Skip to content

Commit 2cc1ae4

Browse files
quitschbosnitm
quitschbo
authored and
snitm
committed
dm: introduce audit event module for device mapper
To be able to send auditing events to user space, we introduce a generic dm-audit module. It provides helper functions to emit audit events through the kernel audit subsystem. We claim the AUDIT_DM_CTRL type=1336 and AUDIT_DM_EVENT type=1337 out of the audit event messages range in the corresponding userspace api in 'include/uapi/linux/audit.h' for those events. AUDIT_DM_CTRL is used to provide information about creation and destruction of device mapper targets which are triggered by user space admin control actions. AUDIT_DM_EVENT is used to provide information about actual errors during operation of the mapped device, showing e.g. integrity violations in audit log. Following commits to device mapper targets actually will make use of this to emit those events in relevant cases. The audit logs look like this if executing the following simple test: # dd if=/dev/zero of=test.img bs=1M count=1024 # losetup -f test.img # integritysetup -vD format --integrity sha256 -t 32 /dev/loop0 # integritysetup open -D /dev/loop0 --integrity sha256 integritytest # integritysetup status integritytest # integritysetup close integritytest # integritysetup open -D /dev/loop0 --integrity sha256 integritytest # integritysetup status integritytest # dd if=/dev/urandom of=/dev/loop0 bs=512 count=1 seek=100000 # dd if=/dev/mapper/integritytest of=/dev/null ------------------------- audit.log from auditd type=UNKNOWN[1336] msg=audit(1630425039.363:184): module=integrity op=ctr ppid=3807 pid=3819 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=3 comm="integritysetup" exe="/sbin/integritysetup" subj==unconfined dev=254:3 error_msg='success' res=1 type=UNKNOWN[1336] msg=audit(1630425039.471:185): module=integrity op=dtr ppid=3807 pid=3819 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=3 comm="integritysetup" exe="/sbin/integritysetup" subj==unconfined dev=254:3 error_msg='success' res=1 type=UNKNOWN[1336] msg=audit(1630425039.611:186): module=integrity op=ctr ppid=3807 pid=3819 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=3 comm="integritysetup" exe="/sbin/integritysetup" subj==unconfined dev=254:3 error_msg='success' res=1 type=UNKNOWN[1336] msg=audit(1630425054.475:187): module=integrity op=dtr ppid=3807 pid=3819 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=3 comm="integritysetup" exe="/sbin/integritysetup" subj==unconfined dev=254:3 error_msg='success' res=1 type=UNKNOWN[1336] msg=audit(1630425073.171:191): module=integrity op=ctr ppid=3807 pid=3883 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=3 comm="integritysetup" exe="/sbin/integritysetup" subj==unconfined dev=254:3 error_msg='success' res=1 type=UNKNOWN[1336] msg=audit(1630425087.239:192): module=integrity op=dtr ppid=3807 pid=3902 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=3 comm="integritysetup" exe="/sbin/integritysetup" subj==unconfined dev=254:3 error_msg='success' res=1 type=UNKNOWN[1336] msg=audit(1630425093.755:193): module=integrity op=ctr ppid=3807 pid=3906 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=3 comm="integritysetup" exe="/sbin/integritysetup" subj==unconfined dev=254:3 error_msg='success' res=1 type=UNKNOWN[1337] msg=audit(1630425112.119:194): module=integrity op=integrity-checksum dev=254:3 sector=77480 res=0 type=UNKNOWN[1337] msg=audit(1630425112.119:195): module=integrity op=integrity-checksum dev=254:3 sector=77480 res=0 type=UNKNOWN[1337] msg=audit(1630425112.119:196): module=integrity op=integrity-checksum dev=254:3 sector=77480 res=0 type=UNKNOWN[1337] msg=audit(1630425112.119:197): module=integrity op=integrity-checksum dev=254:3 sector=77480 res=0 type=UNKNOWN[1337] msg=audit(1630425112.119:198): module=integrity op=integrity-checksum dev=254:3 sector=77480 res=0 type=UNKNOWN[1337] msg=audit(1630425112.119:199): module=integrity op=integrity-checksum dev=254:3 sector=77480 res=0 type=UNKNOWN[1337] msg=audit(1630425112.119:200): module=integrity op=integrity-checksum dev=254:3 sector=77480 res=0 type=UNKNOWN[1337] msg=audit(1630425112.119:201): module=integrity op=integrity-checksum dev=254:3 sector=77480 res=0 type=UNKNOWN[1337] msg=audit(1630425112.119:202): module=integrity op=integrity-checksum dev=254:3 sector=77480 res=0 type=UNKNOWN[1337] msg=audit(1630425112.119:203): module=integrity op=integrity-checksum dev=254:3 sector=77480 res=0 Signed-off-by: Michael Weiß <[email protected]> Signed-off-by: Paul Moore <[email protected]> # fix audit.h numbering Signed-off-by: Mike Snitzer <[email protected]>
1 parent d208b89 commit 2cc1ae4

File tree

5 files changed

+165
-0
lines changed

5 files changed

+165
-0
lines changed

‎drivers/md/Kconfig

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -642,4 +642,13 @@ config DM_ZONED
642642

643643
If unsure, say N.
644644

645+
config DM_AUDIT
646+
bool "DM audit events"
647+
depends on AUDIT
648+
help
649+
Generate audit events for device-mapper.
650+
651+
Enables audit logging of several security relevant events in the
652+
particular device-mapper targets, especially the integrity target.
653+
645654
endif # MD

‎drivers/md/Makefile

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -107,3 +107,7 @@ endif
107107
ifeq ($(CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG),y)
108108
dm-verity-objs += dm-verity-verify-sig.o
109109
endif
110+
111+
ifeq ($(CONFIG_DM_AUDIT),y)
112+
dm-mod-objs += dm-audit.o
113+
endif

‎drivers/md/dm-audit.c

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
// SPDX-License-Identifier: GPL-2.0
2+
/*
3+
* Creating audit records for mapped devices.
4+
*
5+
* Copyright (C) 2021 Fraunhofer AISEC. All rights reserved.
6+
*
7+
* Authors: Michael Weiß <[email protected]>
8+
*/
9+
10+
#include <linux/audit.h>
11+
#include <linux/module.h>
12+
#include <linux/device-mapper.h>
13+
#include <linux/bio.h>
14+
#include <linux/blkdev.h>
15+
16+
#include "dm-audit.h"
17+
#include "dm-core.h"
18+
19+
static struct audit_buffer *dm_audit_log_start(int audit_type,
20+
const char *dm_msg_prefix,
21+
const char *op)
22+
{
23+
struct audit_buffer *ab;
24+
25+
if (audit_enabled == AUDIT_OFF)
26+
return NULL;
27+
28+
ab = audit_log_start(audit_context(), GFP_KERNEL, audit_type);
29+
if (unlikely(!ab))
30+
return NULL;
31+
32+
audit_log_format(ab, "module=%s op=%s", dm_msg_prefix, op);
33+
return ab;
34+
}
35+
36+
void dm_audit_log_ti(int audit_type, const char *dm_msg_prefix, const char *op,
37+
struct dm_target *ti, int result)
38+
{
39+
struct audit_buffer *ab = NULL;
40+
struct mapped_device *md = dm_table_get_md(ti->table);
41+
int dev_major = dm_disk(md)->major;
42+
int dev_minor = dm_disk(md)->first_minor;
43+
44+
switch (audit_type) {
45+
case AUDIT_DM_CTRL:
46+
ab = dm_audit_log_start(audit_type, dm_msg_prefix, op);
47+
if (unlikely(!ab))
48+
return;
49+
audit_log_task_info(ab);
50+
audit_log_format(ab, " dev=%d:%d error_msg='%s'", dev_major,
51+
dev_minor, !result ? ti->error : "success");
52+
break;
53+
case AUDIT_DM_EVENT:
54+
ab = dm_audit_log_start(audit_type, dm_msg_prefix, op);
55+
if (unlikely(!ab))
56+
return;
57+
audit_log_format(ab, " dev=%d:%d sector=?", dev_major,
58+
dev_minor);
59+
break;
60+
default: /* unintended use */
61+
return;
62+
}
63+
64+
audit_log_format(ab, " res=%d", result);
65+
audit_log_end(ab);
66+
}
67+
EXPORT_SYMBOL_GPL(dm_audit_log_ti);
68+
69+
void dm_audit_log_bio(const char *dm_msg_prefix, const char *op,
70+
struct bio *bio, sector_t sector, int result)
71+
{
72+
struct audit_buffer *ab;
73+
int dev_major = MAJOR(bio->bi_bdev->bd_dev);
74+
int dev_minor = MINOR(bio->bi_bdev->bd_dev);
75+
76+
ab = dm_audit_log_start(AUDIT_DM_EVENT, dm_msg_prefix, op);
77+
if (unlikely(!ab))
78+
return;
79+
80+
audit_log_format(ab, " dev=%d:%d sector=%llu res=%d",
81+
dev_major, dev_minor, sector, result);
82+
audit_log_end(ab);
83+
}
84+
EXPORT_SYMBOL_GPL(dm_audit_log_bio);

‎drivers/md/dm-audit.h

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
/* SPDX-License-Identifier: GPL-2.0 */
2+
/*
3+
* Creating audit records for mapped devices.
4+
*
5+
* Copyright (C) 2021 Fraunhofer AISEC. All rights reserved.
6+
*
7+
* Authors: Michael Weiß <[email protected]>
8+
*/
9+
10+
#ifndef DM_AUDIT_H
11+
#define DM_AUDIT_H
12+
13+
#include <linux/device-mapper.h>
14+
#include <linux/audit.h>
15+
16+
#ifdef CONFIG_DM_AUDIT
17+
void dm_audit_log_bio(const char *dm_msg_prefix, const char *op,
18+
struct bio *bio, sector_t sector, int result);
19+
20+
/*
21+
* dm_audit_log_ti() is not intended to be used directly in dm modules,
22+
* the wrapper functions below should be called by dm modules instead.
23+
*/
24+
void dm_audit_log_ti(int audit_type, const char *dm_msg_prefix, const char *op,
25+
struct dm_target *ti, int result);
26+
27+
static inline void dm_audit_log_ctr(const char *dm_msg_prefix,
28+
struct dm_target *ti, int result)
29+
{
30+
dm_audit_log_ti(AUDIT_DM_CTRL, dm_msg_prefix, "ctr", ti, result);
31+
}
32+
33+
static inline void dm_audit_log_dtr(const char *dm_msg_prefix,
34+
struct dm_target *ti, int result)
35+
{
36+
dm_audit_log_ti(AUDIT_DM_CTRL, dm_msg_prefix, "dtr", ti, result);
37+
}
38+
39+
static inline void dm_audit_log_target(const char *dm_msg_prefix, const char *op,
40+
struct dm_target *ti, int result)
41+
{
42+
dm_audit_log_ti(AUDIT_DM_EVENT, dm_msg_prefix, op, ti, result);
43+
}
44+
#else
45+
static inline void dm_audit_log_bio(const char *dm_msg_prefix, const char *op,
46+
struct bio *bio, sector_t sector,
47+
int result)
48+
{
49+
}
50+
static inline void dm_audit_log_target(const char *dm_msg_prefix,
51+
const char *op, struct dm_target *ti,
52+
int result)
53+
{
54+
}
55+
static inline void dm_audit_log_ctr(const char *dm_msg_prefix,
56+
struct dm_target *ti, int result)
57+
{
58+
}
59+
60+
static inline void dm_audit_log_dtr(const char *dm_msg_prefix,
61+
struct dm_target *ti, int result)
62+
{
63+
}
64+
#endif
65+
66+
#endif

‎include/uapi/linux/audit.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,8 @@
118118
#define AUDIT_TIME_ADJNTPVAL 1333 /* NTP value adjustment */
119119
#define AUDIT_BPF 1334 /* BPF subsystem */
120120
#define AUDIT_EVENT_LISTENER 1335 /* Task joined multicast read socket */
121+
#define AUDIT_DM_CTRL 1338 /* Device Mapper target control */
122+
#define AUDIT_DM_EVENT 1339 /* Device Mapper events */
121123

122124
#define AUDIT_AVC 1400 /* SE Linux avc denial or grant */
123125
#define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */

0 commit comments

Comments
 (0)