Audit: add support to match lsm labels on user audit messages

Add support for matching by security label (e.g. SELinux context) of the sender of an user-space audit record. The audit filter code already allows user space to configure such filters, but they were ignored during evaluation. This patch implements evaluation of these filters. For example, after application of this patch, PAM authentication logs caused by cron can be disabled using auditctl -a user,never -F subj_type=crond_t Signed-off-by: Miloslav Trmac <mitr@redhat.com> Acked-by: Eric Paris <eparis@redhat.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Audit: add support to match lsm labels on user audit messages
Add support for matching by security label (e.g. SELinux context) of the sender of an user-space audit record. The audit filter code already allows user space to configure such filters, but they were ignored during evaluation. This patch implements evaluation of these filters. For example, after application of this patch, PAM authentication logs caused by cron can be disabled using auditctl -a user,never -F subj_type=crond_t Signed-off-by: Miloslav Trmac <mitr@redhat.com> Acked-by: Eric Paris <eparis@redhat.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Miloslav Trmac · Al Viro
1 parent 2d10d8737c
Showing 1 changed file with 12 additions and 0 deletions Side-by-side Diff
kernel/auditfilter.c
@@ -1252,6 +1252,18 @@
 		case AUDIT_LOGINUID:
 			result = audit_comparator(cb->loginuid, f->op, f->val);
 			break;
+		case AUDIT_SUBJ_USER:
+		case AUDIT_SUBJ_ROLE:
+		case AUDIT_SUBJ_TYPE:
+		case AUDIT_SUBJ_SEN:
+		case AUDIT_SUBJ_CLR:
+			if (f->lsm_rule)
+				result = security_audit_rule_match(cb->sid,
+								   f->type,
+								   f->op,
+								   f->lsm_rule,
+								   NULL);
+			break;
 		}
  
 		if (!result)
...	...	@@ -1252,6 +1252,18 @@
1252	1252	case AUDIT_LOGINUID:
1253	1253	result = audit_comparator(cb->loginuid, f->op, f->val);
1254	1254	break;
	1255	+ case AUDIT_SUBJ_USER:
	1256	+ case AUDIT_SUBJ_ROLE:
	1257	+ case AUDIT_SUBJ_TYPE:
	1258	+ case AUDIT_SUBJ_SEN:
	1259	+ case AUDIT_SUBJ_CLR:
	1260	+ if (f->lsm_rule)
	1261	+ result = security_audit_rule_match(cb->sid,
	1262	+ f->type,
	1263	+ f->op,
	1264	+ f->lsm_rule,
	1265	+ NULL);
	1266	+ break;
1255	1267	}
1256	1268
1257	1269	if (!result)