linux-stable.git/kernel/auditfilter.c, branch v4.18.2

audit: use existing session info function

2018-05-18T19:47:54+00:00

Use the existing audit_log_session_info() function rather than
hardcoding its functionality.

Signed-off-by: Richard Guy Briggs 
Signed-off-by: Paul Moore

audit: allow not equal op for audit by executable

2018-04-24T15:18:10+00:00

Current implementation of auditing by executable name only implements
the 'equal' operator. This patch extends it to also support the 'not
equal' operator.

See: https://github.com/linux-audit/audit-kernel/issues/53

Signed-off-by: Ondrej Mosnacek 
Reviewed-by: Richard Guy Briggs 
Signed-off-by: Paul Moore

audit: deprecate the AUDIT_FILTER_ENTRY filter

2018-02-15T19:36:29+00:00

The audit entry filter has been long deprecated with userspace support
finally removed in audit-v2.6.7 and plans to remove kernel support have
existed since kernel-v2.6.31.
Remove it.

Since removing the audit entry filter, test for early return before
setting up any context state.

Passes audit-testsuite.

See: https://github.com/linux-audit/audit-kernel/issues/6

Signed-off-by: Richard Guy Briggs 
Signed-off-by: Paul Moore

audit: session ID should not set arch quick field pointer

2018-02-14T21:34:22+00:00

A bug was introduced in 8fae47705685fcaa75a1fe4c8c3e18300a702979
("audit: add support for session ID user filter")
See: https://github.com/linux-audit/audit-kernel/issues/4

When setting a session ID filter, the session ID filter field overwrote
the quick pointer reference to the arch field, potentially causing the
arch field to be misinterpreted.

Passes audit-testsuite.

Signed-off-by: Richard Guy Briggs 
Signed-off-by: Paul Moore

audit: filter PATH records keyed on filesystem magic

2017-11-10T21:08:56+00:00

Tracefs or debugfs were causing hundreds to thousands of PATH records to
be associated with the init_module and finit_module SYSCALL records on a
few modules when the following rule was in place for startup:
	-a always,exit -F arch=x86_64 -S init_module -F key=mod-load

Provide a method to ignore these large number of PATH records from
overwhelming the logs if they are not of interest.  Introduce a new
filter list "AUDIT_FILTER_FS", with a new field type AUDIT_FSTYPE,
which keys off the filesystem 4-octet hexadecimal magic identifier to
filter specific filesystem PATH records.

An example rule would look like:
	-a never,filesystem -F fstype=0x74726163 -F key=ignore_tracefs
	-a never,filesystem -F fstype=0x64626720 -F key=ignore_debugfs

Arguably the better way to address this issue is to disable tracefs and
debugfs on boot from production systems.

See: https://github.com/linux-audit/audit-kernel/issues/16
See: https://github.com/linux-audit/audit-userspace/issues/8
Test case: https://github.com/linux-audit/audit-testsuite/issues/42

Signed-off-by: Richard Guy Briggs 
[PM: fixed the whitespace damage in kernel/auditsc.c]
Signed-off-by: Paul Moore

audit: kernel generated netlink traffic should have a portid of 0

2017-05-02T14:16:05+00:00

We were setting the portid incorrectly in the netlink message headers,
fix that to always be 0 (nlmsg_pid = 0).

Signed-off-by: Paul Moore 
Reviewed-by: Richard Guy Briggs

audit: remove unnecessary semicolon in audit_field_valid()

2017-05-02T14:16:03+00:00

The excess ; after the closing parenthesis is just code-noise it has no
and can be removed.

Signed-off-by: Nicholas Mc Guire 
[PM: tweak subject line]
Signed-off-by: Paul Moore

audit: add support for session ID user filter

2016-11-29T20:10:12+00:00

Define AUDIT_SESSIONID in the uapi and add support for specifying user
filters based on the session ID.  Also add the new session ID filter
to the feature bitmap so userspace knows it is available.

https://github.com/linux-audit/audit-kernel/issues/4
RFE: add a session ID filter to the kernel's user filter

Signed-off-by: Richard Guy Briggs 
[PM: combine multiple patches from Richard into this one]
Signed-off-by: Paul Moore

audit: fix formatting of AUDIT_CONFIG_CHANGE events

2016-11-20T20:38:00+00:00

The AUDIT_CONFIG_CHANGE events sometimes use a op= field. The current
code logs the value of the field with quotes. This field is documented
to not be encoded, so it should not have quotes.

Signed-off-by: Steve Grubb 
Reviewed-by: Richard Guy Briggs 
[PM: reformatted commit description to make checkpatch.pl happy]
Signed-off-by: Paul Moore

audit: add fields to exclude filter by reusing user filter

2016-06-27T15:01:00+00:00

RFE: add additional fields for use in audit filter exclude rules
https://github.com/linux-audit/audit-kernel/issues/5

Re-factor and combine audit_filter_type() with audit_filter_user() to
use audit_filter_user_rules() to enable the exclude filter to
additionally filter on PID, UID, GID, AUID, LOGINUID_SET, SUBJ_*.

The process of combining the similar audit_filter_user() and
audit_filter_type() functions, required inverting the meaning and
including the ALWAYS action of the latter.

Include audit_filter_user_rules() into audit_filter(), removing
unneeded logic in the process.

Keep the check to quit early if the list is empty.

Signed-off-by: Richard Guy Briggs 
[PM: checkpatch.pl fixes - whitespace damage, wrapped description]
Signed-off-by: Paul Moore