-testsuite and I have not > > > noticed any regressions in the normal use of the system. If you want > > > to get a copy of these patches straight from git you can use the > > > "working-io_uring" branch in the repo below: > > > > > > git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git > > > https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git > > > > > > Beyond the existing test suite tests mentioned above, I've cobbled > > > together some very basic, very crude tests to exercise some of the > > > things I care about from a LSM/audit perspective. These tests are > > > pretty awful (I'm not kidding), but they might be helpful for the > > > other LSM/audit developers who want to test things: > > > > > > https://drop.paul-moore.com/90.kUgq > > > > > > There are currently two tests: 'iouring.2' and 'iouring.3'; > > > 'iouring.1' was lost in a misguided and overzealous 'rm' command. > > > The first test is standalone and basically tests the SQPOLL > > > functionality while the second tests sharing io_urings across process > > > boundaries and the credential/personality sharing mechanism. The > > > console output of both tests isn't particularly useful, the more > > > interesting bits are in the audit and LSM specific logs. The > > > 'iouring.2' command requires no special arguments to run but the > > > 'iouring.3' test is split into a "server" and "client"; the server > > > should be run without argument: > > > > > > % ./iouring.3s > > > >>> server started, pid = 11678 > > > >>> memfd created, fd = 3 > > > >>> io_uring created; fd = 5, creds = 1 > > > > > > ... while the client should be run with two arguments: the first is > > > the PID of the server process, the second is the "memfd" fd number: > > > > > > % ./iouring.3c 11678 3 > > > >>> client started, server_pid = 11678 server_memfd = 3 > > > >>> io_urings = 5 (server) / 5 (client) > > > >>> io_uring ops using creds = 1 > > > >>> async op result: 36 > > > >>> async op result: 36 > > > >>> async op result: 36 > > > >>> async op result: 36 > > > >>> START file contents > > > What is this life if, full of care, > > > we have no time to stand and stare. > > > >>> END file contents > > > > > > The tests were hacked together from various sources online, > > > attribution and links to additional info can be found in the test > > > sources, but I expect these tests to die a fiery death in the not > > > to distant future as I work to add some proper tests to the SELinux > > > and audit test suites. > > > > > > As I believe these patches should spend a full -rcX cycle in > > > linux-next, my current plan is to continue to solicit feedback on > > > these patches while they undergo additional testing (next up is > > > verification of the audit filter code for io_uring). Assuming no > > > critical issues are found on the mailing lists or during testing, I > > > will post a proper patchset later with the idea of merging it into > > > selinux/next after the upcoming merge window closes. > > > > > > Any comments, feedback, etc. are welcome. > > > > Thanks for the tests. I have a bunch of userspace patches to add to the > > last set I posted and these tests will help exercise them. I also have > > one more kernel patch to post... I'll dive back into that now. I had > > wanted to post them before now but got distracted with AUDIT_TRIM > > breakage. > > Please tell me about liburing.h that is needed for these. There is one > in tools/io_uring/liburing.h but I don't think that one is right. > > The next obvious one would be include/uapi/linux/io_uring.h > > I must be missing something obvious here... You are looking for the liburing header files, the upstream is here: -> https://github.com/axboe/liburing If you are on a RH/IBM based distro it is likely called liburing[-devel]: % dnf whatprovides */liburing.h Last metadata expiration check: 0:38:37 ago on Wed 25 Aug 2021 08:54:22 PM EDT. liburing-devel-2.0-2.fc35.i686 : Development files for Linux-native io_uring I/O : access library Repo : rawhide Matched from: Filename : /usr/include/liburing.h liburing-devel-2.0-2.fc35.x86_64 : Development files for Linux-native io_uring : I/O access library Repo : @System Matched from: Filename : /usr/include/liburing.h liburing-devel-2.0-2.fc35.x86_64 : Development files for Linux-native io_uring : I/O access library Repo : rawhide Matched from: Filename : /usr/include/liburing.h
On 2021-08-25 21:34, Paul Moore wrote: > On Wed, Aug 25, 2021 at 9:16 PM Richard Guy Briggs <rgb@redhat.com> wrote: > > > > On 2021-08-24 16:57, Richard Guy Briggs wrote: > > > On 2021-08-11 16:48, Paul Moore wrote: > > > > Draft #2 of the patchset which brings auditing and proper LSM access > > > > controls to the io_uring subsystem. The original patchset was posted > > > > in late May and can be found via lore using the link below: > > > > > > > > https://lore.kernel.org/linux-security-module/162163367115.8379.8459012634106035341.stgit@sifl/ > > > > > > > > This draft should incorporate all of the feedback from the original > > > > posting as well as a few smaller things I noticed while playing > > > > further with the code. The big change is of course the selective > > > > auditing in the io_uring op servicing, but that has already been > > > > discussed quite a bit in the original thread so I won't go into > > > > detail here; the important part is that we found a way to move > > > > forward and this draft captures that. For those of you looking to > > > > play with these patches, they are based on Linus' v5.14-rc5 tag and > > > > on my test system they boot and appear to function without problem; > > > > they pass the selinux-testsuite and audit-testsuite and I have not > > > > noticed any regressions in the normal use of the system. If you want > > > > to get a copy of these patches straight from git you can use the > > > > "working-io_uring" branch in the repo below: > > > > > > > > git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git > > > > https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git > > > > > > > > Beyond the existing test suite tests mentioned above, I've cobbled > > > > together some very basic, very crude tests to exercise some of the > > > > things I care about from a LSM/audit perspective. These tests are > > > > pretty awful (I'm not kidding), but they might be helpful for the > > > > other LSM/audit developers who want to test things: > > > > > > > > https://drop.paul-moore.com/90.kUgq > > > > > > > > There are currently two tests: 'iouring.2' and 'iouring.3'; > > > > 'iouring.1' was lost in a misguided and overzealous 'rm' command. > > > > The first test is standalone and basically tests the SQPOLL > > > > functionality while the second tests sharing io_urings across process > > > > boundaries and the credential/personality sharing mechanism. The > > > > console output of both tests isn't particularly useful, the more > > > > interesting bits are in the audit and LSM specific logs. The > > > > 'iouring.2' command requires no special arguments to run but the > > > > 'iouring.3' test is split into a "server" and "client"; the server > > > > should be run without argument: > > > > > > > > % ./iouring.3s > > > > >>> server started, pid = 11678 > > > > >>> memfd created, fd = 3 > > > > >>> io_uring created; fd = 5, creds = 1 > > > > > > > > ... while the client should be run with two arguments: the first is > > > > the PID of the server process, the second is the "memfd" fd number: > > > > > > > > % ./iouring.3c 11678 3 > > > > >>> client started, server_pid = 11678 server_memfd = 3 > > > > >>> io_urings = 5 (server) / 5 (client) > > > > >>> io_uring ops using creds = 1 > > > > >>> async op result: 36 > > > > >>> async op result: 36 > > > > >>> async op result: 36 > > > > >>> async op result: 36 > > > > >>> START file contents > > > > What is this life if, full of care, > > > > we have no time to stand and stare. > > > > >>> END file contents > > > > > > > > The tests were hacked together from various sources online, > > > > attribution and links to additional info can be found in the test > > > > sources, but I expect these tests to die a fiery death in the not > > > > to distant future as I work to add some proper tests to the SELinux > > > > and audit test suites. > > > > > > > > As I believe these patches should spend a full -rcX cycle in > > > > linux-next, my current plan is to continue to solicit feedback on > > > > these patches while they undergo additional testing (next up is > > > > verification of the audit filter code for io_uring). Assuming no > > > > critical issues are found on the mailing lists or during testing, I > > > > will post a proper patchset later with the idea of merging it into > > > > selinux/next after the upcoming merge window closes. > > > > > > > > Any comments, feedback, etc. are welcome. > > > > > > Thanks for the tests. I have a bunch of userspace patches to add to the > > > last set I posted and these tests will help exercise them. I also have > > > one more kernel patch to post... I'll dive back into that now. I had > > > wanted to post them before now but got distracted with AUDIT_TRIM > > > breakage. > > > > Please tell me about liburing.h that is needed for these. There is one > > in tools/io_uring/liburing.h but I don't think that one is right. > > > > The next obvious one would be include/uapi/linux/io_uring.h > > > > I must be missing something obvious here... > > You are looking for the liburing header files, the upstream is here: > -> https://github.com/axboe/liburing > > If you are on a RH/IBM based distro it is likely called liburing[-devel]: Found it but struct io_uring missing "features" in everything except rawhide. Forced upgrade of my test VMs. :-) audit-testsuite still passes. I'm getting: # ./iouring.2 Kernel thread io_uring-sq is not running. Unable to setup io_uring: Permission denied # ./iouring.3s >>> server started, pid = 2082 >>> memfd created, fd = 3 io_uring_queue_init: Permission denied I have CONFIG_IO_URING=y set, what else is needed? > % dnf whatprovides */liburing.h > Last metadata expiration check: 0:38:37 ago on Wed 25 Aug 2021 08:54:22 PM EDT. > liburing-devel-2.0-2.fc35.i686 : Development files for Linux-native io_uring I/O > : access library > Repo : rawhide > Matched from: > Filename : /usr/include/liburing.h > > liburing-devel-2.0-2.fc35.x86_64 : Development files for Linux-native io_uring > : I/O access library > Repo : @System > Matched from: > Filename : /usr/include/liburing.h > > liburing-devel-2.0-2.fc35.x86_64 : Development files for Linux-native io_uring > : I/O access library > Repo : rawhide > Matched from: > Filename : /usr/include/liburing.h > > -- > paul moore - RGB -- Richard Guy Briggs <rgb@redhat.com> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635
On Thu, Aug 26, 2021 at 12:32 PM Richard Guy Briggs <rgb@redhat.com> wrote: > I'm getting: > # ./iouring.2 > Kernel thread io_uring-sq is not running. > Unable to setup io_uring: Permission denied > > # ./iouring.3s > >>> server started, pid = 2082 > >>> memfd created, fd = 3 > io_uring_queue_init: Permission denied > > I have CONFIG_IO_URING=y set, what else is needed? I'm not sure how you tried to run those tests, but try running as root and with SELinux in permissive mode.
On 2021-08-26 15:14, Paul Moore wrote: > On Thu, Aug 26, 2021 at 12:32 PM Richard Guy Briggs <rgb@redhat.com> wrote: > > I'm getting: > > # ./iouring.2 > > Kernel thread io_uring-sq is not running. > > Unable to setup io_uring: Permission denied > > > > # ./iouring.3s > > >>> server started, pid = 2082 > > >>> memfd created, fd = 3 > > io_uring_queue_init: Permission denied > > > > I have CONFIG_IO_URING=y set, what else is needed? > > I'm not sure how you tried to run those tests, but try running as root > and with SELinux in permissive mode. Ok, they ran, including iouring.4. iouring.2 claimed twice: "Kernel thread io_uring-sq is not running." and I didn't get any URING records with ausearch. I don't know if any of this is expected. > paul moore - RGB -- Richard Guy Briggs <rgb@redhat.com> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635
On Fri, Aug 27, 2021 at 9:36 AM Richard Guy Briggs <rgb@redhat.com> wrote: > On 2021-08-26 15:14, Paul Moore wrote: > > On Thu, Aug 26, 2021 at 12:32 PM Richard Guy Briggs <rgb@redhat.com> wrote: > > > I'm getting: > > > # ./iouring.2 > > > Kernel thread io_uring-sq is not running. > > > Unable to setup io_uring: Permission denied > > > > > > # ./iouring.3s > > > >>> server started, pid = 2082 > > > >>> memfd created, fd = 3 > > > io_uring_queue_init: Permission denied > > > > > > I have CONFIG_IO_URING=y set, what else is needed? > > > > I'm not sure how you tried to run those tests, but try running as root > > and with SELinux in permissive mode. > > Ok, they ran, including iouring.4. iouring.2 claimed twice: "Kernel > thread io_uring-sq is not running." and I didn't get any URING records > with ausearch. I don't know if any of this is expected. Now that I've written iouring.4, I would skip the others; while helpful at the time, they are pretty crap. I have no idea what kernel you are running, but I'm going to assume you've applied the v2 patches (if not, you obviously need to do that <g>). Beyond that you may need to set a filter for the io_uring_enter() syscall to force the issue; theoretically your audit userspace patches should allow a uring op specifically to be filtered but I haven't had a chance to try that yet so either the kernel or userspace portion could be broken. At this point if you are running into problems you'll probably need to spend some time debugging them, as I think you're the only person who has tested your audit userspace patches at this point (and the only one who has access to your latest bits).
On 2021-08-27 15:49, Paul Moore wrote: > On Fri, Aug 27, 2021 at 9:36 AM Richard Guy Briggs <rgb@redhat.com> wrote: > > On 2021-08-26 15:14, Paul Moore wrote: > > > On Thu, Aug 26, 2021 at 12:32 PM Richard Guy Briggs <rgb@redhat.com> wrote: > > > > I'm getting: > > > > # ./iouring.2 > > > > Kernel thread io_uring-sq is not running. > > > > Unable to setup io_uring: Permission denied > > > > > > > > # ./iouring.3s > > > > >>> server started, pid = 2082 > > > > >>> memfd created, fd = 3 > > > > io_uring_queue_init: Permission denied > > > > > > > > I have CONFIG_IO_URING=y set, what else is needed? > > > > > > I'm not sure how you tried to run those tests, but try running as root > > > and with SELinux in permissive mode. > > > > Ok, they ran, including iouring.4. iouring.2 claimed twice: "Kernel > > thread io_uring-sq is not running." and I didn't get any URING records > > with ausearch. I don't know if any of this is expected. > > Now that I've written iouring.4, I would skip the others; while > helpful at the time, they are pretty crap. Ok. > I have no idea what kernel you are running, but I'm going to assume > you've applied the v2 patches (if not, you obviously need to do that > <g>). Beyond that you may need to set a filter for the > io_uring_enter() syscall to force the issue; theoretically your audit > userspace patches should allow a uring op specifically to be filtered > but I haven't had a chance to try that yet so either the kernel or > userspace portion could be broken. I'm running audit/next (on 5.14-rc1) with your v2 patches. I did set a syscall filter for -a exit,always -F arch=b64 -S io_uring_enter,io_uring_setup,io_uring_register -F key=iouringsyscall and that yielded some records with a couple of orphans that surprised me a bit. I've attached that log. I was a bit surprised there were no records for ./iouring.3*. I'm now testing the new "-a uring,always -U ..." to get that userspace code working as expected... > At this point if you are running into problems you'll probably need to > spend some time debugging them, as I think you're the only person who > has tested your audit userspace patches at this point (and the only > one who has access to your latest bits). Yes, I'll do some basic debugging and then publish to avoid wasting people's time on silly bugs, but to get help on the more serious ones. > paul moore - RGB -- Richard Guy Briggs <rgb@redhat.com> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635 ---- type=PROCTITLE msg=audit(2021-08-27 16:41:56.190:328) : proctitle=auditctl -a exit,always -F arch b64 -S io_uring_enter,io_uring_setup,io_uring_register -F key=iouringsyscall type=SYSCALL msg=audit(2021-08-27 16:41:56.190:328) : arch=x86_64 syscall=sendto success=yes exit=1072 a0=0x4 a1=0x7ffff3e0dc10 a2=0x430 a3=0x0 items=0 ppid=543 pid=12433 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=auditctl exe=/usr/sbin/auditctl subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) type=CONFIG_CHANGE msg=audit(2021-08-27 16:41:56.190:328) : auid=root ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 op=add_rule key=iouringsyscall list=exit res=yes ---- type=PROCTITLE msg=audit(2021-08-27 16:42:22.032:329) : proctitle=./iouring.2 type=SYSCALL msg=audit(2021-08-27 16:42:22.032:329) : arch=x86_64 syscall=io_uring_setup success=yes exit=3 a0=0x8 a1=0x7fff6037b890 a2=0x7f38ee9de7a7 a3=0x3 items=0 ppid=543 pid=12437 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=iouring.2 exe=/root/rgb/testing/iouring/iouring.2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=iouringsyscall ---- type=PROCTITLE msg=audit(2021-08-27 16:42:22.034:330) : proctitle=./iouring.2 type=MMAP msg=audit(2021-08-27 16:42:22.034:330) : fd=3 flags=MAP_SHARED|MAP_POPULATE type=SYSCALL msg=audit(2021-08-27 16:42:22.034:330) : arch=x86_64 syscall=mmap success=yes exit=139882499366912 a0=0x0 a1=0x260 a2=PROT_READ|PROT_WRITE a3=MAP_SHARED|MAP_POPULATE items=0 ppid=543 pid=12437 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=iouring.2 exe=/root/rgb/testing/iouring/iouring.2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(2021-08-27 16:42:22.034:330) : avc: denied { write } for pid=12437 comm=iouring.2 path=anon_inode:[io_uring] dev="anon_inodefs" ino=26726 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:unconfined_t:s0 tclass=anon_inode permissive=1 type=AVC msg=audit(2021-08-27 16:42:22.034:330) : avc: denied { map } for pid=12437 comm=iouring.2 path=anon_inode:[io_uring] dev="anon_inodefs" ino=26726 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:unconfined_t:s0 tclass=anon_inode permissive=1 ---- type=PROCTITLE msg=audit(2021-08-27 16:42:22.036:331) : proctitle=./iouring.2 type=SYSCALL msg=audit(2021-08-27 16:42:22.036:331) : arch=x86_64 syscall=io_uring_register success=yes exit=0 a0=0x3 a1=0x2 a2=0x7fff6037b854 a3=0x1 items=0 ppid=543 pid=12437 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=iouring.2 exe=/root/rgb/testing/iouring/iouring.2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=iouringsyscall ---- type=PROCTITLE msg=audit(2021-08-27 16:42:22.037:332) : proctitle=./iouring.2 type=SYSCALL msg=audit(2021-08-27 16:42:22.037:332) : arch=x86_64 syscall=io_uring_enter success=yes exit=2 a0=0x3 a1=0x2 a2=0x0 a3=0x2 items=0 ppid=543 pid=12437 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=iouring.2 exe=/root/rgb/testing/iouring/iouring.2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=iouringsyscall ---- type=PROCTITLE msg=audit(2021-08-27 16:42:22.037:333) : proctitle=./iouring.2 type=SYSCALL msg=audit(2021-08-27 16:42:22.037:333) : arch=x86_64 syscall=io_uring_enter success=yes exit=0 a0=0x3 a1=0x0 a2=0x1 a3=0x1 items=0 ppid=543 pid=12437 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=iouring.2 exe=/root/rgb/testing/iouring/iouring.2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=iouringsyscall ---- type=PROCTITLE msg=audit(2021-08-27 16:42:22.038:334) : proctitle=./iouring.2 type=SYSCALL msg=audit(2021-08-27 16:42:22.038:334) : arch=x86_64 syscall=io_uring_enter success=yes exit=0 a0=0x3 a1=0x0 a2=0x1 a3=0x1 items=0 ppid=543 pid=12437 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=iouring.2 exe=/root/rgb/testing/iouring/iouring.2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=iouringsyscall ---- type=PROCTITLE msg=audit(2021-08-27 16:42:22.084:335) : proctitle=./iouring.2 type=SYSCALL msg=audit(2021-08-27 16:42:22.084:335) : arch=x86_64 syscall=io_uring_enter success=yes exit=0 a0=0x3 a1=0x0 a2=0x1 a3=0x1 items=0 ppid=543 pid=12437 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=iouring.2 exe=/root/rgb/testing/iouring/iouring.2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=iouringsyscall ---- type=PROCTITLE msg=audit(2021-08-27 16:42:30.624:336) : proctitle=./iouring.4 sqpoll type=SYSCALL msg=audit(2021-08-27 16:42:30.624:336) : arch=x86_64 syscall=io_uring_setup success=yes exit=4 a0=0x8 a1=0x7fefe5ac10d8 a2=0x7fefe5ac10d8 a3=0x3 items=0 ppid=543 pid=12447 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=iouring.4 exe=/root/rgb/testing/iouring/iouring.4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=iouringsyscall ---- type=PROCTITLE msg=audit(2021-08-27 16:42:30.625:337) : proctitle=./iouring.4 sqpoll type=SYSCALL msg=audit(2021-08-27 16:42:30.625:337) : arch=x86_64 syscall=io_uring_register success=yes exit=1 a0=0x4 a1=0x9 a2=0x0 a3=0x0 items=0 ppid=543 pid=12447 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=iouring.4 exe=/root/rgb/testing/iouring/iouring.4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=iouringsyscall ---- type=PROCTITLE msg=audit(2021-08-27 16:42:30.626:338) : proctitle=./iouring.4 sqpoll type=SYSCALL msg=audit(2021-08-27 16:42:30.626:338) : arch=x86_64 syscall=io_uring_enter success=yes exit=1 a0=0x4 a1=0x1 a2=0x0 a3=0x2 items=0 ppid=543 pid=12447 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=iouring.4 exe=/root/rgb/testing/iouring/iouring.4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=iouringsyscall ---- type=PROCTITLE msg=audit(2021-08-27 16:42:30.627:341) : proctitle=./iouring.4 sqpoll type=SYSCALL msg=audit(2021-08-27 16:42:30.627:341) : arch=x86_64 syscall=io_uring_enter success=yes exit=0 a0=0x4 a1=0x0 a2=0x1 a3=0x1 items=0 ppid=543 pid=12447 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=iouring.4 exe=/root/rgb/testing/iouring/iouring.4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=iouringsyscall ---- type=URINGOP msg=audit(2021-08-27 16:42:30.628:339) : uring_op=18 success=no exit=EAGAIN(Resource temporarily unavailable) items=0 ppid=543 pid=12447 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) ---- type=PATH msg=audit(2021-08-27 16:42:30.628:340) : item=1 name=/tmp/iouring.4.txt inode=33 dev=00:1f mode=file,644 ouid=root ogid=root rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(2021-08-27 16:42:30.628:340) : item=0 name=/tmp/ inode=1 dev=00:1f mode=dir,sticky,777 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:tmp_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(2021-08-27 16:42:30.628:340) : cwd=/root/rgb/testing/iouring type=URINGOP msg=audit(2021-08-27 16:42:30.628:340) : uring_op=18 success=yes exit=0 items=2 ppid=543 pid=12447 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) ---- type=PROCTITLE msg=audit(2021-08-27 16:42:30.629:342) : proctitle=./iouring.4 sqpoll type=SYSCALL msg=audit(2021-08-27 16:42:30.629:342) : arch=x86_64 syscall=io_uring_register success=yes exit=0 a0=0x4 a1=0x2 a2=0x7ffff75290a8 a3=0x1 items=0 ppid=543 pid=12447 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=iouring.4 exe=/root/rgb/testing/iouring/iouring.4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=iouringsyscall ---- type=PROCTITLE msg=audit(2021-08-27 16:42:30.629:343) : proctitle=./iouring.4 sqpoll type=SYSCALL msg=audit(2021-08-27 16:42:30.629:343) : arch=x86_64 syscall=io_uring_enter success=yes exit=0 a0=0x4 a1=0x0 a2=0x1 a3=0x1 items=0 ppid=543 pid=12447 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=iouring.4 exe=/root/rgb/testing/iouring/iouring.4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=iouringsyscall ---- type=PROCTITLE msg=audit(2021-08-27 16:42:30.631:344) : proctitle=./iouring.4 sqpoll type=SYSCALL msg=audit(2021-08-27 16:42:30.631:344) : arch=x86_64 syscall=io_uring_enter success=yes exit=0 a0=0x4 a1=0x0 a2=0x1 a3=0x1 items=0 ppid=543 pid=12447 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=iouring.4 exe=/root/rgb/testing/iouring/iouring.4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=iouringsyscall ---- type=PROCTITLE msg=audit(2021-08-27 16:42:30.632:346) : proctitle=./iouring.4 sqpoll type=SYSCALL msg=audit(2021-08-27 16:42:30.632:346) : arch=x86_64 syscall=io_uring_enter success=yes exit=0 a0=0x4 a1=0x0 a2=0x1 a3=0x1 items=0 ppid=543 pid=12447 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=iouring.4 exe=/root/rgb/testing/iouring/iouring.4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=iouringsyscall ---- type=URINGOP msg=audit(2021-08-27 16:42:30.633:345) : uring_op=19 success=yes exit=0 items=0 ppid=543 pid=12447 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) ---- type=PROCTITLE msg=audit(2021-08-27 16:42:30.634:347) : proctitle=./iouring.4 sqpoll type=SYSCALL msg=audit(2021-08-27 16:42:30.634:347) : arch=x86_64 syscall=io_uring_register success=yes exit=0 a0=0x4 a1=0x3 a2=0x0 a3=0x0 items=0 ppid=543 pid=12447 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=iouring.4 exe=/root/rgb/testing/iouring/iouring.4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=iouringsyscall ---- type=PROCTITLE msg=audit(2021-08-27 16:42:36.895:348) : proctitle=./iouring.4 t1 type=SYSCALL msg=audit(2021-08-27 16:42:36.895:348) : arch=x86_64 syscall=io_uring_setup success=yes exit=4 a0=0x8 a1=0x7fcaf2b8a0d8 a2=0x7fcaf2b8a0d8 a3=0x3 items=0 ppid=543 pid=12451 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=iouring.4 exe=/root/rgb/testing/iouring/iouring.4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=iouringsyscall ---- type=PROCTITLE msg=audit(2021-08-27 16:42:36.896:349) : proctitle=./iouring.4 t1 type=SYSCALL msg=audit(2021-08-27 16:42:36.896:349) : arch=x86_64 syscall=io_uring_register success=yes exit=1 a0=0x4 a1=0x9 a2=0x0 a3=0x0 items=0 ppid=543 pid=12451 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=iouring.4 exe=/root/rgb/testing/iouring/iouring.4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=iouringsyscall ---- type=PROCTITLE msg=audit(2021-08-27 16:42:36.902:350) : proctitle=./iouring.4 t1_child type=PATH msg=audit(2021-08-27 16:42:36.902:350) : item=0 name=/tmp/iouring.4.txt nametype=UNKNOWN cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(2021-08-27 16:42:36.902:350) : cwd=/root/rgb/testing/iouring type=SYSCALL msg=audit(2021-08-27 16:42:36.902:350) : arch=x86_64 syscall=io_uring_enter success=yes exit=1 a0=0x4 a1=0x1 a2=0x0 a3=0x0 items=1 ppid=12451 pid=12452 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=iouring.4 exe=/root/rgb/testing/iouring/iouring.4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=iouringsyscall type=URINGOP msg=audit(2021-08-27 16:42:36.902:350) : uring_op=18 items=1 ppid=12451 pid=12452 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=iouringsyscall ---- type=PATH msg=audit(2021-08-27 16:42:36.902:351) : item=0 name=/tmp/iouring.4.txt inode=33 dev=00:1f mode=file,644 ouid=root ogid=root rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(2021-08-27 16:42:36.902:351) : cwd=/root/rgb/testing/iouring type=URINGOP msg=audit(2021-08-27 16:42:36.902:351) : uring_op=18 success=yes exit=0 items=1 ppid=12451 pid=12452 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) ---- type=PROCTITLE msg=audit(2021-08-27 16:42:36.902:352) : proctitle=./iouring.4 t1_child type=SYSCALL msg=audit(2021-08-27 16:42:36.902:352) : arch=x86_64 syscall=io_uring_enter success=yes exit=0 a0=0x4 a1=0x0 a2=0x1 a3=0x1 items=0 ppid=12451 pid=12452 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=iouring.4 exe=/root/rgb/testing/iouring/iouring.4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=iouringsyscall ---- type=PROCTITLE msg=audit(2021-08-27 16:42:36.902:353) : proctitle=./iouring.4 t1_child type=SYSCALL msg=audit(2021-08-27 16:42:36.902:353) : arch=x86_64 syscall=io_uring_register success=yes exit=0 a0=0x4 a1=0x2 a2=0x7ffc0645bcb8 a3=0x1 items=0 ppid=12451 pid=12452 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=iouring.4 exe=/root/rgb/testing/iouring/iouring.4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=iouringsyscall ---- type=PROCTITLE msg=audit(2021-08-27 16:42:36.903:354) : proctitle=./iouring.4 t1_child type=SYSCALL msg=audit(2021-08-27 16:42:36.903:354) : arch=x86_64 syscall=io_uring_enter success=yes exit=1 a0=0x4 a1=0x1 a2=0x0 a3=0x0 items=0 ppid=12451 pid=12452 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=iouring.4 exe=/root/rgb/testing/iouring/iouring.4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=iouringsyscall ---- type=PROCTITLE msg=audit(2021-08-27 16:42:36.903:355) : proctitle=./iouring.4 t1_child type=SYSCALL msg=audit(2021-08-27 16:42:36.903:355) : arch=x86_64 syscall=io_uring_enter success=yes exit=0 a0=0x4 a1=0x0 a2=0x1 a3=0x1 items=0 ppid=12451 pid=12452 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=iouring.4 exe=/root/rgb/testing/iouring/iouring.4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=iouringsyscall ---- type=PROCTITLE msg=audit(2021-08-27 16:42:36.903:356) : proctitle=./iouring.4 t1_child type=SYSCALL msg=audit(2021-08-27 16:42:36.903:356) : arch=x86_64 syscall=io_uring_enter success=yes exit=1 a0=0x4 a1=0x1 a2=0x0 a3=0x0 items=0 ppid=12451 pid=12452 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=iouring.4 exe=/root/rgb/testing/iouring/iouring.4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=iouringsyscall ---- type=PROCTITLE msg=audit(2021-08-27 16:42:36.903:357) : proctitle=./iouring.4 t1_child type=SYSCALL msg=audit(2021-08-27 16:42:36.903:357) : arch=x86_64 syscall=io_uring_enter success=yes exit=0 a0=0x4 a1=0x0 a2=0x1 a3=0x1 items=0 ppid=12451 pid=12452 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=iouring.4 exe=/root/rgb/testing/iouring/iouring.4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=iouringsyscall ---- type=PROCTITLE msg=audit(2021-08-27 16:42:36.904:358) : proctitle=./iouring.4 t1_child type=SYSCALL msg=audit(2021-08-27 16:42:36.904:358) : arch=x86_64 syscall=io_uring_enter success=yes exit=1 a0=0x4 a1=0x1 a2=0x0 a3=0x0 items=0 ppid=12451 pid=12452 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=iouring.4 exe=/root/rgb/testing/iouring/iouring.4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=iouringsyscall type=URINGOP msg=audit(2021-08-27 16:42:36.904:358) : uring_op=19 items=0 ppid=12451 pid=12452 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=iouringsyscall ---- type=PROCTITLE msg=audit(2021-08-27 16:42:36.904:359) : proctitle=./iouring.4 t1_child type=SYSCALL msg=audit(2021-08-27 16:42:36.904:359) : arch=x86_64 syscall=io_uring_register success=yes exit=0 a0=0x4 a1=0x3 a2=0x0 a3=0x0 items=0 ppid=12451 pid=12452 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyS0 ses=1 comm=iouring.4 exe=/root/rgb/testing/iouring/iouring.4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=iouringsyscall ----
On Sat, Aug 28, 2021 at 11:04 AM Richard Guy Briggs <rgb@redhat.com> wrote: > I did set a syscall filter for > -a exit,always -F arch=b64 -S io_uring_enter,io_uring_setup,io_uring_register -F key=iouringsyscall > and that yielded some records with a couple of orphans that surprised me > a bit. Without looking too closely at the log you sent, you can expect URING records without an associated SYSCALL record when the uring op is being processed in the io-wq or sqpoll context. In the io-wq case the processing is happening after the thread finished the syscall but before the execution context returns to userspace and in the case of sqpoll the processing is handled by a separate kernel thread with no association to a process thread.
On Sun, Aug 29, 2021 at 11:18 AM Paul Moore <paul@paul-moore.com> wrote: > On Sat, Aug 28, 2021 at 11:04 AM Richard Guy Briggs <rgb@redhat.com> wrote: > > I did set a syscall filter for > > -a exit,always -F arch=b64 -S io_uring_enter,io_uring_setup,io_uring_register -F key=iouringsyscall > > and that yielded some records with a couple of orphans that surprised me > > a bit. > > Without looking too closely at the log you sent, you can expect URING > records without an associated SYSCALL record when the uring op is > being processed in the io-wq or sqpoll context. In the io-wq case the > processing is happening after the thread finished the syscall but > before the execution context returns to userspace and in the case of > sqpoll the processing is handled by a separate kernel thread with no > association to a process thread. I spent some time this morning/afternoon playing with the io_uring audit filtering capability and with your audit userspace ghau-iouring-filtering.v1.0 branch it appears to work correctly. Yes, the userspace tooling isn't quite 100% yet (e.g. `auditctl -l` doesn't map the io_uring ops correctly), but I know you mentioned you have a number of fixes/improvements still as a work-in-progress there so I'm not too concerned. The important part is that the kernel pieces look to be working correctly. As usual, if you notice anything awry while playing with the userspace changes please let me know.
On 2021-09-01 15:21, Paul Moore wrote: > On Sun, Aug 29, 2021 at 11:18 AM Paul Moore <paul@paul-moore.com> wrote: > > On Sat, Aug 28, 2021 at 11:04 AM Richard Guy Briggs <rgb@redhat.com> wrote: > > > I did set a syscall filter for > > > -a exit,always -F arch=b64 -S io_uring_enter,io_uring_setup,io_uring_register -F key=iouringsyscall > > > and that yielded some records with a couple of orphans that surprised me > > > a bit. > > > > Without looking too closely at the log you sent, you can expect URING > > records without an associated SYSCALL record when the uring op is > > being processed in the io-wq or sqpoll context. In the io-wq case the > > processing is happening after the thread finished the syscall but > > before the execution context returns to userspace and in the case of > > sqpoll the processing is handled by a separate kernel thread with no > > association to a process thread. > > I spent some time this morning/afternoon playing with the io_uring > audit filtering capability and with your audit userspace > ghau-iouring-filtering.v1.0 branch it appears to work correctly. Yes, > the userspace tooling isn't quite 100% yet (e.g. `auditctl -l` doesn't > map the io_uring ops correctly), but I know you mentioned you have a > number of fixes/improvements still as a work-in-progress there so I'm > not too concerned. The important part is that the kernel pieces look > to be working correctly. Ok, I have squashed and pushed the audit userspace support for iouring: https://github.com/rgbriggs/audit-userspace/commit/e8bd8d2ea8adcaa758024cb9b8fa93895ae35eea https://github.com/linux-audit/audit-userspace/compare/master...rgbriggs:ghak-iouring-filtering.v2.1 There are test rpms for f35 here: http://people.redhat.com/~rbriggs/ghak-iouring/git-e8bd8d2-fc35/ userspace v2 changelog: - check for watch before adding perm - update manpage to include filesystem filter - update support for the uring filter list: doc, -U op, op names - add support for the AUDIT_URINGOP record type - add uringop support to ausearch - add uringop support to aureport - lots of bug fixes "auditctl -a uring,always -S ..." will now throw an error and require "-U" instead. > As usual, if you notice anything awry while playing with the userspace > changes please let me know. Same for userspace... I think I already see one mapping uring op names in ausearch... > paul moore - RGB -- Richard Guy Briggs <rgb@redhat.com> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635
On Thu, Sep 9, 2021 at 8:59 PM Richard Guy Briggs <rgb@redhat.com> wrote: > On 2021-09-01 15:21, Paul Moore wrote: > > On Sun, Aug 29, 2021 at 11:18 AM Paul Moore <paul@paul-moore.com> wrote: > > > On Sat, Aug 28, 2021 at 11:04 AM Richard Guy Briggs <rgb@redhat.com> wrote: > > > > I did set a syscall filter for > > > > -a exit,always -F arch=b64 -S io_uring_enter,io_uring_setup,io_uring_register -F key=iouringsyscall > > > > and that yielded some records with a couple of orphans that surprised me > > > > a bit. > > > > > > Without looking too closely at the log you sent, you can expect URING > > > records without an associated SYSCALL record when the uring op is > > > being processed in the io-wq or sqpoll context. In the io-wq case the > > > processing is happening after the thread finished the syscall but > > > before the execution context returns to userspace and in the case of > > > sqpoll the processing is handled by a separate kernel thread with no > > > association to a process thread. > > > > I spent some time this morning/afternoon playing with the io_uring > > audit filtering capability and with your audit userspace > > ghau-iouring-filtering.v1.0 branch it appears to work correctly. Yes, > > the userspace tooling isn't quite 100% yet (e.g. `auditctl -l` doesn't > > map the io_uring ops correctly), but I know you mentioned you have a > > number of fixes/improvements still as a work-in-progress there so I'm > > not too concerned. The important part is that the kernel pieces look > > to be working correctly. > > Ok, I have squashed and pushed the audit userspace support for iouring: > https://github.com/rgbriggs/audit-userspace/commit/e8bd8d2ea8adcaa758024cb9b8fa93895ae35eea > https://github.com/linux-audit/audit-userspace/compare/master...rgbriggs:ghak-iouring-filtering.v2.1 > There are test rpms for f35 here: > http://people.redhat.com/~rbriggs/ghak-iouring/git-e8bd8d2-fc35/ > > userspace v2 changelog: > - check for watch before adding perm > - update manpage to include filesystem filter > - update support for the uring filter list: doc, -U op, op names > - add support for the AUDIT_URINGOP record type > - add uringop support to ausearch > - add uringop support to aureport > - lots of bug fixes > > "auditctl -a uring,always -S ..." will now throw an error and require > "-U" instead. Thanks Richard. FYI, I rebased the io_uring/LSM/audit patchset on top of v5.15-rc1 today and tested both with your v1.0 and with your v2.1 branch and the various combinations seemed to work just fine (of course the v2.1 userspace branch was more polished, less warts, etc.). I'm going to go over the patch set one more time to make sure everything is still looking good, write up an updated cover letter, and post a v3 revision later tonight with the hope of merging it into -next later this week.
On Mon, Sep 13, 2021 at 3:23 PM Paul Moore <paul@paul-moore.com> wrote: > On Thu, Sep 9, 2021 at 8:59 PM Richard Guy Briggs <rgb@redhat.com> wrote: > > On 2021-09-01 15:21, Paul Moore wrote: > > > On Sun, Aug 29, 2021 at 11:18 AM Paul Moore <paul@paul-moore.com> wrote: > > > > On Sat, Aug 28, 2021 at 11:04 AM Richard Guy Briggs <rgb@redhat.com> wrote: > > > > > I did set a syscall filter for > > > > > -a exit,always -F arch=b64 -S io_uring_enter,io_uring_setup,io_uring_register -F key=iouringsyscall > > > > > and that yielded some records with a couple of orphans that surprised me > > > > > a bit. > > > > > > > > Without looking too closely at the log you sent, you can expect URING > > > > records without an associated SYSCALL record when the uring op is > > > > being processed in the io-wq or sqpoll context. In the io-wq case the > > > > processing is happening after the thread finished the syscall but > > > > before the execution context returns to userspace and in the case of > > > > sqpoll the processing is handled by a separate kernel thread with no > > > > association to a process thread. > > > > > > I spent some time this morning/afternoon playing with the io_uring > > > audit filtering capability and with your audit userspace > > > ghau-iouring-filtering.v1.0 branch it appears to work correctly. Yes, > > > the userspace tooling isn't quite 100% yet (e.g. `auditctl -l` doesn't > > > map the io_uring ops correctly), but I know you mentioned you have a > > > number of fixes/improvements still as a work-in-progress there so I'm > > > not too concerned. The important part is that the kernel pieces look > > > to be working correctly. > > > > Ok, I have squashed and pushed the audit userspace support for iouring: > > https://github.com/rgbriggs/audit-userspace/commit/e8bd8d2ea8adcaa758024cb9b8fa93895ae35eea > > https://github.com/linux-audit/audit-userspace/compare/master...rgbriggs:ghak-iouring-filtering.v2.1 > > There are test rpms for f35 here: > > http://people.redhat.com/~rbriggs/ghak-iouring/git-e8bd8d2-fc35/ > > > > userspace v2 changelog: > > - check for watch before adding perm > > - update manpage to include filesystem filter > > - update support for the uring filter list: doc, -U op, op names > > - add support for the AUDIT_URINGOP record type > > - add uringop support to ausearch > > - add uringop support to aureport > > - lots of bug fixes > > > > "auditctl -a uring,always -S ..." will now throw an error and require > > "-U" instead. > > Thanks Richard. > > FYI, I rebased the io_uring/LSM/audit patchset on top of v5.15-rc1 > today and tested both with your v1.0 and with your v2.1 branch and the > various combinations seemed to work just fine (of course the v2.1 > userspace branch was more polished, less warts, etc.). I'm going to > go over the patch set one more time to make sure everything is still > looking good, write up an updated cover letter, and post a v3 revision > later tonight with the hope of merging it into -next later this week. Best laid plans of mice and men ... It turns out the LSM hook macros are full of warnings-now-errors that should likely be resolved before sending anything LSM related to Linus. I'll post v3 once I fix this, which may not be until tomorrow. (To be clear, the warnings/errors aren't new to this patchset, I'm likely just the first person to notice them.)
On Mon, Sep 13, 2021 at 9:50 PM Paul Moore <paul@paul-moore.com> wrote: > On Mon, Sep 13, 2021 at 3:23 PM Paul Moore <paul@paul-moore.com> wrote: > > On Thu, Sep 9, 2021 at 8:59 PM Richard Guy Briggs <rgb@redhat.com> wrote: > > > On 2021-09-01 15:21, Paul Moore wrote: > > > > On Sun, Aug 29, 2021 at 11:18 AM Paul Moore <paul@paul-moore.com> wrote: > > > > > On Sat, Aug 28, 2021 at 11:04 AM Richard Guy Briggs <rgb@redhat.com> wrote: > > > > > > I did set a syscall filter for > > > > > > -a exit,always -F arch=b64 -S io_uring_enter,io_uring_setup,io_uring_register -F key=iouringsyscall > > > > > > and that yielded some records with a couple of orphans that surprised me > > > > > > a bit. > > > > > > > > > > Without looking too closely at the log you sent, you can expect URING > > > > > records without an associated SYSCALL record when the uring op is > > > > > being processed in the io-wq or sqpoll context. In the io-wq case the > > > > > processing is happening after the thread finished the syscall but > > > > > before the execution context returns to userspace and in the case of > > > > > sqpoll the processing is handled by a separate kernel thread with no > > > > > association to a process thread. > > > > > > > > I spent some time this morning/afternoon playing with the io_uring > > > > audit filtering capability and with your audit userspace > > > > ghau-iouring-filtering.v1.0 branch it appears to work correctly. Yes, > > > > the userspace tooling isn't quite 100% yet (e.g. `auditctl -l` doesn't > > > > map the io_uring ops correctly), but I know you mentioned you have a > > > > number of fixes/improvements still as a work-in-progress there so I'm > > > > not too concerned. The important part is that the kernel pieces look > > > > to be working correctly. > > > > > > Ok, I have squashed and pushed the audit userspace support for iouring: > > > https://github.com/rgbriggs/audit-userspace/commit/e8bd8d2ea8adcaa758024cb9b8fa93895ae35eea > > > https://github.com/linux-audit/audit-userspace/compare/master...rgbriggs:ghak-iouring-filtering.v2.1 > > > There are test rpms for f35 here: > > > http://people.redhat.com/~rbriggs/ghak-iouring/git-e8bd8d2-fc35/ > > > > > > userspace v2 changelog: > > > - check for watch before adding perm > > > - update manpage to include filesystem filter > > > - update support for the uring filter list: doc, -U op, op names > > > - add support for the AUDIT_URINGOP record type > > > - add uringop support to ausearch > > > - add uringop support to aureport > > > - lots of bug fixes > > > > > > "auditctl -a uring,always -S ..." will now throw an error and require > > > "-U" instead. > > > > Thanks Richard. > > > > FYI, I rebased the io_uring/LSM/audit patchset on top of v5.15-rc1 > > today and tested both with your v1.0 and with your v2.1 branch and the > > various combinations seemed to work just fine (of course the v2.1 > > userspace branch was more polished, less warts, etc.). I'm going to > > go over the patch set one more time to make sure everything is still > > looking good, write up an updated cover letter, and post a v3 revision > > later tonight with the hope of merging it into -next later this week. > > Best laid plans of mice and men ... > > It turns out the LSM hook macros are full of warnings-now-errors that > should likely be resolved before sending anything LSM related to > Linus. I'll post v3 once I fix this, which may not be until tomorrow. > > (To be clear, the warnings/errors aren't new to this patchset, I'm > likely just the first person to notice them.) Actually, scratch that ... I'm thinking that might just be an oddity of the Intel 0day test robot building for the xtensa arch. I'll post the v3 patchset tonight.
On 2021-09-13 22:49, Paul Moore wrote: > On Mon, Sep 13, 2021 at 9:50 PM Paul Moore <paul@paul-moore.com> wrote: > > On Mon, Sep 13, 2021 at 3:23 PM Paul Moore <paul@paul-moore.com> wrote: > > > On Thu, Sep 9, 2021 at 8:59 PM Richard Guy Briggs <rgb@redhat.com> wrote: > > > > On 2021-09-01 15:21, Paul Moore wrote: > > > > > On Sun, Aug 29, 2021 at 11:18 AM Paul Moore <paul@paul-moore.com> wrote: > > > > > > On Sat, Aug 28, 2021 at 11:04 AM Richard Guy Briggs <rgb@redhat.com> wrote: > > > > > > > I did set a syscall filter for > > > > > > > -a exit,always -F arch=b64 -S io_uring_enter,io_uring_setup,io_uring_register -F key=iouringsyscall > > > > > > > and that yielded some records with a couple of orphans that surprised me > > > > > > > a bit. > > > > > > > > > > > > Without looking too closely at the log you sent, you can expect URING > > > > > > records without an associated SYSCALL record when the uring op is > > > > > > being processed in the io-wq or sqpoll context. In the io-wq case the > > > > > > processing is happening after the thread finished the syscall but > > > > > > before the execution context returns to userspace and in the case of > > > > > > sqpoll the processing is handled by a separate kernel thread with no > > > > > > association to a process thread. > > > > > > > > > > I spent some time this morning/afternoon playing with the io_uring > > > > > audit filtering capability and with your audit userspace > > > > > ghau-iouring-filtering.v1.0 branch it appears to work correctly. Yes, > > > > > the userspace tooling isn't quite 100% yet (e.g. `auditctl -l` doesn't > > > > > map the io_uring ops correctly), but I know you mentioned you have a > > > > > number of fixes/improvements still as a work-in-progress there so I'm > > > > > not too concerned. The important part is that the kernel pieces look > > > > > to be working correctly. > > > > > > > > Ok, I have squashed and pushed the audit userspace support for iouring: > > > > https://github.com/rgbriggs/audit-userspace/commit/e8bd8d2ea8adcaa758024cb9b8fa93895ae35eea > > > > https://github.com/linux-audit/audit-userspace/compare/master...rgbriggs:ghak-iouring-filtering.v2.1 > > > > There are test rpms for f35 here: > > > > http://people.redhat.com/~rbriggs/ghak-iouring/git-e8bd8d2-fc35/ > > > > > > > > userspace v2 changelog: > > > > - check for watch before adding perm > > > > - update manpage to include filesystem filter > > > > - update support for the uring filter list: doc, -U op, op names > > > > - add support for the AUDIT_URINGOP record type > > > > - add uringop support to ausearch > > > > - add uringop support to aureport > > > > - lots of bug fixes > > > > > > > > "auditctl -a uring,always -S ..." will now throw an error and require > > > > "-U" instead. > > > > > > Thanks Richard. > > > > > > FYI, I rebased the io_uring/LSM/audit patchset on top of v5.15-rc1 > > > today and tested both with your v1.0 and with your v2.1 branch and the > > > various combinations seemed to work just fine (of course the v2.1 > > > userspace branch was more polished, less warts, etc.). I'm going to > > > go over the patch set one more time to make sure everything is still > > > looking good, write up an updated cover letter, and post a v3 revision > > > later tonight with the hope of merging it into -next later this week. > > > > Best laid plans of mice and men ... > > > > It turns out the LSM hook macros are full of warnings-now-errors that > > should likely be resolved before sending anything LSM related to > > Linus. I'll post v3 once I fix this, which may not be until tomorrow. > > > > (To be clear, the warnings/errors aren't new to this patchset, I'm > > likely just the first person to notice them.) > > Actually, scratch that ... I'm thinking that might just be an oddity > of the Intel 0day test robot building for the xtensa arch. I'll post > the v3 patchset tonight. I was in the middle of reviewing the v2 patchset to add my acks when I forgot to add the comment that you still haven't convinced me that ses= isn't needed or relevant if we are including auid=. > paul moore - RGB -- Richard Guy Briggs <rgb@redhat.com> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635
On Wednesday, September 15, 2021 8:29:08 AM EDT Richard Guy Briggs wrote: > I was in the middle of reviewing the v2 patchset to add my acks when I > forgot to add the comment that you still haven't convinced me that ses= > isn't needed or relevant if we are including auid=. The session id is needed to disambiguate which login the event belongs to. It is necessary sometimes to trace an event back to the login because it was a remote login from an unexpected IP address. -Steve
On Wed, Sep 15, 2021 at 8:29 AM Richard Guy Briggs <rgb@redhat.com> wrote: > I was in the middle of reviewing the v2 patchset to add my acks when I > forgot to add the comment that you still haven't convinced me that ses= > isn't needed or relevant if we are including auid=. [Side note: v3 was posted on Monday, it would be more helpful to see the Reviewed-by tags on the v3 patchset.] Ah, okay, it wasn't clear to me from your earlier comments that this was your concern. It sounded as if you were arguing that both session ID and audit ID needed to be logged for every io_uring op, which doesn't make sense (as previously discussed). However, I see your point, and in fact pulling the audit ID from @current in the audit_log_uring() function is just plain wrong ... likely a vestige of the original copy-n-paste or format matching, I'll drop that now. Thanks. While a small code change, it is somewhat significant so I'll post an updated v4 patchset later today once it passes through a round of testing.