On 2018-07-12 13:36, Ondrej Mosnacek wrote: > So far only add one to openat(2) for testing purposes. > > Example records: > type=PROCTITLE msg=audit(07/04/18 15:28:41.808:76) : proctitle=/bin/bash > ./openat-audit-test.sh > type=PATH msg=audit(07/04/18 15:28:41.808:76) : item=0 name=b inode=2154 > dev=00:1a mode=dir,755 ouid=root ogid=root rdev=00:00 > obj=system_u:object_r:tmpfs_t:s0 nametype=NORMAL cap_fp=none cap_fi=none > cap_fe=0 cap_fver=0 > type=CWD msg=audit(07/04/18 15:28:41.808:76) : cwd=/root/Dokumenty/Kernel > type=SYSCALL msg=audit(07/04/18 15:28:41.808:76) : arch=x86_64 syscall=openat > success=yes exit=6 a0=0x5 a1=0x55bad2616348 > a2=O_RDONLY|O_NOCTTY|O_NONBLOCK|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC a3=0x0 > items=1 ppid=594 pid=630 auid=root uid=root gid=root euid=root suid=root > fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=1 comm=find > exe=/usr/bin/find subj=system_u:system_r:kernel_t:s0 key=(null) > type=FD_PATH msg=audit(07/04/18 15:28:41.808:76) : fd=5 path=/tmp/a > ---- > type=PROCTITLE msg=audit(07/04/18 15:28:41.808:77) : proctitle=/bin/bash > ./openat-audit-test.sh > type=PATH msg=audit(07/04/18 15:28:41.808:77) : item=0 name=c inode=2155 > dev=00:1a mode=dir,755 ouid=root ogid=root rdev=00:00 > obj=system_u:object_r:tmpfs_t:s0 nametype=NORMAL cap_fp=none cap_fi=none > cap_fe=0 cap_fver=0 > type=CWD msg=audit(07/04/18 15:28:41.808:77) : cwd=/root/Dokumenty/Kernel > type=SYSCALL msg=audit(07/04/18 15:28:41.808:77) : arch=x86_64 syscall=openat > success=yes exit=6 a0=0x7 a1=0x55bad260e328 > a2=O_RDONLY|O_NOCTTY|O_NONBLOCK|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC a3=0x0 > items=1 ppid=594 pid=630 auid=root uid=root gid=root euid=root suid=root > fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=1 comm=find > exe=/usr/bin/find subj=system_u:system_r:kernel_t:s0 key=(null) > type=FD_PATH msg=audit(07/04/18 15:28:41.808:77) : fd=7 path=/tmp/a/b > ---- > > Signed-off-by: Ondrej Mosnacek <[email protected]>
This patchset looks encouraging. > --- > fs/open.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/fs/open.c b/fs/open.c > index d0e955b558ad..7fa326fc025d 100644 > --- a/fs/open.c > +++ b/fs/open.c > @@ -1125,6 +1125,8 @@ SYSCALL_DEFINE4(openat, int, dfd, const char __user *, > filename, int, flags, > if (force_o_largefile()) > flags |= O_LARGEFILE; > > + audit_fd_path(dfd); > + > return do_sys_open(dfd, filename, flags, mode); > } > - RGB -- Richard Guy Briggs <[email protected]> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635 -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
