archives/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-03-08 03:24:45 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

audit/stable-7.0 PR 20260203

Browse source 
-----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCgAyFiEES0KozwfymdVUl37v6iDy2pc3iXMFAmmCuoQUHHBhdWxAcGF1
 bC1tb29yZS5jb20ACgkQ6iDy2pc3iXMRFhAAntv4vmqRciFI4oEqxi5X8wmYmzc9
 BUQV2XXcfO63IOHdGrXmYHByx3+mZZddAPpYMTqrzA0p2NCqi4svCVwspUHwUcTY
 btl+xlppBJpBtUL5pmLiP6Q4u+zURYCwuA/OKfxuKa5Frm8D3kbkd5MpxJS15Mev
 qqEhLT0aj6/rjQpYVwOFGMwehKfE7iuyc8XTBaetvUKHW38sj18ANSpLnN5bmiuE
 3lz252kCjyDoOsu+vO0Saa8Rv8lVDjlSMn6mYr4L2fVygYwFDg2Gj7+bmB6LGYy9
 YyIm6P+b23E8GOltEObpvrz8ItPR7nvKNiDMEeP1eqGzQ/Mc5OqqljVaNMNPmP+s
 XN/jZt02XePKXlje+C08620mDVeIYp35TK1bY2/HrYMqySE0wwO1iSyBI4ftPFtu
 CteM8XA8oH49pspFWbEKCHmtFFGxDVjfVM7YrHeDc+qw2tJjZ7R1GRk5hadP1Ou7
 emxGLb6jfejT6NMNU8rM2RVmQNs1jcFh+8lHvDgqqQmaCXJd3AEgr+Om5w9kZ6fJ
 FyEkh0f9HuZdcEn8tqWaIwCAZXTzECOThj6hhxZGiG9xXFXza1eIXxq7VtIE6fdO
 ATAJ6cpcj0LIQmE7QWntS1NloPkWD1OSiWLNis0AgCiN97oRTk0oFJ5q7fD0bLUa
 HGAQqd4OJKmNciw=
 =pFeD
 -----END PGP SIGNATURE-----

Merge tag 'audit-pr-20260203' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit

Pull audit updates from Paul Moore:

 - Improve the NETFILTER_PKT audit records

   Add source and destination ports to the NETFILTER_PKT audit records
   while also consolidating a lot of the code into a new, singular
   audit_log_nf_skb() function. This new approach to structuring the
   NETFILTER_PKT record generation should eliminate some unnecessary
   overhead when audit is not built into the kernel.

 - Update the audit syscall classifier code

   Add the listxattrat(), getxattrat(), and fchmodat2() syscall to the
   audit code which classifies syscalls into categories of operations,
   e.g. "read" or "change attributes".

 - Move the syscall classifier declarations into audit_arch.h

   Shuffle around some header file declarations to resolve some sparse
   warnings.

* tag 'audit-pr-20260203' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
  audit: move the compat_xxx_class[] extern declarations to audit_arch.h
  audit: add missing syscalls to read class
  audit: include source and destination ports to NETFILTER_PKT
  audit: add audit_log_nf_skb helper function
  audit: add fchmodat2() to change attributes class
This commit is contained in:
Linus Torvalds 2026-02-09 10:13:03 -08:00
commit 698749164a
7 changed files with 185 additions and 120 deletions
Download patch file Download diff file Expand all files Collapse all files

3
include/asm-generic/audit_change_attr.h
View file

@ -26,6 +26,9 @@ __NR_fremovexattr,
__NR_fchownat,
__NR_fchmodat,
#endif
#ifdef __NR_fchmodat2
__NR_fchmodat2,
#endif
#ifdef __NR_chown32
__NR_chown32,
__NR_fchown32,

6
include/asm-generic/audit_read.h
View file

@ -4,9 +4,15 @@ __NR_readlink,
#endif
__NR_quotactl,
__NR_listxattr,
#ifdef __NR_listxattrat
__NR_listxattrat,
#endif
__NR_llistxattr,
__NR_flistxattr,
__NR_getxattr,
#ifdef __NR_getxattrat
__NR_getxattrat,
#endif
__NR_lgetxattr,
__NR_fgetxattr,
#ifdef __NR_readlinkat

14
include/linux/audit.h
View file

@ -128,12 +128,6 @@ enum audit_nfcfgop {
extern int __init audit_register_class(int class, unsigned *list);
extern int audit_classify_syscall(int abi, unsigned syscall);
extern int audit_classify_arch(int arch);
/* only for compat system calls */
extern unsigned compat_write_class[];
extern unsigned compat_read_class[];
extern unsigned compat_dir_class[];
extern unsigned compat_chattr_class[];
extern unsigned compat_signal_class[];
/* audit_names->type values */
#define AUDIT_TYPE_UNKNOWN 0 /* we don't know yet */
@ -195,6 +189,8 @@ extern int audit_log_subj_ctx(struct audit_buffer *ab, struct lsm_prop *prop);
extern int audit_log_obj_ctx(struct audit_buffer *ab, struct lsm_prop *prop);
extern int audit_log_task_context(struct audit_buffer *ab);
extern void audit_log_task_info(struct audit_buffer *ab);
extern int audit_log_nf_skb(struct audit_buffer *ab,
const struct sk_buff *skb, u8 nfproto);
extern int audit_update_lsm_rules(void);
@ -272,6 +268,12 @@ static inline int audit_log_task_context(struct audit_buffer *ab)
static inline void audit_log_task_info(struct audit_buffer *ab)
{ }
static inline int audit_log_nf_skb(struct audit_buffer *ab,
const struct sk_buff *skb, u8 nfproto)
{
return 0;
}
static inline kuid_t audit_get_loginuid(struct task_struct *tsk)
{
return INVALID_UID;

7
include/linux/audit_arch.h
View file

@ -23,4 +23,11 @@ enum auditsc_class_t {
extern int audit_classify_compat_syscall(int abi, unsigned syscall);
/* only for compat system calls */
extern unsigned compat_write_class[];
extern unsigned compat_read_class[];
extern unsigned compat_dir_class[];
extern unsigned compat_chattr_class[];
extern unsigned compat_signal_class[];
#endif

159
kernel/audit.c
View file

@ -58,6 +58,9 @@
#include <linux/freezer.h>
#include <linux/pid_namespace.h>
#include <net/netns/generic.h>
#include <net/ip.h>
#include <net/ipv6.h>
#include <linux/sctp.h>
#include "audit.h"
@ -2488,6 +2491,162 @@ void audit_log_path_denied(int type, const char *operation)
audit_log_end(ab);
}
int audit_log_nf_skb(struct audit_buffer *ab,
const struct sk_buff *skb, u8 nfproto)
{
/* find the IP protocol in the case of NFPROTO_BRIDGE */
if (nfproto == NFPROTO_BRIDGE) {
switch (eth_hdr(skb)->h_proto) {
case htons(ETH_P_IP):
nfproto = NFPROTO_IPV4;
break;
case htons(ETH_P_IPV6):
nfproto = NFPROTO_IPV6;
break;
default:
goto unknown_proto;
}
}
switch (nfproto) {
case NFPROTO_IPV4: {
struct iphdr iph;
const struct iphdr *ih;
ih = skb_header_pointer(skb, skb_network_offset(skb),
sizeof(iph), &iph);
if (!ih)
return -ENOMEM;
switch (ih->protocol) {
case IPPROTO_TCP: {
struct tcphdr _tcph;
const struct tcphdr *th;
th = skb_header_pointer(skb, skb_transport_offset(skb),
sizeof(_tcph), &_tcph);
if (!th)
return -ENOMEM;
audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu sport=%hu dport=%hu",
&ih->saddr, &ih->daddr, ih->protocol,
ntohs(th->source), ntohs(th->dest));
break;
}
case IPPROTO_UDP:
case IPPROTO_UDPLITE: {
struct udphdr _udph;
const struct udphdr *uh;
uh = skb_header_pointer(skb, skb_transport_offset(skb),
sizeof(_udph), &_udph);
if (!uh)
return -ENOMEM;
audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu sport=%hu dport=%hu",
&ih->saddr, &ih->daddr, ih->protocol,
ntohs(uh->source), ntohs(uh->dest));
break;
}
case IPPROTO_SCTP: {
struct sctphdr _sctph;
const struct sctphdr *sh;
sh = skb_header_pointer(skb, skb_transport_offset(skb),
sizeof(_sctph), &_sctph);
if (!sh)
return -ENOMEM;
audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu sport=%hu dport=%hu",
&ih->saddr, &ih->daddr, ih->protocol,
ntohs(sh->source), ntohs(sh->dest));
break;
}
default:
audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu",
&ih->saddr, &ih->daddr, ih->protocol);
}
break;
}
case NFPROTO_IPV6: {
struct ipv6hdr iph;
const struct ipv6hdr *ih;
u8 nexthdr;
__be16 frag_off;
ih = skb_header_pointer(skb, skb_network_offset(skb),
sizeof(iph), &iph);
if (!ih)
return -ENOMEM;
nexthdr = ih->nexthdr;
ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(iph),
&nexthdr, &frag_off);
switch (nexthdr) {
case IPPROTO_TCP: {
struct tcphdr _tcph;
const struct tcphdr *th;
th = skb_header_pointer(skb, skb_transport_offset(skb),
sizeof(_tcph), &_tcph);
if (!th)
return -ENOMEM;
audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu sport=%hu dport=%hu",
&ih->saddr, &ih->daddr, nexthdr,
ntohs(th->source), ntohs(th->dest));
break;
}
case IPPROTO_UDP:
case IPPROTO_UDPLITE: {
struct udphdr _udph;
const struct udphdr *uh;
uh = skb_header_pointer(skb, skb_transport_offset(skb),
sizeof(_udph), &_udph);
if (!uh)
return -ENOMEM;
audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu sport=%hu dport=%hu",
&ih->saddr, &ih->daddr, nexthdr,
ntohs(uh->source), ntohs(uh->dest));
break;
}
case IPPROTO_SCTP: {
struct sctphdr _sctph;
const struct sctphdr *sh;
sh = skb_header_pointer(skb, skb_transport_offset(skb),
sizeof(_sctph), &_sctph);
if (!sh)
return -ENOMEM;
audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu sport=%hu dport=%hu",
&ih->saddr, &ih->daddr, nexthdr,
ntohs(sh->source), ntohs(sh->dest));
break;
}
default:
audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu",
&ih->saddr, &ih->daddr, nexthdr);
}
break;
}
default:
goto unknown_proto;
}
return 0;
unknown_proto:
audit_log_format(ab, " saddr=? daddr=? proto=?");
return -EPFNOSUPPORT;
}
EXPORT_SYMBOL(audit_log_nf_skb);
/* global counter which is incremented every time something logs in */
static atomic_t session_id = ATOMIC_INIT(0);

58
net/netfilter/nft_log.c
View file

@ -26,46 +26,10 @@ struct nft_log {
char *prefix;
};
static bool audit_ip4(struct audit_buffer *ab, struct sk_buff *skb)
{
struct iphdr _iph;
const struct iphdr *ih;
ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_iph), &_iph);
if (!ih)
return false;
audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu",
&ih->saddr, &ih->daddr, ih->protocol);
return true;
}
static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb)
{
struct ipv6hdr _ip6h;
const struct ipv6hdr *ih;
u8 nexthdr;
__be16 frag_off;
ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_ip6h), &_ip6h);
if (!ih)
return false;
nexthdr = ih->nexthdr;
ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h), &nexthdr, &frag_off);
audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu",
&ih->saddr, &ih->daddr, nexthdr);
return true;
}
static void nft_log_eval_audit(const struct nft_pktinfo *pkt)
{
struct sk_buff *skb = pkt->skb;
struct audit_buffer *ab;
int fam = -1;
if (!audit_enabled)
return;
@ -76,27 +40,7 @@ static void nft_log_eval_audit(const struct nft_pktinfo *pkt)
audit_log_format(ab, "mark=%#x", skb->mark);
switch (nft_pf(pkt)) {
case NFPROTO_BRIDGE:
switch (eth_hdr(skb)->h_proto) {
case htons(ETH_P_IP):
fam = audit_ip4(ab, skb) ? NFPROTO_IPV4 : -1;
break;
case htons(ETH_P_IPV6):
fam = audit_ip6(ab, skb) ? NFPROTO_IPV6 : -1;
break;
}
break;
case NFPROTO_IPV4:
fam = audit_ip4(ab, skb) ? NFPROTO_IPV4 : -1;
break;
case NFPROTO_IPV6:
fam = audit_ip6(ab, skb) ? NFPROTO_IPV6 : -1;
break;
}
if (fam == -1)
audit_log_format(ab, " saddr=? daddr=? proto=-1");
audit_log_nf_skb(ab, skb, nft_pf(pkt));
audit_log_end(ab);
}

58
net/netfilter/xt_AUDIT.c
View file

@ -28,46 +28,10 @@ MODULE_ALIAS("ip6t_AUDIT");
MODULE_ALIAS("ebt_AUDIT");
MODULE_ALIAS("arpt_AUDIT");
static bool audit_ip4(struct audit_buffer *ab, struct sk_buff *skb)
{
struct iphdr _iph;
const struct iphdr *ih;
ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_iph), &_iph);
if (!ih)
return false;
audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu",
&ih->saddr, &ih->daddr, ih->protocol);
return true;
}
static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb)
{
struct ipv6hdr _ip6h;
const struct ipv6hdr *ih;
u8 nexthdr;
__be16 frag_off;
ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_ip6h), &_ip6h);
if (!ih)
return false;
nexthdr = ih->nexthdr;
ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h), &nexthdr, &frag_off);
audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu",
&ih->saddr, &ih->daddr, nexthdr);
return true;
}
static unsigned int
audit_tg(struct sk_buff *skb, const struct xt_action_param *par)
{
struct audit_buffer *ab;
int fam = -1;
if (audit_enabled == AUDIT_OFF)
goto errout;
@ -77,27 +41,7 @@ audit_tg(struct sk_buff *skb, const struct xt_action_param *par)
audit_log_format(ab, "mark=%#x", skb->mark);
switch (xt_family(par)) {
case NFPROTO_BRIDGE:
switch (eth_hdr(skb)->h_proto) {
case htons(ETH_P_IP):
fam = audit_ip4(ab, skb) ? NFPROTO_IPV4 : -1;
break;
case htons(ETH_P_IPV6):
fam = audit_ip6(ab, skb) ? NFPROTO_IPV6 : -1;
break;
}
break;
case NFPROTO_IPV4:
fam = audit_ip4(ab, skb) ? NFPROTO_IPV4 : -1;
break;
case NFPROTO_IPV6:
fam = audit_ip6(ab, skb) ? NFPROTO_IPV6 : -1;
break;
}
if (fam == -1)
audit_log_format(ab, " saddr=? daddr=? proto=-1");
audit_log_nf_skb(ab, skb, xt_family(par));
audit_log_end(ab);