linux-kernel - [PATCH ALT3] audit: hide PATH records of anonymous parents and their children

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 28 Feb 2017 22:26:00 -0500
From:   Richard Guy Briggs <rgb@...hat.com>
To:     linux-kernel@...r.kernel.org, linux-audit@...hat.com
Cc:     Richard Guy Briggs <rgb@...hat.com>,
        Steven Rostedt <rostedt@...dmis.org>,
        Ingo Molnar <mingo@...hat.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Al Viro <viro@...iv.linux.org.uk>,
        Eric Paris <eparis@...hat.com>, Paul Moore <pmoore@...hat.com>,
        Steve Grubb <sgrubb@...hat.com>
Subject: [PATCH ALT3] audit: hide PATH records of anonymous parents and their children

Tracefs or debugfs were causing hundreds to thousands of null PATH records to
be associated with the init_module and finit_module SYSCALL records on a few
modules when the following rule was in place for startup:
        -a always,exit -F arch=x86_64 -S init_module -F key=mod-load

This patch hides those records, but the SYSCALL record "items=" count will
still reflect the number of hidden items.  (This will fail the test below.)

See https://github.com/linux-audit/audit-kernel/issues/8
Test case: https://github.com/linux-audit/audit-testsuite/issues/42

Signed-off-by: Richard Guy Briggs <rgb@...hat.com>
---
 kernel/auditsc.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 4db32e8..58ea64e 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1914,6 +1914,7 @@ void __audit_inode_child(struct inode *parent,
 		if (!n)
 			return;
 		audit_copy_inode(n, NULL, parent);
+		n->hidden = true;
 	}
 
 	if (!found_child) {
@@ -1928,6 +1929,8 @@ void __audit_inode_child(struct inode *parent,
 			found_child->name = found_parent->name;
 			found_child->name_len = AUDIT_NAME_FULL;
 			found_child->name->refcnt++;
+		} else {
+			found_child->hidden = true;
 		}
 	}
 
-- 
1.7.1