On Thu, Aug 01, 2013 at 12:31:30AM -0700, Tyler Hicks wrote: > This requires libaalogparse to become aware of USER_AVC messages. > > Signed-off-by: Tyler Hicks <[email protected]>
Acked-by: Seth Arnold <[email protected]> > --- > libraries/libapparmor/src/aalogparse.h | 7 +++ > libraries/libapparmor/src/grammar.y | 72 > ++++++++++++++++++++++++++++++- > libraries/libapparmor/src/libaalogparse.c | 12 ++++++ > libraries/libapparmor/src/scanner.l | 42 ++++++++++++++++++ > 4 files changed, 132 insertions(+), 1 deletion(-) > > diff --git a/libraries/libapparmor/src/aalogparse.h > b/libraries/libapparmor/src/aalogparse.h > index 2079669..ceaa4ec 100644 > --- a/libraries/libapparmor/src/aalogparse.h > +++ b/libraries/libapparmor/src/aalogparse.h > @@ -116,6 +116,7 @@ typedef struct > aa_record_syntax_version version; > aa_record_event_type event; /* Event type */ > unsigned long pid; /* PID of the program logging the > message */ > + unsigned long peer_pid; > unsigned long task; > unsigned long magic_token; > long epoch; /* example: 12345679 */ > @@ -129,6 +130,7 @@ typedef struct > unsigned long fsuid; /* fsuid of task - if logged */ > unsigned long ouid; /* ouid of task - if logged */ > char *profile; /* The name of the profile */ > + char *peer_profile; > char *comm; /* Command that triggered msg */ > char *name; > char *name2; > @@ -136,6 +138,7 @@ typedef struct > char *attribute; > unsigned long parent; > char *info; > + char *peer_info; > int error_code; /* error_code returned if logged */ > char *active_hat; > char *net_family; > @@ -145,6 +148,10 @@ typedef struct > unsigned long net_local_port; > char *net_foreign_addr; > unsigned long net_foreign_port; > + char *dbus_bus; > + char *dbus_path; > + char *dbus_interface; > + char *dbus_member; > } aa_log_record; > > /** > diff --git a/libraries/libapparmor/src/grammar.y > b/libraries/libapparmor/src/grammar.y > index 80f659e..a9b1176 100644 > --- a/libraries/libapparmor/src/grammar.y > +++ b/libraries/libapparmor/src/grammar.y > @@ -91,6 +91,8 @@ aa_record_event_type lookup_aa_event(unsigned int type) > %token TOK_OPEN_PAREN > %token TOK_CLOSE_PAREN > %token TOK_PERIOD > +%token TOK_QUESTION_MARK > +%token TOK_SINGLE_QUOTE > > %token TOK_TYPE_REJECT > %token TOK_TYPE_AUDIT > @@ -105,6 +107,7 @@ aa_record_event_type lookup_aa_event(unsigned int type) > %token TOK_TYPE_AA_STATUS > %token TOK_TYPE_AA_ERROR > %token TOK_TYPE_LSM_AVC > +%token TOK_TYPE_USER_AVC > > %token TOK_KEY_APPARMOR > %token TOK_KEY_TYPE > @@ -112,6 +115,7 @@ aa_record_event_type lookup_aa_event(unsigned int type) > %token TOK_KEY_OPERATION > %token TOK_KEY_NAME > %token TOK_KEY_NAME2 > +%token TOK_KEY_MASK > %token TOK_KEY_DENIED_MASK > %token TOK_KEY_REQUESTED_MASK > %token TOK_KEY_ATTRIBUTE > @@ -119,8 +123,11 @@ aa_record_event_type lookup_aa_event(unsigned int type) > %token TOK_KEY_PARENT > %token TOK_KEY_MAGIC_TOKEN > %token TOK_KEY_INFO > +%token TOK_KEY_PEER_INFO > %token TOK_KEY_PID > +%token TOK_KEY_PEER_PID > %token TOK_KEY_PROFILE > +%token TOK_KEY_PEER_PROFILE > %token TOK_AUDIT > %token TOK_KEY_FAMILY > %token TOK_KEY_SOCK_TYPE > @@ -129,6 +136,14 @@ aa_record_event_type lookup_aa_event(unsigned int type) > %token TOK_KEY_ERROR > %token TOK_KEY_FSUID > %token TOK_KEY_OUID > +%token TOK_KEY_UID > +%token TOK_KEY_AUID > +%token TOK_KEY_SAUID > +%token TOK_KEY_SES > +%token TOK_KEY_HOSTNAME > +%token TOK_KEY_ADDR > +%token TOK_KEY_TERMINAL > +%token TOK_KEY_EXE > %token TOK_KEY_COMM > %token TOK_KEY_CAPABILITY > %token TOK_KEY_CAPNAME > @@ -138,8 +153,13 @@ aa_record_event_type lookup_aa_event(unsigned int type) > %token TOK_KEY_FADDR > %token TOK_KEY_LPORT > %token TOK_KEY_FPORT > +%token TOK_KEY_BUS > +%token TOK_KEY_PATH > +%token TOK_KEY_INTERFACE > +%token TOK_KEY_MEMBER > > %token TOK_SYSLOG_KERNEL > +%token TOK_SYSLOG_USER > > %% > > @@ -163,6 +183,7 @@ new_syntax: > | TOK_TYPE_AA_ERROR audit_msg key_list { ret_record->event = > AA_RECORD_ERROR; } > | TOK_TYPE_UNKNOWN audit_msg key_list { ret_record->event = > lookup_aa_event($1); } > | TOK_TYPE_LSM_AVC audit_msg key_list > + | TOK_TYPE_USER_AVC audit_user_msg TOK_SINGLE_QUOTE key_list > TOK_SINGLE_QUOTE > ; > > other_audit: TOK_TYPE_OTHER audit_msg TOK_MSG_REST > @@ -182,6 +203,8 @@ syslog_type: > { ret_record->version = AA_RECORD_SYNTAX_V2; } > | syslog_date TOK_ID TOK_SYSLOG_KERNEL TOK_DMESG_STAMP key_type > audit_id key_list > { ret_record->version = AA_RECORD_SYNTAX_V2; } > + | syslog_date TOK_ID TOK_SYSLOG_USER key_list > + { ret_record->version = AA_RECORD_SYNTAX_V2; } > ; > > /* when audit dispatches a message it doesn't prepend the audit type string > */ > @@ -192,6 +215,9 @@ audit_dispatch: > audit_msg: TOK_KEY_MSG TOK_EQUALS audit_id > ; > > +audit_user_msg: TOK_KEY_MSG TOK_EQUALS audit_id ignored_pid ignored_uid > ignored_auid ignored_ses TOK_KEY_MSG TOK_EQUALS > + ; > + > audit_id: TOK_AUDIT TOK_OPEN_PAREN TOK_AUDIT_DIGITS TOK_PERIOD > TOK_AUDIT_DIGITS TOK_COLON TOK_AUDIT_DIGITS TOK_CLOSE_PAREN TOK_COLON > { > if (!asprintf(&ret_record->audit_id, "%s.%s:%s", $3, $5, $7)) > @@ -219,6 +245,8 @@ key: TOK_KEY_OPERATION TOK_EQUALS TOK_QUOTED_STRING > { ret_record->namespace = $3;} > | TOK_KEY_NAME2 TOK_EQUALS safe_string > { ret_record->name2 = $3;} > + | TOK_KEY_MASK TOK_EQUALS TOK_QUOTED_STRING > + { ret_record->denied_mask = $3;} > | TOK_KEY_DENIED_MASK TOK_EQUALS TOK_QUOTED_STRING > { ret_record->denied_mask = $3;} > | TOK_KEY_REQUESTED_MASK TOK_EQUALS TOK_QUOTED_STRING > @@ -233,9 +261,14 @@ key: TOK_KEY_OPERATION TOK_EQUALS TOK_QUOTED_STRING > { ret_record->magic_token = $3;} > | TOK_KEY_INFO TOK_EQUALS TOK_QUOTED_STRING > { ret_record->info = $3;} > + | TOK_KEY_PEER_INFO TOK_EQUALS TOK_QUOTED_STRING > + { ret_record->peer_info = $3;} > | key_pid > + | key_peer_pid > | TOK_KEY_PROFILE TOK_EQUALS safe_string > { ret_record->profile = $3;} > + | TOK_KEY_PEER_PROFILE TOK_EQUALS safe_string > + { ret_record->peer_profile = $3;} > | TOK_KEY_FAMILY TOK_EQUALS TOK_QUOTED_STRING > { ret_record->net_family = $3;} > | TOK_KEY_SOCK_TYPE TOK_EQUALS TOK_QUOTED_STRING > @@ -252,8 +285,29 @@ key: TOK_KEY_OPERATION TOK_EQUALS TOK_QUOTED_STRING > { ret_record->fsuid = $3;} > | TOK_KEY_OUID TOK_EQUALS TOK_DIGITS > { ret_record->ouid = $3;} > + | TOK_KEY_SAUID TOK_EQUALS TOK_DIGITS > + { /* Ignore - Source audit ID from user AVC messages */ } > + | TOK_KEY_HOSTNAME TOK_EQUALS safe_string > + { free($3); /* Ignore - hostname from user AVC messages */ } > + | TOK_KEY_HOSTNAME TOK_EQUALS TOK_QUESTION_MARK > + | TOK_KEY_ADDR TOK_EQUALS TOK_QUESTION_MARK > + | TOK_KEY_TERMINAL TOK_EQUALS TOK_QUESTION_MARK > + | TOK_KEY_ADDR TOK_EQUALS safe_string > + { free($3); /* Ignore - IP address from user AVC messages */ } > + | TOK_KEY_TERMINAL TOK_EQUALS safe_string > + { free($3); /* Ignore - TTY from user AVC messages */ } > + | TOK_KEY_EXE TOK_EQUALS safe_string > + { /* Free existing arrays because exe= and comm= maps to the same > + aa_log_record member */ > + free(ret_record->comm); > + ret_record->comm = $3; > + } > | TOK_KEY_COMM TOK_EQUALS safe_string > - { ret_record->comm = $3;} > + { /* Free existing arrays because exe= and comm= maps to the same > + aa_log_record member */ > + free(ret_record->comm); > + ret_record->comm = $3; > + } > | TOK_KEY_APPARMOR TOK_EQUALS apparmor_event > | TOK_KEY_CAPABILITY TOK_EQUALS TOK_DIGITS > { /* need to reverse map number to string, need to figure out > @@ -282,6 +336,14 @@ key: TOK_KEY_OPERATION TOK_EQUALS TOK_QUOTED_STRING > { ret_record->net_local_port = $3;} > | TOK_KEY_FPORT TOK_EQUALS TOK_DIGITS > { ret_record->net_foreign_port = $3;} > + | TOK_KEY_BUS TOK_EQUALS TOK_QUOTED_STRING > + { ret_record->dbus_bus = $3; } > + | TOK_KEY_PATH TOK_EQUALS TOK_QUOTED_STRING > + { ret_record->dbus_path = $3; } > + | TOK_KEY_INTERFACE TOK_EQUALS TOK_QUOTED_STRING > + { ret_record->dbus_interface = $3; } > + | TOK_KEY_MEMBER TOK_EQUALS TOK_QUOTED_STRING > + { ret_record->dbus_member = $3; } > | TOK_MSG_REST > { > ret_record->event = AA_RECORD_INVALID; > @@ -301,6 +363,14 @@ apparmor_event: > key_pid: TOK_KEY_PID TOK_EQUALS TOK_DIGITS { ret_record->pid = $3; } > ; > > +key_peer_pid: TOK_KEY_PEER_PID TOK_EQUALS TOK_DIGITS { ret_record->peer_pid > = $3; } > + ; > + > +ignored_pid: TOK_KEY_PID TOK_EQUALS TOK_DIGITS { /* DROP */ } > +ignored_uid: TOK_KEY_UID TOK_EQUALS TOK_DIGITS { /* DROP */ } > +ignored_auid: TOK_KEY_AUID TOK_EQUALS TOK_DIGITS { /* DROP */ } > +ignored_ses: TOK_KEY_SES TOK_EQUALS TOK_DIGITS { /* DROP */ } > + > key_type: TOK_KEY_TYPE TOK_EQUALS TOK_DIGITS { ret_record->event = > lookup_aa_event($3); } > ; > > diff --git a/libraries/libapparmor/src/libaalogparse.c > b/libraries/libapparmor/src/libaalogparse.c > index 5292830..f0b13bb 100644 > --- a/libraries/libapparmor/src/libaalogparse.c > +++ b/libraries/libapparmor/src/libaalogparse.c > @@ -55,6 +55,8 @@ void free_record(aa_log_record *record) > free(record->denied_mask); > if (record->profile != NULL) > free(record->profile); > + if (record->peer_profile != NULL) > + free(record->peer_profile); > if (record->comm != NULL) > free(record->comm); > if (record->name != NULL) > @@ -67,6 +69,8 @@ void free_record(aa_log_record *record) > free(record->attribute); > if (record->info != NULL) > free(record->info); > + if (record->peer_info != NULL) > + free(record->peer_info); > if (record->active_hat != NULL) > free(record->active_hat); > if (record->audit_id != NULL) > @@ -77,6 +81,14 @@ void free_record(aa_log_record *record) > free(record->net_protocol); > if (record->net_sock_type != NULL) > free(record->net_sock_type); > + if (record->dbus_bus != NULL) > + free(record->dbus_bus); > + if (record->dbus_path != NULL) > + free(record->dbus_path); > + if (record->dbus_interface != NULL) > + free(record->dbus_interface); > + if (record->dbus_member != NULL) > + free(record->dbus_member); > > free(record); > } > diff --git a/libraries/libapparmor/src/scanner.l > b/libraries/libapparmor/src/scanner.l > index 0a619a2..2f25b04 100644 > --- a/libraries/libapparmor/src/scanner.l > +++ b/libraries/libapparmor/src/scanner.l > @@ -86,6 +86,8 @@ close_paren ")" > ID [^ \t\n\(\)="'!] > hexstring ({hex}{hex})+ > period "\." > +question_mark "?" > +single_quote "'" > mode_chars > ([RrWwaLlMmkXx])|([Pp][Xx])|([Uu][Xx])|([Ii][Xx])|([Pp][Ii][Xx]) > modes > ({mode_chars}+)|({mode_chars}+::{mode_chars}*)|(::{mode_chars}*) > /* New message types */ > @@ -103,6 +105,7 @@ hint_type "\"HINT\"" > status_type "\"STATUS\"" > error_type "\"ERROR\"" > lsm_avc_type "AVC" > +user_avc_type "USER_AVC" > unknown_type UNKNOWN\[{digits}+\] > other_audit_type [[:alnum:]\[\]_-]+ > > @@ -115,6 +118,7 @@ key_operation "operation" > key_name "name" > key_name2 "name2" > key_namespace "namespace" > +key_mask "mask" > key_denied_mask "denied_mask" > key_requested_mask "requested_mask" > key_attribute "attribute" > @@ -122,14 +126,25 @@ key_task "task" > key_parent "parent" > key_magic_token "magic_token" > key_info "info" > +key_peer_info "peer_info" > key_pid "pid" > +key_peer_pid "peer_pid" > key_profile "profile" > +key_peer_profile "peer_profile" > key_family "family" > key_sock_type "sock_type" > key_protocol "protocol" > key_error "error" > key_fsuid "fsuid" > key_ouid "ouid" > +key_uid "uid" > +key_auid "auid" > +key_sauid "sauid" > +key_ses "ses" > +key_hostname "hostname" > +key_addr "addr" > +key_terminal "terminal" > +key_exe "exe" > key_comm "comm" > key_capability "capability" > key_capname "capname" > @@ -139,6 +154,11 @@ key_laddr "laddr" > key_faddr "faddr" > key_lport "lport" > key_fport "fport" > +key_bus "bus" > +key_dest "dest" > +key_path "path" > +key_interface "interface" > +key_member "member" > audit "audit" > > /* network addrs */ > @@ -146,6 +166,7 @@ ip_addr [a-f[:digit:].:]{3,} > > /* syslog tokens */ > syslog_kernel kernel{colon} > +syslog_user [[:alnum:]_-]+\[[[:digit:]]+\]{colon} > syslog_yyyymmdd {digit}{4}{minus}{digit}{2}{minus}{digit}{2} > syslog_date {syslog_yyyymmdd} > syslog_month > Jan(uary)?|Feb(ruary)?|Mar(ch)?|Apr(il)?|May|Jun(e)?|Jul(y)?|Aug(ust)?|Sep(tember)?|Oct(ober)?|Nov(ember)?|Dec(ember)? > @@ -155,6 +176,7 @@ syslog_time > {hhmmss}({period}{digits})?{timezone}? > syslog_hostname [[:alnum:]_-]+ > dmesg_timestamp \[[[:digit:] ]{5,}\.[[:digit:]]{6,}\] > > +%x single_quoted_string > %x quoted_string > %x sub_id > %x audit_id > @@ -237,6 +259,7 @@ yy_flex_debug = 0; > {aa_status_type} { BEGIN(INITIAL); return(TOK_TYPE_AA_STATUS); } > {aa_error_type} { BEGIN(INITIAL); return(TOK_TYPE_AA_ERROR); } > {lsm_avc_type} { BEGIN(INITIAL); return(TOK_TYPE_LSM_AVC); } > + {user_avc_type} { BEGIN(INITIAL); return(TOK_TYPE_USER_AVC); } > {unknown_type} { char *yptr = yytext; > while (*yptr && *yptr != '[') > yptr++; > @@ -262,6 +285,8 @@ yy_flex_debug = 0; > } > {close_paren} { return(TOK_CLOSE_PAREN); } > {period} { return(TOK_PERIOD); } > +{question_mark} { return(TOK_QUESTION_MARK); } > +{single_quote} { return(TOK_SINGLE_QUOTE); } > > {key_apparmor} { BEGIN(audit_types); return(TOK_KEY_APPARMOR); > } > {key_type} { BEGIN(audit_types); return(TOK_KEY_TYPE); } > @@ -270,6 +295,7 @@ yy_flex_debug = 0; > {key_name} { BEGIN(safe_string); return(TOK_KEY_NAME); } > {key_name2} { BEGIN(safe_string); return(TOK_KEY_NAME2); } > {key_namespace} { BEGIN(safe_string); > return(TOK_KEY_NAMESPACE); } > +{key_mask} { return(TOK_KEY_MASK); } > {key_denied_mask} { return(TOK_KEY_DENIED_MASK); } > {key_requested_mask} { return(TOK_KEY_REQUESTED_MASK); } > {key_attribute} { BEGIN(sub_id); return(TOK_KEY_ATTRIBUTE); } > @@ -277,14 +303,25 @@ yy_flex_debug = 0; > {key_parent} { return(TOK_KEY_PARENT); } > {key_magic_token} { return(TOK_KEY_MAGIC_TOKEN); } > {key_info} { return(TOK_KEY_INFO); } > +{key_peer_info} { return(TOK_KEY_PEER_INFO); } > {key_pid} { return(TOK_KEY_PID); } > +{key_peer_pid} { return(TOK_KEY_PEER_PID); } > {key_profile} { BEGIN(safe_string); return(TOK_KEY_PROFILE); } > +{key_peer_profile} { BEGIN(safe_string); return(TOK_KEY_PEER_PROFILE); } > {key_family} { return(TOK_KEY_FAMILY); } > {key_sock_type} { return(TOK_KEY_SOCK_TYPE); } > {key_protocol} { return(TOK_KEY_PROTOCOL); } > {key_error} { return(TOK_KEY_ERROR); } > {key_fsuid} { return(TOK_KEY_FSUID); } > {key_ouid} { return(TOK_KEY_OUID); } > +{key_uid} { return(TOK_KEY_UID); } > +{key_auid} { return(TOK_KEY_AUID); } > +{key_sauid} { return(TOK_KEY_SAUID); } > +{key_ses} { return(TOK_KEY_SES); } > +{key_hostname} { return(TOK_KEY_HOSTNAME); } > +{key_addr} { return(TOK_KEY_ADDR); } > +{key_terminal} { return(TOK_KEY_TERMINAL); } > +{key_exe} { BEGIN(safe_string); return(TOK_KEY_EXE); } > {key_comm} { BEGIN(safe_string); return(TOK_KEY_COMM); } > {key_capability} { return(TOK_KEY_CAPABILITY); } > {key_capname} { return(TOK_KEY_CAPNAME); } > @@ -294,8 +331,13 @@ yy_flex_debug = 0; > {key_faddr} { yy_push_state(ip_addr, yyscanner); > return(TOK_KEY_FADDR); } > {key_lport} { return(TOK_KEY_LPORT); } > {key_fport} { return(TOK_KEY_FPORT); } > +{key_bus} { return(TOK_KEY_BUS); } > +{key_path} { return(TOK_KEY_PATH); } > +{key_interface} { return(TOK_KEY_INTERFACE); } > +{key_member} { return(TOK_KEY_MEMBER); } > > {syslog_kernel} { BEGIN(dmesg_timestamp); > return(TOK_SYSLOG_KERNEL); } > +{syslog_user} { return(TOK_SYSLOG_USER); } > {syslog_month} { yylval->t_str = strdup(yytext); > return(TOK_DATE_MONTH); } > {syslog_date} { yylval->t_str = strdup(yytext); > return(TOK_DATE); } > {syslog_date}T/{syslog_time} { yylval->t_str = strndup(yytext, > strlen(yytext)-1); return(TOK_DATE); } > -- > 1.8.3.2 > > > -- > AppArmor mailing list > [email protected] > Modify settings or unsubscribe at: > https://lists.ubuntu.com/mailman/listinfo/apparmor >
signature.asc
Description: Digital signature
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
