[lkml]   [2018]   [May]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH] audit: add containerid support for IMA-audit
On 05/21/2018 02:30 PM, Steve Grubb wrote:
> Hello Stefan,
> On Monday, May 21, 2018 1:53:04 PM EDT Stefan Berger wrote:
>> On 05/21/2018 12:58 PM, Steve Grubb wrote:
>>> On Thursday, May 17, 2018 10:18:13 AM EDT Stefan Berger wrote:
>>>>> audit_log_container_info() then releasing the local context. This
>>>>> version of the record has additional concerns covered here:
>>>> Following the discussion there and the concern with breaking user space,
>>>> how can we split up the AUDIT_INTEGRITY_RULE that is used in
>>>> ima_audit_measurement() and ima_parse_rule(), without 'breaking user
>>>> space'?
>>>> A message produced by ima_parse_rule() looks like this here:
>>>> type=INTEGRITY_RULE msg=audit(1526566213.870:305): action="dont_measure"
>>>> fsmagic="0x9fa0" res=1
>>> Why is action and fsmagic being logged as untrusted strings? Untrusted
>>> strings are used when an unprivileged user can affect the contents of the
>>> field such as creating a file with space or special characters in the
>>> name.
>>> Also, subject and object information is missing. Who loaded this rule?
>>>> in contrast to that an INTEGRITY_PCR record type:
>>>> type=INTEGRITY_PCR msg=audit(1526566235.193:334): pid=1615 uid=0 auid=0
>>>> ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>>>> op="invalid_pcr" cause="open_writers" comm="scp"
>>>> name="/var/log/audit/audit.log" dev="dm-0" ino=1962625 res=1
>>> Why is op & cause being logged as an untrusted string? This also has
>>> incomplete subject information.
>> It's calling audit_log_string() in both cases:
>> _audit.c#L48
> I see. Looking things over, I see that it seems like it should do the right
> thing. But the original purpose for this function is here:
> This is where it is logging an untrusted string and has to decide to encode
> it or just place it in quotes. If it has quotes, that means it's an untrusted
> string but has no control characters in it. I think you want to use
> audit_log_format() for any string that is trustworthy.

Replacing all occurrences (in IMA) of audit_log_string() with
> As an aside, I wonder why audit_log_string() is in the API when it is a
> helper to audit_log_untrustedstring() ? Without understanding the rules of
> untrusted strings, it can't be used correctly without re-inventing
> audit_log_untrustedstring() by hand.
>>>> Should some of the fields from INTEGRITY_PCR also appear in
>>>> INTEGRITY_RULE? If so, which ones?
>>> pid, uid, auid, tty, session, subj, comm, exe, res. <- these are
>>> required to be searchable
>>>> We could probably refactor the current integrity_audit_message() and
>>>> have ima_parse_rule() call into it to get those fields as well. I
>>>> suppose adding new fields to it wouldn't be considered breaking user
>>>> space?
>>> The audit user space utilities pretty much expects those fields in that
>>> order for any IMA originating events. You can add things like op or
>>> cause before
>> We will call into audit_log_task, which will put the parameters into
>> correct order:
>> auid uid gid ses subj pid comm exe
> I'm telling you what the correct order is. :-) A long time ago, the IMA

:-) Thanks. Was getting confused.

> system had audit events with the order I'm mentioning. For example, here's
> one from a log I collected back in 2013:
> type=INTEGRITY_PCR msg=audit(1327409021.813:21): pid=1 uid=0 auid=4294967295
> ses=4294967295 subj=kernel op="add_template_measure" cause="hash_added"
> comm="init" name="" dev=rootfs ino=5413 res=0
> it was missing "tty" and "exe", but the order is as I mentioned. The
> expectation is that INTEGRITY events maintain this established order across
> all events.

I am *appending* exe= and tty= now:

type=INTEGRITY_PCR msg=audit(1526939047.809:305): pid=1609 uid=0 auid=0
ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
op="invalid_pcr" cause="open_writers" comm="ssh"
name="/var/lib/sss/mc/passwd" dev="dm-0" ino=1962679 res=1
exe="/usr/bin/ssh" tty=tty2


> Thanks,
> -Steve
>>> that. The reason why you can do that is those additional fields are not
>>> required to be searchable by common criteria.
>>> -Steve

 \ /
  Last update: 2018-05-21 23:58    [W:0.106 / U:3.184 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site