On Thu, Jun 4, 2020 at 9:21 AM Richard Guy Briggs <r...@redhat.com> wrote: > > iptables, ip6tables, arptables and ebtables table registration, > replacement and unregistration configuration events are logged for the > native (legacy) iptables setsockopt api, but not for the > nftables netlink api which is used by the nft-variant of iptables in > addition to nftables itself. > > Add calls to log the configuration actions in the nftables netlink api. > > This uses the same NETFILTER_CFG record format but overloads the table > field. > > type=NETFILTER_CFG msg=audit(2020-05-28 17:46:41.878:162) : table=?:0;?:0 > family=unspecified entries=2 op=nft_register_gen pid=396 > subj=system_u:system_r:firewalld_t:s0 comm=firewalld > ... > type=NETFILTER_CFG msg=audit(2020-05-28 17:46:41.878:162) : > table=firewalld:1;?:0 family=inet entries=0 op=nft_register_table pid=396 > subj=system_u:system_r:firewalld_t:s0 comm=firewalld > ... > type=NETFILTER_CFG msg=audit(2020-05-28 17:46:41.911:163) : > table=firewalld:1;filter_FORWARD:85 family=inet entries=8 > op=nft_register_chain pid=396 subj=system_u:system_r:firewalld_t:s0 > comm=firewalld > ... > type=NETFILTER_CFG msg=audit(2020-05-28 17:46:41.911:163) : > table=firewalld:1;filter_FORWARD:85 family=inet entries=101 > op=nft_register_rule pid=396 subj=system_u:system_r:firewalld_t:s0 > comm=firewalld > ... > type=NETFILTER_CFG msg=audit(2020-05-28 17:46:41.911:163) : > table=firewalld:1;__set0:87 family=inet entries=87 op=nft_register_setelem > pid=396 subj=system_u:system_r:firewalld_t:s0 comm=firewalld > ... > type=NETFILTER_CFG msg=audit(2020-05-28 17:46:41.911:163) : > table=firewalld:1;__set0:87 family=inet entries=0 op=nft_register_set pid=396 > subj=system_u:system_r:firewalld_t:s0 comm=firewalld > > For further information please see issue > https://github.com/linux-audit/audit-kernel/issues/124 > > Signed-off-by: Richard Guy Briggs <r...@redhat.com> > --- > Changelog: > v3: > - inline message type rather than table > > v2: > - differentiate between xtables and nftables > - add set, setelem, obj, flowtable, gen > - use nentries field as appropriate per type > - overload the "tables" field with table handle and chain/set/flowtable > > include/linux/audit.h | 18 ++++++++ > kernel/auditsc.c | 24 ++++++++-- > net/netfilter/nf_tables_api.c | 103 > ++++++++++++++++++++++++++++++++++++++++++ > 3 files changed, 142 insertions(+), 3 deletions(-)
I'm not seeing any additional comments from the netfilter folks so I've gone ahead and merged this into audit/next. Thanks Richard. -- paul moore www.paul-moore.com -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit
