lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CAHC9VhQGAVejYvkvDQ_-egvMYn7VvY9WtdCZvANhmkDswBL8YA@mail.gmail.com>
Date:   Tue, 1 Oct 2019 01:37:59 -0400
From:   Paul Moore <paul@...l-moore.com>
To:     Kees Cook <keescook@...omium.org>
Cc:     linux-kernel@...r.kernel.org,
        Jérémie Galarneau 
        <jeremie.galarneau@...icios.com>, s.mesoraca16@...il.com,
        viro@...iv.linux.org.uk, dan.carpenter@...cle.com,
        akpm@...ux-foundation.org,
        Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
        kernel-hardening@...ts.openwall.com, linux-audit@...hat.com,
        Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: [PATCH] audit: Report suspicious O_CREAT usage

On Wed, Sep 25, 2019 at 5:02 PM Kees Cook <keescook@...omium.org> wrote:
>
> This renames the very specific audit_log_link_denied() to
> audit_log_path_denied() and adds the AUDIT_* type as an argument. This
> allows for the creation of the new AUDIT_ANOM_CREAT that can be used to
> report the fifo/regular file creation restrictions that were introduced
> in commit 30aba6656f61 ("namei: allow restricted O_CREAT of FIFOs and
> regular files"). Without this change, discovering that the restriction
> is enabled can be very challenging:
> https://lore.kernel.org/lkml/CA+jJMxvkqjXHy3DnV5MVhFTL2RUhg0WQ-XVFW3ngDQOdkFq0PA@mail.gmail.com
>
> Reported-by: Jérémie Galarneau <jeremie.galarneau@...icios.com>
> Signed-off-by: Kees Cook <keescook@...omium.org>
> ---
> This is not a complete fix because reporting was broken in commit
> 15564ff0a16e ("audit: make ANOM_LINK obey audit_enabled and
> audit_dummy_context")
> which specifically goes against the intention of these records: they
> should _always_ be reported. If auditing isn't enabled, they should be
> ratelimited.
>
> Instead of using audit, should this just go back to using
> pr_ratelimited()?
> ---
>  fs/namei.c                 |  7 +++++--
>  include/linux/audit.h      |  5 +++--
>  include/uapi/linux/audit.h |  1 +
>  kernel/audit.c             | 11 ++++++-----
>  4 files changed, 15 insertions(+), 9 deletions(-)

...

> diff --git a/fs/namei.c b/fs/namei.c
> index 671c3c1a3425..0e60f81e1d5a 100644
> --- a/fs/namei.c
> +++ b/fs/namei.c
> @@ -1031,6 +1031,9 @@ static int may_create_in_sticky(struct dentry * const dir,
>             (dir->d_inode->i_mode & 0020 &&
>              ((sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) ||
>               (sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode))))) {
> +               audit_log_path_denied(AUDIT_ANOM_CREAT,
> +                                     S_ISFIFO(inode->i_mode) ? "fifo"
> +                                                             : "regular");
>                 return -EACCES;

Other callers typically pass an operation value more closely tied to
the syscall/function name, and that somewhat makes sense since the
syscall/function name is often verb-ish.  The code above, while
helpful in the sense that it distinguishes between types of inodes, it
doesn't give much indication about the "operation" which failed.  I'm
open to suggestions, but something like "sticky_create_fifo" seems
more consistent which current usage.  Thoughts?

> diff --git a/include/linux/audit.h b/include/linux/audit.h
> index aee3dc9eb378..b3715e2ee1c5 100644
> --- a/include/linux/audit.h
> +++ b/include/linux/audit.h
> @@ -217,7 +218,7 @@ static inline void audit_log_d_path(struct audit_buffer *ab,
>  { }
>  static inline void audit_log_key(struct audit_buffer *ab, char *key)
>  { }
> -static inline void audit_log_link_denied(const char *string)
> +static inline void audit_log_path_denied(int type, const char *string);
>  { }

I probably wouldn't make you respin just for this, but since you may
need to respin this anyway, you might as well fix the above.

-- 
paul moore
www.paul-moore.com

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ