linux-kernel - [PATCH] capabilities: do not audit log BPRM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Thu,  2 Mar 2017 20:10:29 -0500
From:   Richard Guy Briggs <rgb@...hat.com>
To:     linux-security-module@...r.kernel.org, linux-audit@...hat.com
Cc:     Richard Guy Briggs <rgb@...hat.com>,
        Andy Lutomirski <luto@...nel.org>,
        "Serge E. Hallyn" <serge.hallyn@...ntu.com>,
        Kees Cook <keescook@...omium.org>,
        James Morris <james.l.morris@...cle.com>,
        Eric Paris <eparis@...hat.com>, Paul Moore <pmoore@...hat.com>,
        Steve Grubb <sgrubb@...hat.com>
Subject: [PATCH] capabilities: do not audit log BPRM_FCAPS on set*id

The audit subsystem is adding a BPRM_FCAPS record when auditing setuid
application execution (SYSCALL execve). This is not expected as it was
supposed to be limited to when the file system actually had capabilities
in an extended attribute.  It lists all capabilities making the event
really ugly to parse what is happening.  The PATH record correctly
records the setuid bit and owner.  Suppress the BPRM_FCAPS record on
set*id.

See: https://github.com/linux-audit/audit-kernel/issues/16

Signed-off-by: Richard Guy Briggs <rgb@...hat.com>
---
 security/commoncap.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/security/commoncap.c b/security/commoncap.c
index 14540bd..8f6bedf 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -594,16 +594,17 @@ skip:
 	/*
 	 * Audit candidate if current->cap_effective is set
 	 *
-	 * We do not bother to audit if 3 things are true:
+	 * We do not bother to audit if 4 things are true:
 	 *   1) cap_effective has all caps
 	 *   2) we are root
 	 *   3) root is supposed to have all caps (SECURE_NOROOT)
+	 *   4) we are running a set*id binary
 	 * Since this is just a normal root execing a process.
 	 *
 	 * Number 1 above might fail if you don't have a full bset, but I think
 	 * that is interesting information to audit.
 	 */
-	if (!cap_issubset(new->cap_effective, new->cap_ambient)) {
+	if (!is_setid && !cap_issubset(new->cap_effective, new->cap_ambient)) {
 		if (!cap_issubset(CAP_FULL_SET, new->cap_effective) ||
 		    !uid_eq(new->euid, root_uid) || !uid_eq(new->uid, root_uid) ||
 		    issecure(SECURE_NOROOT)) {
-- 
1.7.1