From: Deven Bowers
IPE, like SELinux, supports a permissive mode. This mode allows policy
authors to test and evaluate IPE policy without it effecting their
programs. When the mode is changed, a 1404 AUDIT_MAC_STATUS
be reported.
This patch adds the following audit records:
audit: MAC_STATUS permissive=1 auid=4294967295 ses=4294967295 lsm=ipe
res=1
audit: MAC_STATUS permissive=0 auid=4294967295 ses=4294967295 lsm=ipe
res=1
These records are emitted within the following events:
audit: MAC_STATUS permissive=1 auid=4294967295 ses=4294967295 lsm=ipe
res=1
audit[185]: SYSCALL arch=c03e syscall=1 success=yes exit=2 a0=1
a1=56308bb3ecc0 a2=2 a3=7f290fdc53e0 items=0 ppid=183 pid=185
auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=pts0 ses=4294967295 comm="bash" exe="/usr/bin/bash" key=(null)
audit: PROCTITLE proctitle="-bash"
audit: MAC_STATUS permissive=0 auid=4294967295 ses=4294967295 lsm=ipe
res=1
audit[185]: SYSCALL arch=c03e syscall=1 success=yes exit=2 a0=1
a1=56308bb3ecc0 a2=2 a3=7f290fdc53e0 items=0 ppid=183 pid=185
auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=pts0 ses=4294967295 comm="bash" exe="/usr/bin/bash" key=(null)
audit: PROCTITLE proctitle="-bash"
Implying user used bash to toggle the switch.
Signed-off-by: Deven Bowers
Signed-off-by: Fan Wu
---
v2:
+ Split evaluation loop, access control hooks,
and evaluation loop from policy parser and userspace
interface to pass mailing list character limit
v3:
+ Move ipe_load_properties to patch 04.
+ Remove useless 0-initializations
+ Prefix extern variables with ipe_
+ Remove kernel module parameters, as these are
exposed through sysctls.
+ Add more prose to the IPE base config option
help text.
+ Use GFP_KERNEL for audit_log_start.
+ Remove unnecessary caching system.
+ Remove comments from headers
+ Use rcu_access_pointer for rcu-pointer null check
+ Remove usage of reqprot; use prot only.
+ Move policy load and activation audit event to 03/12
v4:
+ Remove sysctls in favor of securityfs nodes
+ Re-add kernel module parameters, as these are now
exposed through securityfs.
+ Refactor property audit loop to a separate function.
v5:
+ fix minor grammatical errors
+ do not group rule by curly-brace in audit record,
reconstruct the exact rule.
v6:
+ No changes
v7:
+ Further split lsm creation into a separate commit from the
evaluation loop and audit system, for easier review.
+ Propogating changes to support the new ipe_context structure in the
evaluation loop.
+ Split out permissive functionality into a separate patch for easier
review.
+ Remove permissive switch compile-time configuration option - this
is trivial to add later.
v8:
+ Remove "IPE" prefix from permissive audit record
+ align fields to the linux-audit field dictionary. This causes the
following fields to change:
enforce -> permissive
+ Remove duplicated information correlated with syscall record, that
will always be present in the audit event.
+ Change audit types:
+ AUDIT_TRUST_STATUS -> AUDIT_MAC_STATUS
+ There is no significant difference in meaning between
these types.
v9:
+ Clean up ipe_context related code
---
security/ipe/audit.c | 36 +++
security/ipe/audit.h | 1 +
security/ipe/eval.c | 9 ++
security/ipe/eval.h | 1 +
security/ipe/fs.c| 69 ++--
5 files changed, 114 insertions(+), 2 deletions(-)
diff --git a/security/ipe/audit.c b/security/ipe/audit.c
index 295e9f9f5146..ff74026a595f 100644
--- a/security/ipe/audit.c
+++ b/security/ipe/audit.c
@@ -194,3 +194,39 @@ void ipe_audit_policy_load(const struct ipe_policy *const
p)
audit_log_end(ab);
}
+
+/**
+ * ipe_audit_enforce - Audit a change in IPE's enforcement state.
+ */
+void ipe_audit_enforce(void)
+{
+ struct audit_buffer *ab;
+
+ ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_MAC_STATUS);
+ if (!ab)
+ return;
+
+ audit_log_format(ab, "permissive=%d", !READ_ONCE(enforce));
+ audit_log_format(ab, " auid=%u ses=%u lsm=ipe res=1",
+from_kuid(&init_user_ns, audit_get_loginuid(current)),
+audit_get_sessionid(current));
+
+ audit_log_end(ab);
+}
+
+/**
+ * emit_enforcement - Emit the enforcement state of IPE started with.
+ *
+ * Return:
+ * 0 - Always
+ */
+static int emit_enforcement(void)
+{
+ if (!ipe_enabled)
+ return -EOPNOTSUPP;
+
+ ipe_audit_enforce();
+ return 0;
+}
+
+late_initcall(emit_enforcement);
diff --git a/security/ipe/audit.h b/security/ipe/audit.h
index 2e9b99737f97..4c676ed32846 100644
--- a/security/ipe/audit.h
+++ b/security/ipe/audit.h
@@ -14,5 +14,6 @@ void ipe_audit_match(const struct ipe_eval_ctx *const ctx,
void ipe_audit_pol
