Doug / smarc-fsl-linux-kernel

02 Aug, 2010

2 commits

  • 67012e820   AppArmor: basic auditing infrastructure. ... Browse Code »

    Update lsm_audit for AppArmor specific data, and add the core routines for
    AppArmor uses for auditing.

    Signed-off-by: John Johansen
    Signed-off-by: James Morris

    John Johansen
     
  • b782e0a68   SELinux: special dontaudit for access checks ... Browse Code »

    Currently there are a number of applications (nautilus being the main one) which
    calls access() on files in order to determine how they should be displayed. It
    is normal and expected that nautilus will want to see if files are executable
    or if they are really read/write-able. access() should return the real
    permission. SELinux policy checks are done in access() and can result in lots
    of AVC denials as policy denies RWX on files which DAC allows. Currently
    SELinux must dontaudit actual attempts to read/write/execute a file in
    order to silence these messages (and not flood the logs.) But dontaudit rules
    like that can hide real attacks. This patch addes a new common file
    permission audit_access. This permission is special in that it is meaningless
    and should never show up in an allow rule. Instead the only place this
    permission has meaning is in a dontaudit rule like so:

    dontaudit nautilus_t sbin_t:file audit_access

    With such a rule if nautilus just checks access() we will still get denied and
    thus userspace will still get the correct answer but we will not log the denial.
    If nautilus attempted to actually perform one of the forbidden actions
    (rather than just querying access(2) about it) we would still log a denial.
    This type of dontaudit rule should be used sparingly, as it could be a
    method for an attacker to probe the system permissions without detection.

    Signed-off-by: Eric Paris
    Acked-by: Stephen D. Smalley
    Signed-off-by: James Morris

    Eric Paris
     

28 Apr, 2010

1 commit

10 Nov, 2009

1 commit

  • dd8dbf2e6   security: report the module name to security_module_request ... Browse Code »

    For SELinux to do better filtering in userspace we send the name of the
    module along with the AVC denial when a program is denied module_request.

    Example output:

    type=SYSCALL msg=audit(11/03/2009 10:59:43.510:9) : arch=x86_64 syscall=write success=yes exit=2 a0=3 a1=7fc28c0d56c0 a2=2 a3=7fffca0d7440 items=0 ppid=1727 pid=1729 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=rpc.nfsd exe=/usr/sbin/rpc.nfsd subj=system_u:system_r:nfsd_t:s0 key=(null)
    type=AVC msg=audit(11/03/2009 10:59:43.510:9) : avc: denied { module_request } for pid=1729 comm=rpc.nfsd kmod="net-pf-10" scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system

    Signed-off-by: Eric Paris
    Signed-off-by: James Morris

    Eric Paris
     

17 Aug, 2009

1 commit

  • 2bf496903   SELinux: Convert avc_audit to use lsm_audit.h ... Browse Code »

    Convert avc_audit in security/selinux/avc.c to use lsm_audit.h,
    for better maintainability.

    - changed selinux to use common_audit_data instead of
    avc_audit_data
    - eliminated code in avc.c and used code from lsm_audit.h instead.

    Had to add a LSM_AUDIT_NO_AUDIT to lsm_audit.h so that avc_audit
    can call common_lsm_audit and do the pre and post callbacks without
    doing the actual dump. This makes it so that the patched version
    behaves the same way as the unpatched version.

    Also added a denied field to the selinux_audit_data private space,
    once again to make it so that the patched version behaves like the
    unpatched.

    I've tested and confirmed that AVCs look the same before and after
    this patch.

    Signed-off-by: Thomas Liu
    Acked-by: Stephen Smalley
    Signed-off-by: James Morris

    Thomas Liu
     

10 Jul, 2009

3 commits

14 Apr, 2009

1 commit

  • 6e837fb15   smack: implement logging V3 ... Browse Code »

    This patch creates auditing functions usable by LSM to audit security
    events. It provides standard dumping of FS, NET, task etc ... events
    (code borrowed from SELinux)
    and provides 2 callbacks to define LSM specific auditing, which should be
    flexible enough to convert SELinux too.

    Signed-off-by: Etienne Basset
    Acked-by: Casey Schaufler
    cked-by: Eric Paris
    Signed-off-by: James Morris

    Etienne Basset