linux-kernel - Re: [PATCH V3 0/3] Add support for session ID user filtering

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1817842.78IB8nV8t8@sifl>
Date:   Thu, 20 Oct 2016 15:27:36 -0400
From:   Paul Moore <pmoore@...hat.com>
To:     Richard Guy Briggs <rgb@...hat.com>
Cc:     linux-audit@...hat.com, linux-kernel@...r.kernel.org,
        sgrubb@...hat.com, eparis@...hat.com
Subject: Re: [PATCH V3 0/3] Add support for session ID user filtering

On Thursday, August 18, 2016 01:43:12 PM Richard Guy Briggs wrote:
> https://github.com/linux-audit/audit-kernel/wiki/RFE-Session-ID-User-Filter
> RFE Session ID User Filter
> 
> https://github.com/linux-audit/audit-kernel/issues/4
> RFE: add a session ID filter to the kernel's user filter
> 
> See also the set of userspace suport patches:
> 	Add support for sessionid user filters, sessionid_set and loginuid_set
> 	https://www.redhat.com/archives/linux-audit/2016-August/msg00005.html
> 	(userspace update expected to be posted 2016-08-18)
> and the test case:
> 	https://github.com/rgbriggs/audit-testsuite/tree/ghak4-test-for-sessionID-u
> ser-filter
> 
> This third patch is expected to have a merge conflict with:
> 	"audit: add exclude filter extension to feature bitmap"
> posted on 2016-08-18.
> 
> Richard Guy Briggs (3):
>   audit: add support for session ID user filter
>   audit: add AUDIT_SESSIONID_SET support
>   audit: add sessionid filter extension to feature bitmap
> 
>  include/linux/audit.h      |   10 ++++++++++
>  include/uapi/linux/audit.h |    6 +++++-
>  kernel/auditfilter.c       |    5 +++++
>  kernel/auditsc.c           |    6 ++++++
>  4 files changed, 26 insertions(+), 1 deletions(-)

In light of our current decision to drop the session ID "set" filter, I'm 
taking another look at these patches and Richard's comment to simply drop 
patch 2/3 and apply 1/3 and 3/3.

Richard, as I mentioned earlier, perhaps not clearly enough, I think we should 
put a check in audit_set_loginuid() to skip the (int)-1 value from appearing 
in session_id during normal operation.  In other words, roll/reset the value 
in session_id one value early so we don't run into problems with the (int)-1 
unset sentinel value.

-- 
paul moore
security @ redhat