Re: Hundreds of null PATH records for *init_module syscall audit logs

From	Steve Grubb <sgrubb@redhat.com>
Newsgroups	linux.kernel
Subject	Re: Hundreds of null PATH records for *init_module syscall audit logs
Date	2017-03-01 05:20 +0100
Message-ID	<tg3U6-5UQ-3@gated-at.bofh.it> (permalink)
References	<tg37I-5hT-3@gated-at.bofh.it> <tg3r3-5qI-1@gated-at.bofh.it>
Organization	Red Hat

Show all headers | View raw

On Tuesday, February 28, 2017 10:37:04 PM EST Richard Guy Briggs wrote:
> Sorry, I forgot to include Cc: in this cover letter for context to the 4
> alt patches.
> 
> On 2017-02-28 22:15, Richard Guy Briggs wrote:
> > The background to this is:
> > 	https://github.com/linux-audit/audit-kernel/issues/8
> > 
> > In short, audit SYSCALL records for *init_module were occasionally
> > accompanied by hundreds to thousands of null PATH records.
> > 
> > I chatted with Al Viro and Eric Paris about this Friday afternoon and
> > they seemed to vaguely recall this issue and didn't have any solid
> > recommendations as to what was the right thing to do (other than the
> > same suggestion from both that I won't print here).
> > 
> > It was reproducible on a number of vintages of distributions with
> > default kernels, but triggering on very few of the many modules loaded
> > at boot time.  It was reproduced with fs-nfs4 and nfsv4 modules on
> > tracefs, but there are reports of it also happening with debugfs.  It
> > was triggering only in __audit_inode_child with a parent that was not
> > found in the task context's audit names_list.
> > 
> > I have four potential solutions listed in my order of preference and I'd
> > like to get some feedback about which one would be the most acceptable.

0.5 - Notice that we are in *init_module & delete_module and inhibit 
generation of any record type except SYSCALL and KERN_MODULE ? There are some 
classification routines for -F perms=wrxa that might be used to create a new 
class for loading/deleting modules that sets a flag that we use to suppress 
some record types.

> > 1 - In __audit_inode_child, return immedialy upon detecting TRACEFS and
> > 
> >     DEBUGFS (and potentially other filesystems identified, via s_magic).

XFS creates them too. Who knows what else.

-Steve

> > 2 - In __audit_inode_child, return after not finding the parent in that
> > 
> >     task context's audit names_list.
> > 
> > 3 - In __audit_inode_child, mark the parent and its child as "hidden"
> > 
> >     when the parent isn't found in that task context's audit names_list.
> >     This will still result in an "items=" count that does not match the
> >     number of accompanying PATH records for that SYSCALL record, which
> >     may upset userspace tools but would still indicate suppressed
> >     records.
> > 
> > 4 - In __audit_inode_child, when the parent isn't found, store the
> > 
> >     child's dentry in the child's (new or not) audit_names structure
> >     (properly refcounted with dget) and store the parent's dentry in its
> >     newly created audit_names structure (via dget_parent), then if the
> >     name isn't available at PATH record generation time, use that stored
> >     value (with dentry_path_raw and released with dput)
> >
> > Is there another more elegant solution that I've missed that catches
> > things before they get anywhere near audit_inode_child (called from
> > tracefs' notifiers)?
> > 
> > I'll thread onto this message tested patches for all four solutions.

Thread

Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs <rgb@redhat.com> - 2017-03-01 04:30 +0100
  [PATCH ALT2] audit: don't create PATH records for anonymous parents and their children Richard Guy Briggs <rgb@redhat.com> - 2017-03-01 04:30 +0100
  Re: Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs <rgb@redhat.com> - 2017-03-01 04:50 +0100
    Re: Hundreds of null PATH records for *init_module syscall audit logs Steve Grubb <sgrubb@redhat.com> - 2017-03-01 05:20 +0100
      Re: Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs <rgb@redhat.com> - 2017-03-03 22:30 +0100
        [PATCH ALT5] audit: ignore module syscalls on inode child Richard Guy Briggs <rgb@redhat.com> - 2017-03-03 23:30 +0100
        Re: Hundreds of null PATH records for *init_module syscall audit logs Paul Moore <paul@paul-moore.com> - 2017-03-04 01:30 +0100
          Re: Hundreds of null PATH records for *init_module syscall audit logs Jessica Yu <jeyu@redhat.com> - 2017-03-06 23:40 +0100
            Re: Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs <rgb@redhat.com> - 2017-03-07 04:50 +0100
          Re: Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs <rgb@redhat.com> - 2017-03-07 03:10 +0100
            Re: Hundreds of null PATH records for *init_module syscall audit logs Steve Grubb <sgrubb@redhat.com> - 2017-03-09 14:30 +0100
        Re: Hundreds of null PATH records for *init_module syscall audit logs Steve Grubb <sgrubb@redhat.com> - 2017-03-09 14:30 +0100
    Re: Hundreds of null PATH records for *init_module syscall audit logs Paul Moore <paul@paul-moore.com> - 2017-03-04 01:30 +0100
      Re: Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs <rgb@redhat.com> - 2017-03-07 05:00 +0100
        Re: Hundreds of null PATH records for *init_module syscall audit  logs Steven Rostedt <rostedt@goodmis.org> - 2017-03-07 17:00 +0100
          Re: Hundreds of null PATH records for *init_module syscall audit  logs Steven Rostedt <rostedt@goodmis.org> - 2017-03-07 17:30 +0100
            Re: Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs <rgb@redhat.com> - 2017-03-07 18:50 +0100
              Re: Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs <rgb@redhat.com> - 2017-03-07 19:40 +0100
                Re: Hundreds of null PATH records for *init_module syscall audit  logs Steven Rostedt <rostedt@goodmis.org> - 2017-03-07 20:20 +0100
                Re: Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs <rgb@redhat.com> - 2017-03-07 23:30 +0100
              Re: Hundreds of null PATH records for *init_module syscall audit  logs Steven Rostedt <rostedt@goodmis.org> - 2017-03-07 21:50 +0100
          Re: Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs <rgb@redhat.com> - 2017-03-07 17:30 +0100
            Re: Hundreds of null PATH records for *init_module syscall audit logs Steve Grubb <sgrubb@redhat.com> - 2017-03-09 14:40 +0100
      Re: Hundreds of null PATH records for *init_module syscall audit  logs Steven Rostedt <rostedt@goodmis.org> - 2017-03-07 16:40 +0100
  [PATCH ALT4] audit: show fstype:pathname for entries with anonymous parents Richard Guy Briggs <rgb@redhat.com> - 2017-03-01 08:50 +0100
    Re: [PATCH ALT4] audit: show fstype:pathname for entries with  anonymous parents kbuild test robot <lkp@intel.com> - 2017-03-02 14:10 +0100

csiph-web