netdev - [PATCH] drivers: connector: cn_proc: allow limiting certain messages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20200212192901.6402-1-danielwa@cisco.com>
Date:   Wed, 12 Feb 2020 11:29:01 -0800
From:   Daniel Walker <danielwa@...co.com>
To:     Evgeniy Polyakov <zbr@...emap.net>
Cc:     netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH] drivers: connector: cn_proc: allow limiting certain messages

This adds a way for system administrators to limit which messages can be
seen on the interface. Currently cn_proc is rather noisy, and it sends a
lot of different messages which may not be needed.

At Cisco we need to receive the coredump messages, and no others. This
interface currently has no way to allow this. This patch provides a set
of bool module parameters to enable or disable each message type. The
parameters end up looking like this,

$ ls -al /sys/module/cn_proc/parameters/
total 0
drwxr-xr-x 2 root root    0 Feb 10 16:51 .
drwxr-xr-x 3 root root    0 Feb 10 16:50 ..
-rw-r--r-- 1 root root 4096 Feb 10 16:51 enabled_comm
-rw-r--r-- 1 root root 4096 Feb 10 16:51 enabled_coredump
-rw-r--r-- 1 root root 4096 Feb 10 16:51 enabled_exec
-rw-r--r-- 1 root root 4096 Feb 10 16:51 enabled_exit
-rw-r--r-- 1 root root 4096 Feb 10 16:51 enabled_fork
-rw-r--r-- 1 root root 4096 Feb 10 16:51 enabled_gid
-rw-r--r-- 1 root root 4096 Feb 10 16:51 enabled_none
-rw-r--r-- 1 root root 4096 Feb 10 16:51 enabled_ptrace
-rw-r--r-- 1 root root 4096 Feb 10 16:51 enabled_sid
-rw-r--r-- 1 root root 4096 Feb 10 16:51 enabled_uid

All messages are enabled by default. To disable one you can run the following,

echo N > /sys/module/cn_proc/parameters/enabled_comm

Signed-off-by: Daniel Walker <danielwa@...co.com>
---
 drivers/connector/cn_proc.c | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
index d58ce664da84..23b934ee9862 100644
--- a/drivers/connector/cn_proc.c
+++ b/drivers/connector/cn_proc.c
@@ -38,6 +38,22 @@ static inline struct cn_msg *buffer_to_cn_msg(__u8 *buffer)
 static atomic_t proc_event_num_listeners = ATOMIC_INIT(0);
 static struct cb_id cn_proc_event_id = { CN_IDX_PROC, CN_VAL_PROC };
 
+#define CN_PROC_MSG_PARAM(name) \
+	static bool enabled_##name = true; \
+	module_param(enabled_##name, bool, 0644); \
+	MODULE_PARM_DESC(enabled_##name, "Enable message #name");
+
+CN_PROC_MSG_PARAM(none)
+CN_PROC_MSG_PARAM(fork)
+CN_PROC_MSG_PARAM(exec)
+CN_PROC_MSG_PARAM(uid)
+CN_PROC_MSG_PARAM(gid)
+CN_PROC_MSG_PARAM(sid)
+CN_PROC_MSG_PARAM(ptrace)
+CN_PROC_MSG_PARAM(comm)
+CN_PROC_MSG_PARAM(coredump)
+CN_PROC_MSG_PARAM(exit)
+
 /* proc_event_counts is used as the sequence number of the netlink message */
 static DEFINE_PER_CPU(__u32, proc_event_counts) = { 0 };
 
@@ -66,6 +82,8 @@ void proc_fork_connector(struct task_struct *task)
 	__u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
 	struct task_struct *parent;
 
+	if (!enabled_fork)
+		return;
 	if (atomic_read(&proc_event_num_listeners) < 1)
 		return;
 
@@ -95,6 +113,8 @@ void proc_exec_connector(struct task_struct *task)
 	struct proc_event *ev;
 	__u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
 
+	if (!enabled_exec)
+		return;
 	if (atomic_read(&proc_event_num_listeners) < 1)
 		return;
 
@@ -120,6 +140,8 @@ void proc_id_connector(struct task_struct *task, int which_id)
 	__u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
 	const struct cred *cred;
 
+	if (!enabled_uid)
+		return;
 	if (atomic_read(&proc_event_num_listeners) < 1)
 		return;
 
@@ -157,6 +179,8 @@ void proc_sid_connector(struct task_struct *task)
 	struct proc_event *ev;
 	__u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
 
+	if (!enabled_sid)
+		return;
 	if (atomic_read(&proc_event_num_listeners) < 1)
 		return;
 
@@ -181,6 +205,8 @@ void proc_ptrace_connector(struct task_struct *task, int ptrace_id)
 	struct proc_event *ev;
 	__u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
 
+	if (!enabled_ptrace)
+		return;
 	if (atomic_read(&proc_event_num_listeners) < 1)
 		return;
 
@@ -213,6 +239,8 @@ void proc_comm_connector(struct task_struct *task)
 	struct proc_event *ev;
 	__u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
 
+	if (!enabled_comm)
+		return;
 	if (atomic_read(&proc_event_num_listeners) < 1)
 		return;
 
@@ -239,6 +267,8 @@ void proc_coredump_connector(struct task_struct *task)
 	struct task_struct *parent;
 	__u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
 
+	if (!enabled_coredump)
+		return;
 	if (atomic_read(&proc_event_num_listeners) < 1)
 		return;
 
@@ -272,6 +302,8 @@ void proc_exit_connector(struct task_struct *task)
 	struct task_struct *parent;
 	__u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
 
+	if (!enabled_exit)
+		return;
 	if (atomic_read(&proc_event_num_listeners) < 1)
 		return;
 
@@ -314,6 +346,8 @@ static void cn_proc_ack(int err, int rcvd_seq, int rcvd_ack)
 	struct proc_event *ev;
 	__u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
 
+	if (!enabled_none)
+		return;
 	if (atomic_read(&proc_event_num_listeners) < 1)
 		return;
 
-- 
2.17.1