From patchwork Thu Aug 13 14:48:58 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Thi=C3=A9baud_Weksteen?= X-Patchwork-Id: 11712565 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 9172C1744 for ; Thu, 13 Aug 2020 14:49:51 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7899820781 for ; Thu, 13 Aug 2020 14:49:51 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="brQMO6gX" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726106AbgHMOtZ (ORCPT ); Thu, 13 Aug 2020 10:49:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45464 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726427AbgHMOtW (ORCPT ); Thu, 13 Aug 2020 10:49:22 -0400 Received: from mail-yb1-xb4a.google.com (mail-yb1-xb4a.google.com [IPv6:2607:f8b0:4864:20::b4a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ABA38C061383 for ; Thu, 13 Aug 2020 07:49:21 -0700 (PDT) Received: by mail-yb1-xb4a.google.com with SMTP id w17so6922736ybl.9 for ; Thu, 13 Aug 2020 07:49:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:message-id:mime-version:subject:from:to:cc :content-transfer-encoding; bh=SEalPAaL/L400EFRhNDiBFOTi7pT/2kjH95anJxxgxI=; b=brQMO6gXvTrV2iIjuWTZ0a0xYUjqCYajx8AKbapPdz63kQ6krMyNmy5nRKklvp5bCn w41xOH4gOa0rGhWRgSSPP+zInZZipzm3Xqq+DqPQ7S6/3oroY0FUngVjJ9aQmrLaagsy OHY51yBqks31Yed941hnElUusZA5AB/Bs4X3me0ZHTrw+Zo6PKgEUeZdpdsnmCI96tKx i+4R3An/1umtigsoxZ5Tzx/ZAkI1K5WmIIv/E0C8amv1gcjVbo+CtTn6ZZtyB07QTzEj R49z2EfrHfvj5x3mCe4nJ33AYh0SEeiuvFmbeoKRsSas+zIFsnrflu0c8vsesRZNb54c byWA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:message-id:mime-version:subject:from:to:cc :content-transfer-encoding; bh=SEalPAaL/L400EFRhNDiBFOTi7pT/2kjH95anJxxgxI=; b=neDFAn55UVbIfjWKrVChdyoI25QtF6Y83BTS1UYSNDcqblc7pGtUPHtLo4ckSet9/M wNI41qahrE9bFPHyTPBED1Yh3b0klvg1nXGUidIiN566EjpgV0lnvJP4gl3MDYul5nhX bjXFYDOIzm6+3cD16/e2/mAht8M/DMi6vWK6SUbXmgNRQcvFFwjfSmm68cDJwa9Nm0Cq sqlpb2rnCwN3Xt8Y6clFVXEynSVFEYYLSEghkKQrXx/kA6IonHbUEom7kgKTE67uaTfy KoV5lkpgOWZXcKcOA1JfNDsm+wgAN6ulDkKSBGaEnLPaY9oh8OKn/Pi6RKshmiB3H42Z 1JXw== X-Gm-Message-State: AOAM5335R8rznbP8t7vVvDf0MPpxIuu/PzKlZ/Pxoc/pbiUaDFMEvJpI puFXe8UZ0cApaW9r43+Ul7ficwS92A== X-Google-Smtp-Source: ABdhPJzZtAT/LPYngsPA4jm9kXHeRMw5dGr+JkxZ1qFWnJ/D4JgdZUTLHH3l2MhXFU0U+oHTuGsdHjNawA== X-Received: by 2002:a25:8689:: with SMTP id z9mr7576775ybk.226.1597330160576; Thu, 13 Aug 2020 07:49:20 -0700 (PDT) Date: Thu, 13 Aug 2020 16:48:58 +0200 Message-Id: <20200813144914.737306-1-tweek@google.com> Mime-Version: 1.0 X-Mailer: git-send-email 2.28.0.236.gb10cc79966-goog Subject: [PATCH v2 1/2] selinux: add tracepoint on denials From: " =?utf-8?q?Thi=C3=A9baud_Weksteen?= " To: Paul Moore Cc: Nick Kralevich , " =?utf-8?q?Thi=C3=A9baud_Weksteen?= " , Joel Fernandes , Peter Enderborg , Stephen Smalley , Eric Paris , Steven Rostedt , Ingo Molnar , Mauro Carvalho Chehab , "David S. Miller" , Rob Herring , Arnd Bergmann , linux-kernel@vger.kernel.org, selinux@vger.kernel.org Sender: selinux-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org The audit data currently captures which process and which target is responsible for a denial. There is no data on where exactly in the process that call occurred. Debugging can be made easier by being able to reconstruct the unified kernel and userland stack traces [1]. Add a tracepoint on the SELinux denials which can then be used by userland (i.e. perf). Although this patch could manually be added by each OS developer to trouble shoot a denial, adding it to the kernel streamlines the developers workflow. It is possible to use perf for monitoring the event: # perf record -e avc:selinux_audited -g -a ^C # perf report -g [...] 6.40% 6.40% audited=800000 tclass=4 | __libc_start_main | |--4.60%--__GI___ioctl | entry_SYSCALL_64 | do_syscall_64 | __x64_sys_ioctl | ksys_ioctl | binder_ioctl | binder_set_nice | can_nice | capable | security_capable | cred_has_capability.isra.0 | slow_avc_audit | common_lsm_audit | avc_audit_post_callback | avc_audit_post_callback | It is also possible to use the ftrace interface: # echo 1 > /sys/kernel/debug/tracing/events/avc/selinux_audited/enable # cat /sys/kernel/debug/tracing/trace tracer: nop entries-in-buffer/entries-written: 1/1 #P:8 [...] dmesg-3624 [001] 13072.325358: selinux_denied: audited=800000 tclass=4 [1] https://source.android.com/devices/tech/debug/native_stack_dump Signed-off-by: Thiébaud Weksteen Suggested-by: Joel Fernandes Reviewed-by: Peter Enderborg --- v2 changes: - update changelog to include usage examples MAINTAINERS | 1 + include/trace/events/avc.h | 37 +++++++++++++++++++++++++++++++++++++ security/selinux/avc.c | 5 +++++ 3 files changed, 43 insertions(+) create mode 100644 include/trace/events/avc.h diff --git a/MAINTAINERS b/MAINTAINERS index c8e8232c65da..0efaea0e144c 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -15426,6 +15426,7 @@ T: git git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git F: Documentation/ABI/obsolete/sysfs-selinux-checkreqprot F: Documentation/ABI/obsolete/sysfs-selinux-disable F: Documentation/admin-guide/LSM/SELinux.rst +F: include/trace/events/avc.h F: include/uapi/linux/selinux_netlink.h F: scripts/selinux/ F: security/selinux/ diff --git a/include/trace/events/avc.h b/include/trace/events/avc.h new file mode 100644 index 000000000000..07c058a9bbcd --- /dev/null +++ b/include/trace/events/avc.h @@ -0,0 +1,37 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Author: Thiébaud Weksteen + */ +#undef TRACE_SYSTEM +#define TRACE_SYSTEM avc + +#if !defined(_TRACE_SELINUX_H) || defined(TRACE_HEADER_MULTI_READ) +#define _TRACE_SELINUX_H + +#include + +TRACE_EVENT(selinux_audited, + + TP_PROTO(struct selinux_audit_data *sad), + + TP_ARGS(sad), + + TP_STRUCT__entry( + __field(unsigned int, tclass) + __field(unsigned int, audited) + ), + + TP_fast_assign( + __entry->tclass = sad->tclass; + __entry->audited = sad->audited; + ), + + TP_printk("tclass=%u audited=%x", + __entry->tclass, + __entry->audited) +); + +#endif + +/* This part must be outside protection */ +#include diff --git a/security/selinux/avc.c b/security/selinux/avc.c index d18cb32a242a..b0a0af778b70 100644 --- a/security/selinux/avc.c +++ b/security/selinux/avc.c @@ -31,6 +31,9 @@ #include "avc_ss.h" #include "classmap.h" +#define CREATE_TRACE_POINTS +#include + #define AVC_CACHE_SLOTS 512 #define AVC_DEF_CACHE_THRESHOLD 512 #define AVC_CACHE_RECLAIM 16 @@ -706,6 +709,8 @@ static void avc_audit_post_callback(struct audit_buffer *ab, void *a) u32 scontext_len; int rc; + trace_selinux_audited(sad); + rc = security_sid_to_context(sad->state, sad->ssid, &scontext, &scontext_len); if (rc) From patchwork Thu Aug 13 14:48:59 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Thi=C3=A9baud_Weksteen?= X-Patchwork-Id: 11712567 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id AA1A4722 for ; Thu, 13 Aug 2020 14:50:02 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8ABD520791 for ; Thu, 13 Aug 2020 14:50:02 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="aPGwSU3D" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726583AbgHMOty (ORCPT ); Thu, 13 Aug 2020 10:49:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45512 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726567AbgHMOtm (ORCPT ); Thu, 13 Aug 2020 10:49:42 -0400 Received: from mail-qk1-x749.google.com (mail-qk1-x749.google.com [IPv6:2607:f8b0:4864:20::749]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7B3B0C061383 for ; Thu, 13 Aug 2020 07:49:40 -0700 (PDT) Received: by mail-qk1-x749.google.com with SMTP id q18so4053906qkq.11 for ; Thu, 13 Aug 2020 07:49:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc:content-transfer-encoding; bh=fCGrFQfpfR4RJs5ZY7NRIygzu/+q9MlAoBreTUrZtKI=; b=aPGwSU3DH9pOxvTlq3Vws4aZ298GUILOkQMZa7HkaFW7bbJTqkoKkJdDwZOvXyfLCD WjttKGnSDKQuTC1kLTWwWqMTBI1ZC/bDZLtFG9RSer2bvKuAZn5jEnRuMjOj4r6Ulfap WUhkJRfcn3VqdCv6hUbALW+EyFpBFQmAJbqtUzpKSYKypkVGXwwmjX1BnrtwwWD+FMU5 eL1WKBbm1M6vWDjHt54UOwQEex3jLh5y7x1L4MlyPsaiXESuJaS6q/Mt00dYpzsCtLCU 8JYET0WCgV0cQCSmIMmVESEZN206LNEL8hAZAZ3dOdAq6vKM75+dnliVv9V5CxmTWOyl wTdQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc:content-transfer-encoding; bh=fCGrFQfpfR4RJs5ZY7NRIygzu/+q9MlAoBreTUrZtKI=; b=s3Bf9OR/RkywPIe5Yl4HCWROkCJGhtuWnPqD3Wuug+++TDWQUzxkkkd+hYYoLOJn33 gFKzCpHgGMqUCJ/+SpMzNorO6GGC9epIv/wYiSpMQ3a/6a/7nx2HC39Fi3hzUO/oqm7R TGBrwDdrBIEKmmtXiuObqy6kTr6UhDhk9ez7Uhcv6KzphDrMmqp6Y4tRzhVNUa3Bjbos WgSptxf3dGO0GbtIatFMM7jiGD2/RxiHr5NF8ciURAk9mRffqTf/i8ubMOfUTgxPjVzH 7Nw0e5kcIjS0dsXr6QUs4jcsJGFJvuN1mrxbge+q3ECGk3jqnZKex1ItOSKtiRLgYl30 eDbg== X-Gm-Message-State: AOAM533QjcicFT7U7bo+XnLXbgwY08ni0sip8pyM0+DcUxCOwDeFMqPC IJpQawHusz2PaiqbypHYVsQ1SJMGYw== X-Google-Smtp-Source: ABdhPJwhDd55Hhnw1Df03C8Ckc1A5yrI74oFew+g5Iv+yieF4ooMZEPMYiaFMZYEMPON3RGCK0rWZJmfPg== X-Received: by 2002:ad4:54c6:: with SMTP id j6mr5037154qvx.126.1597330178932; Thu, 13 Aug 2020 07:49:38 -0700 (PDT) Date: Thu, 13 Aug 2020 16:48:59 +0200 In-Reply-To: <20200813144914.737306-1-tweek@google.com> Message-Id: <20200813144914.737306-2-tweek@google.com> Mime-Version: 1.0 References: <20200813144914.737306-1-tweek@google.com> X-Mailer: git-send-email 2.28.0.236.gb10cc79966-goog Subject: [PATCH v2 2/2] selinux: add basic filtering for audit trace events From: " =?utf-8?q?Thi=C3=A9baud_Weksteen?= " To: Paul Moore Cc: Nick Kralevich , Peter Enderborg , " =?utf-8?q?Thi=C3=A9baud_Wekst?= =?utf-8?q?een?= " , Stephen Smalley , Eric Paris , Steven Rostedt , Ingo Molnar , Mauro Carvalho Chehab , "David S. Miller" , Rob Herring , Arnd Bergmann , linux-kernel@vger.kernel.org, selinux@vger.kernel.org Sender: selinux-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org From: Peter Enderborg This patch adds further attributes to the event. These attributes are helpful to understand the context of the message and can be used to filter the events. There are three common items. Source context, target context and tclass. There are also items from the outcome of operation performed. An event is similar to: <...>-1309 [002] .... 6346.691689: selinux_audited: requested=0x4000000 denied=0x4000000 audited=0x4000000 result=-13 ssid=315 tsid=61 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=file With systems where many denials are occurring, it is useful to apply a filter. The filtering is a set of logic that is inserted with the filter file. Example: echo "tclass==\"file\" && ssid!=42" > events/avc/selinux_audited/filter This adds that we only get tclass=file but not for ssid 42. The trace can also have extra properties. Adding the user stack can be done with echo 1 > options/userstacktrace Now the output will be runcon-1365 [003] .... 6960.955530: selinux_audited: requested=0x4000000 denied=0x4000000 audited=0x4000000 result=-13 ssid=315 tsid=61 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=file runcon-1365 [003] .... 6960.955560: => <00007f325b4ce45b> => <00005607093efa57> Note that the ssid is the internal numeric representation of scontext and tsid is numeric for tcontext. They are useful for filtering. Signed-off-by: Peter Enderborg Reviewed-by: Thiébaud Weksteen --- v2 changes: - update changelog to include usage examples include/trace/events/avc.h | 41 ++++++++++++++++++++++++++++---------- security/selinux/avc.c | 22 +++++++++++--------- 2 files changed, 44 insertions(+), 19 deletions(-) diff --git a/include/trace/events/avc.h b/include/trace/events/avc.h index 07c058a9bbcd..ac5ef2e1c2c5 100644 --- a/include/trace/events/avc.h +++ b/include/trace/events/avc.h @@ -1,6 +1,7 @@ /* SPDX-License-Identifier: GPL-2.0 */ /* - * Author: Thiébaud Weksteen + * Authors: Thiébaud Weksteen + * Peter Enderborg */ #undef TRACE_SYSTEM #define TRACE_SYSTEM avc @@ -12,23 +13,43 @@ TRACE_EVENT(selinux_audited, - TP_PROTO(struct selinux_audit_data *sad), + TP_PROTO(struct selinux_audit_data *sad, + char *scontext, + char *tcontext, + const char *tclass + ), - TP_ARGS(sad), + TP_ARGS(sad, scontext, tcontext, tclass), TP_STRUCT__entry( - __field(unsigned int, tclass) - __field(unsigned int, audited) + __field(u32, requested) + __field(u32, denied) + __field(u32, audited) + __field(int, result) + __string(scontext, scontext) + __string(tcontext, tcontext) + __string(tclass, tclass) + __field(u32, ssid) + __field(u32, tsid) ), TP_fast_assign( - __entry->tclass = sad->tclass; - __entry->audited = sad->audited; + __entry->requested = sad->requested; + __entry->denied = sad->denied; + __entry->audited = sad->audited; + __entry->result = sad->result; + __entry->ssid = sad->ssid; + __entry->tsid = sad->tsid; + __assign_str(tcontext, tcontext); + __assign_str(scontext, scontext); + __assign_str(tclass, tclass); ), - TP_printk("tclass=%u audited=%x", - __entry->tclass, - __entry->audited) + TP_printk("requested=0x%x denied=0x%x audited=0x%x result=%d ssid=%u tsid=%u scontext=%s tcontext=%s tclass=%s", + __entry->requested, __entry->denied, __entry->audited, __entry->result, + __entry->ssid, __entry->tsid, __get_str(scontext), __get_str(tcontext), + __get_str(tclass) + ) ); #endif diff --git a/security/selinux/avc.c b/security/selinux/avc.c index b0a0af778b70..7de5cc5169af 100644 --- a/security/selinux/avc.c +++ b/security/selinux/avc.c @@ -705,35 +705,39 @@ static void avc_audit_post_callback(struct audit_buffer *ab, void *a) { struct common_audit_data *ad = a; struct selinux_audit_data *sad = ad->selinux_audit_data; - char *scontext; + char *scontext = NULL; + char *tcontext = NULL; + const char *tclass = NULL; u32 scontext_len; + u32 tcontext_len; int rc; - trace_selinux_audited(sad); - rc = security_sid_to_context(sad->state, sad->ssid, &scontext, &scontext_len); if (rc) audit_log_format(ab, " ssid=%d", sad->ssid); else { audit_log_format(ab, " scontext=%s", scontext); - kfree(scontext); } - rc = security_sid_to_context(sad->state, sad->tsid, &scontext, - &scontext_len); + rc = security_sid_to_context(sad->state, sad->tsid, &tcontext, + &tcontext_len); if (rc) audit_log_format(ab, " tsid=%d", sad->tsid); else { - audit_log_format(ab, " tcontext=%s", scontext); - kfree(scontext); + audit_log_format(ab, " tcontext=%s", tcontext); } - audit_log_format(ab, " tclass=%s", secclass_map[sad->tclass-1].name); + tclass = secclass_map[sad->tclass-1].name; + audit_log_format(ab, " tclass=%s", tclass); if (sad->denied) audit_log_format(ab, " permissive=%u", sad->result ? 0 : 1); + trace_selinux_audited(sad, scontext, tcontext, tclass); + kfree(tcontext); + kfree(scontext); + /* in case of invalid context report also the actual context string */ rc = security_sid_to_context_inval(sad->state, sad->ssid, &scontext, &scontext_len);