lkml.org 
[lkml]   [2020]   [Jan]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH ghak25 v2 8/9] netfilter: add audit operation field
    Date
    Add the operation performed (register or replace) to the NETFILTER_CFG
    record.

    Here is the sample record:
    type=NETFILTER_CFG msg=audit(1494981627.248:9764): family=7 table=broute entries=0 op=replace

    See: https://github.com/linux-audit/audit-kernel/issues/25
    Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
    ---
    include/linux/audit.h | 8 ++++----
    kernel/auditsc.c | 7 ++++---
    net/bridge/netfilter/ebtables.c | 4 ++--
    net/netfilter/x_tables.c | 3 ++-
    4 files changed, 12 insertions(+), 10 deletions(-)

    diff --git a/include/linux/audit.h b/include/linux/audit.h
    index 96cabb095eed..5eab4d898c26 100644
    --- a/include/linux/audit.h
    +++ b/include/linux/audit.h
    @@ -379,7 +379,7 @@ extern int __audit_log_bprm_fcaps(struct linux_binprm *bprm,
    extern void __audit_fanotify(unsigned int response);
    extern void __audit_tk_injoffset(struct timespec64 offset);
    extern void __audit_ntp_log(const struct audit_ntp_data *ad);
    -extern void __audit_nf_cfg(const char *name, u8 af, int nentries);
    +extern void __audit_nf_cfg(const char *name, u8 af, int nentries, int op);

    static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
    {
    @@ -515,10 +515,10 @@ static inline void audit_ntp_log(const struct audit_ntp_data *ad)
    __audit_ntp_log(ad);
    }

    -static inline void audit_nf_cfg(const char *name, u8 af, int nentries)
    +static inline void audit_nf_cfg(const char *name, u8 af, int nentries, int op)
    {
    if (!audit_dummy_context())
    - __audit_nf_cfg(name, af, nentries);
    + __audit_nf_cfg(name, af, nentries, op);
    }

    extern int audit_n_rules;
    @@ -654,7 +654,7 @@ static inline void audit_ntp_log(const struct audit_ntp_data *ad)
    static inline void audit_ptrace(struct task_struct *t)
    { }

    -static inline void audit_nf_cfg(const char *name, u8 af, int nentries)
    +static inline void audit_nf_cfg(const char *name, u8 af, int nentries, int op)
    { }

    #define audit_n_rules 0
    diff --git a/kernel/auditsc.c b/kernel/auditsc.c
    index 4e1df4233cd3..999ac184246b 100644
    --- a/kernel/auditsc.c
    +++ b/kernel/auditsc.c
    @@ -2545,7 +2545,7 @@ void __audit_ntp_log(const struct audit_ntp_data *ad)
    audit_log_ntp_val(ad, "adjust", AUDIT_NTP_ADJUST);
    }

    -void __audit_nf_cfg(const char *name, u8 af, int nentries)
    +void __audit_nf_cfg(const char *name, u8 af, int nentries, int op)
    {
    struct audit_buffer *ab;
    struct audit_context *context = audit_context();
    @@ -2555,8 +2555,9 @@ void __audit_nf_cfg(const char *name, u8 af, int nentries)
    ab = audit_log_start(context, GFP_KERNEL, AUDIT_NETFILTER_CFG);
    if (!ab)
    return; /* audit_panic or being filtered */
    - audit_log_format(ab, "table=%s family=%u entries=%u",
    - name, af, nentries);
    + audit_log_format(ab, "table=%s family=%u entries=%u op=%s",
    + name, af, nentries,
    + op ? "replace" : "register");
    audit_log_end(ab);
    }
    EXPORT_SYMBOL_GPL(__audit_nf_cfg);
    diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
    index 58126547b175..baff2f05af43 100644
    --- a/net/bridge/netfilter/ebtables.c
    +++ b/net/bridge/netfilter/ebtables.c
    @@ -1049,7 +1049,7 @@ static int do_replace_finish(struct net *net, struct ebt_replace *repl,
    vfree(counterstmp);

    if (audit_enabled)
    - audit_nf_cfg(repl->name, AF_BRIDGE, repl->nentries);
    + audit_nf_cfg(repl->name, AF_BRIDGE, repl->nentries, 1);
    return ret;

    free_unlock:
    @@ -1220,7 +1220,7 @@ int ebt_register_table(struct net *net, const struct ebt_table *input_table,
    }

    if (audit_enabled)
    - audit_nf_cfg(repl->name, AF_BRIDGE, repl->nentries);
    + audit_nf_cfg(repl->name, AF_BRIDGE, repl->nentries, 0);
    return ret;
    free_unlock:
    mutex_unlock(&ebt_mutex);
    diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
    index c0416ae52f7f..4ae4f7bf8946 100644
    --- a/net/netfilter/x_tables.c
    +++ b/net/netfilter/x_tables.c
    @@ -1402,7 +1402,8 @@ struct xt_table_info *xt_replace_table(struct xt_table *table,
    }

    if (audit_enabled)
    - audit_nf_cfg(table->name, table->af, private->number);
    + audit_nf_cfg(table->name, table->af, private->number,
    + private->number);

    return private;
    }
    --
    1.8.3.1
    \
     
     \ /
      Last update: 2020-01-06 19:57    [W:2.254 / U:1.184 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site