lkml.org 
[lkml]   [2020]   [Sep]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.4 24/64] audit: CONFIG_CHANGE don't log internal bookkeeping as an event
    Date
    From: Steve Grubb <sgrubb@redhat.com>

    [ Upstream commit 70b3eeed49e8190d97139806f6fbaf8964306cdb ]

    Common Criteria calls out for any action that modifies the audit trail to
    be recorded. That usually is interpreted to mean insertion or removal of
    rules. It is not required to log modification of the inode information
    since the watch is still in effect. Additionally, if the rule is a never
    rule and the underlying file is one they do not want events for, they
    get an event for this bookkeeping update against their wishes.

    Since no device/inode info is logged at insertion and no device/inode
    information is logged on update, there is nothing meaningful being
    communicated to the admin by the CONFIG_CHANGE updated_rules event. One
    can assume that the rule was not "modified" because it is still watching
    the intended target. If the device or inode cannot be resolved, then
    audit_panic is called which is sufficient.

    The correct resolution is to drop logging config_update events since
    the watch is still in effect but just on another unknown inode.

    Signed-off-by: Steve Grubb <sgrubb@redhat.com>
    Signed-off-by: Paul Moore <paul@paul-moore.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    kernel/audit_watch.c | 2 --
    1 file changed, 2 deletions(-)

    diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
    index f45a9a5d3e47a..af453f3c2b3dd 100644
    --- a/kernel/audit_watch.c
    +++ b/kernel/audit_watch.c
    @@ -316,8 +316,6 @@ static void audit_update_watch(struct audit_parent *parent,
    if (oentry->rule.exe)
    audit_remove_mark(oentry->rule.exe);

    - audit_watch_log_rule_change(r, owatch, "updated_rules");
    -
    call_rcu(&oentry->rcu, audit_free_rule_rcu);
    }

    --
    2.25.1
    \
     
     \ /
      Last update: 2020-09-18 04:18    [W:3.516 / U:0.156 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site