diff options
author | Richard Guy Briggs <rgb@redhat.com> | 2019-01-23 13:34:59 -0500 |
---|---|---|
committer | Paul Moore <paul@paul-moore.com> | 2019-01-25 16:12:55 -0500 |
commit | a252f56a3c922197ef40dce8f8cc258ae75e0193 (patch) | |
tree | 76998437c6dc721ac70e480ccc5081aa0ed52d01 /kernel/auditsc.c | |
parent | 2fec30e245a3b46fef89c4cb1f74eefc5fbb29a6 (diff) | |
download | linux-a252f56a3c922197ef40dce8f8cc258ae75e0193.tar.gz linux-a252f56a3c922197ef40dce8f8cc258ae75e0193.tar.bz2 linux-a252f56a3c922197ef40dce8f8cc258ae75e0193.zip |
audit: more filter PATH records keyed on filesystem magic
Like commit 42d5e37654e4 ("audit: filter PATH records keyed on
filesystem magic") that addresses
https://github.com/linux-audit/audit-kernel/issues/8
Any user or remote filesystem could become unavailable and effectively
block on a forced unmount.
-a always,exit -S umount2 -F key=umount2
Provide a method to ignore these user and remote filesystems to prevent
them from being impossible to unmount.
Extend the "AUDIT_FILTER_FS" filter that uses the field type
AUDIT_FSTYPE keying off the filesystem 4-octet hexadecimal magic
identifier to filter specific filesystems to cover audit_inode() to address
this blockage.
An example rule would look like:
-a never,filesystem -F fstype=0x517B -F key=ignore_smb
-a never,filesystem -F fstype=0x6969 -F key=ignore_nfs
Arguably the better way to address this issue is to disable auditing
processes that touch removable filesystems.
Note: refactor __audit_inode_child() to remove two levels of if
indentation.
Please see the github issue tracker
https://github.com/linux-audit/audit-kernel/issues/100
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'kernel/auditsc.c')
-rw-r--r-- | kernel/auditsc.c | 35 |
1 files changed, 27 insertions, 8 deletions
diff --git a/kernel/auditsc.c b/kernel/auditsc.c index c16beb25fd0a..a2696ce790f9 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1766,10 +1766,31 @@ void __audit_inode(struct filename *name, const struct dentry *dentry, struct inode *inode = d_backing_inode(dentry); struct audit_names *n; bool parent = flags & AUDIT_INODE_PARENT; + struct audit_entry *e; + struct list_head *list = &audit_filter_list[AUDIT_FILTER_FS]; + int i; if (!context->in_syscall) return; + rcu_read_lock(); + if (!list_empty(list)) { + list_for_each_entry_rcu(e, list, list) { + for (i = 0; i < e->rule.field_count; i++) { + struct audit_field *f = &e->rule.fields[i]; + + if (f->type == AUDIT_FSTYPE + && audit_comparator(inode->i_sb->s_magic, + f->op, f->val) + && e->rule.action == AUDIT_NEVER) { + rcu_read_unlock(); + return; + } + } + } + } + rcu_read_unlock(); + if (!name) goto out_alloc; @@ -1878,14 +1899,12 @@ void __audit_inode_child(struct inode *parent, for (i = 0; i < e->rule.field_count; i++) { struct audit_field *f = &e->rule.fields[i]; - if (f->type == AUDIT_FSTYPE) { - if (audit_comparator(parent->i_sb->s_magic, - f->op, f->val)) { - if (e->rule.action == AUDIT_NEVER) { - rcu_read_unlock(); - return; - } - } + if (f->type == AUDIT_FSTYPE + && audit_comparator(parent->i_sb->s_magic, + f->op, f->val) + && e->rule.action == AUDIT_NEVER) { + rcu_read_unlock(); + return; } } } |