search

linux-audit / audit-kernel

GitHub mirror of the Linux Kernel's audit repository
https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git
Other
137 stars 36 forks source link

BUG: accompanying records missing for requried records when no rules present #120

Closed rgbriggs closed 3 years ago

rgbriggs commented 4 years ago

When there are no audit rules registered, mandatory records (config, etc.) are missing their accompanying records (syscall, proctitle, etc.).

This is due to audit context dummy set on syscall entry based on absence of rules that signals that no other records are to be printed.

rgbriggs commented 4 years ago

Post v1.0 https://www.redhat.com/archives/linux-audit/2020-February/msg00061.html https://lkml.org/lkml/2020/2/18/1087

rgbriggs commented 4 years ago

post v2: https://www.redhat.com/archives/linux-audit/2020-March/msg00026.html https://lkml.org/lkml/2020/3/10/970

rgbriggs commented 4 years ago

Upstreamed 2020-03-12 for 5.6-rc1 1320a4052ea1

rgbriggs commented 4 years ago

NULL pointer dereference reported by bauen1:

Reproducer:

Mitigated by: ghak96 commit d7481b24b816 ("audit: issue CWD record to accompany LSM_AUDITDATA* records")

Code audit still needed to check all other records generated from audit_log_exit().

rgbriggs commented 4 years ago

Post v3fix: https://www.redhat.com/archives/linux-audit/2020-July/msg00132.html https://lkml.org/lkml/2020/7/27/1692

rgbriggs commented 4 years ago

v2 reverted from audit/stable-5.8 and audit-pr-20200729 https://www.redhat.com/archives/linux-audit/2020-July/msg00144.html 8ac68dc455d9 revert: 1320a4052ea1 ("audit: trigger accompanying records when no rules present") https://www.redhat.com/archives/linux-audit/2020-July/msg00170.html

rgbriggs commented 3 years ago

post v4: https://www.redhat.com/archives/linux-audit/2020-September/msg00041.html
https://patchwork.kernel.org/patch/11768033

rgbriggs commented 3 years ago

post v5: https://www.redhat.com/archives/linux-audit/2020-September/msg00052.html
https://lkml.org/lkml/2020/9/22/481 https://patchwork.kernel.org/patch/11792463/

rgbriggs commented 3 years ago

v5.7-rc1 1320a4052ea1 audit: trigger accompanying records when no rules present v5.9-rc1 d7481b24b816 audit: issue CWD record to accompany LSM_AUDITDATA* records v5.8 8ac68dc455d9 revert: 1320a4052ea1 ("audit: trigger accompanying records when no rules present") audit/next 6d915476e67d audit: trigger accompanying records when no rules present

rgbriggs commented 3 years ago

On 2020-12-16 18:28, Paul Moore wrote:

Reopened #120.

I was going to say... It isn't in Linus' tree yet, which is why I didn't ask to have it closed yet. :-)

pcmoore commented 3 years ago

Yes, I was on a bit of a roll closing out issues and this was a case of my finger clicking on the "Close" button while my mind was still reading the last update :)

rgbriggs commented 3 years ago

In v5.11-rc1 2020-12-27, in v5.11 2021-02-14