Skip to content

cloud-kernel
cloud-kernel

openanolis / cloud-kernel
接近 2 年 前同步成功

通知 170
Star 36
Fork 7
cloud-kernel
cloud-kernel
切换分支/标签
  1. 15 5月, 2018 3 次提交
  3. 08 5月, 2018 4 次提交
    • T
      seccomp: Don't special case audited processes when logging · 326bee02
      由 Tyler Hicks 提交于 
      Seccomp logging for "handled" actions such as RET_TRAP, RET_TRACE, or
RET_ERRNO can be very noisy for processes that are being audited. This
patch modifies the seccomp logging behavior to treat processes that are
being inspected via the audit subsystem the same as processes that
aren't under inspection. Handled actions will no longer be logged just
because the process is being inspected. Since v4.14, applications have
the ability to request logging of handled actions by using the
SECCOMP_FILTER_FLAG_LOG flag when loading seccomp filters.

With this patch, the logic for deciding if an action will be logged is:

  if action == RET_ALLOW:
    do not log
  else if action not in actions_logged:
    do not log
  else if action == RET_KILL:
    log
  else if action == RET_LOG:
    log
  else if filter-requests-logging:
    log
  else:
    do not log
Reported-by: NSteve Grubb <sgrubb@redhat.com>
Signed-off-by: NTyler Hicks <tyhicks@canonical.com>
Acked-by: NKees Cook <keescook@chromium.org>
Signed-off-by: NPaul Moore <paul@paul-moore.com>
      326bee02
    • T
      seccomp: Audit attempts to modify the actions_logged sysctl · ea6eca77
      由 Tyler Hicks 提交于 
      The decision to log a seccomp action will always be subject to the
value of the kernel.seccomp.actions_logged sysctl, even for processes
that are being inspected via the audit subsystem, in an upcoming patch.
Therefore, we need to emit an audit record on attempts at writing to the
actions_logged sysctl when auditing is enabled.

This patch updates the write handler for the actions_logged sysctl to
emit an audit record on attempts to write to the sysctl. Successful
writes to the sysctl will result in a record that includes a normalized
list of logged actions in the "actions" field and a "res" field equal to
1. Unsuccessful writes to the sysctl will result in a record that
doesn't include the "actions" field and has a "res" field equal to 0.

Not all unsuccessful writes to the sysctl are audited. For example, an
audit record will not be emitted if an unprivileged process attempts to
open the sysctl file for reading since that access control check is not
part of the sysctl's write handler.

Below are some example audit records when writing various strings to the
actions_logged sysctl.

Writing "not-a-real-action", when the kernel.seccomp.actions_logged
sysctl previously was "kill_process kill_thread trap errno trace log",
emits this audit record:

 type=CONFIG_CHANGE msg=audit(1525392371.454:120): op=seccomp-logging
 actions=? old-actions=kill_process,kill_thread,trap,errno,trace,log
 res=0

If you then write "kill_process kill_thread errno trace log", this audit
record is emitted:

 type=CONFIG_CHANGE msg=audit(1525392401.645:126): op=seccomp-logging
 actions=kill_process,kill_thread,errno,trace,log
 old-actions=kill_process,kill_thread,trap,errno,trace,log res=1

If you then write "log log errno trace kill_process kill_thread", which
is unordered and contains the log action twice, it results in the same
actions value as the previous record:

 type=CONFIG_CHANGE msg=audit(1525392436.354:132): op=seccomp-logging
 actions=kill_process,kill_thread,errno,trace,log
 old-actions=kill_process,kill_thread,errno,trace,log res=1

If you then write an empty string to the sysctl, this audit record is
emitted:

 type=CONFIG_CHANGE msg=audit(1525392494.413:138): op=seccomp-logging
 actions=(none) old-actions=kill_process,kill_thread,errno,trace,log
 res=1

No audit records are generated when reading the actions_logged sysctl.
Suggested-by: NSteve Grubb <sgrubb@redhat.com>
Signed-off-by: NTyler Hicks <tyhicks@canonical.com>
Acked-by: NKees Cook <keescook@chromium.org>
Signed-off-by: NPaul Moore <paul@paul-moore.com>
      ea6eca77
    • T
      seccomp: Configurable separator for the actions_logged string · beb44aca
      由 Tyler Hicks 提交于 
      The function that converts a bitmask of seccomp actions that are
allowed to be logged is currently only used for constructing the display
string for the kernel.seccomp.actions_logged sysctl. That string wants a
space character to be used for the separator between actions.

A future patch will make use of the same function for building a string
that will be sent to the audit subsystem for tracking modifications to
the kernel.seccomp.actions_logged sysctl. That string will need to use a
comma as a separator. This patch allows the separator character to be
configurable to meet both needs.
Signed-off-by: NTyler Hicks <tyhicks@canonical.com>
Acked-by: NKees Cook <keescook@chromium.org>
Signed-off-by: NPaul Moore <paul@paul-moore.com>
      beb44aca
    • T
      seccomp: Separate read and write code for actions_logged sysctl · d013db02
      由 Tyler Hicks 提交于 
      Break the read and write paths of the kernel.seccomp.actions_logged
sysctl into separate functions to maintain readability. An upcoming
change will need to audit writes, but not reads, of this sysctl which
would introduce too many conditional code paths on whether or not the
'write' parameter evaluates to true.
Signed-off-by: NTyler Hicks <tyhicks@canonical.com>
Acked-by: NKees Cook <keescook@chromium.org>
Signed-off-by: NPaul Moore <paul@paul-moore.com>
      d013db02
  5. 24 4月, 2018 1 次提交
  7. 21 4月, 2018 1 次提交
  9. 14 4月, 2018 14 次提交
  11. 12 4月, 2018 9 次提交
  13. 11 4月, 2018 6 次提交
  15. 10 4月, 2018 2 次提交