Commit 2fec30e2 authored by Richard Guy Briggs's avatar Richard Guy Briggs Committed by Paul Moore
Browse files

audit: add support for fcaps v3 

V3 namespaced file capabilities were introduced in
commit 8db6c34f ("Introduce v3 namespaced file capabilities")

Add support for these by adding the "frootid" field to the existing
fcaps fields in the NAME and BPRM_FCAPS records.

Please see github issue
https://github.com/linux-audit/audit-kernel/issues/103



Signed-off-by: default avatarRichard Guy Briggs <rgb@redhat.com>
Acked-by: default avatarSerge Hallyn <serge@hallyn.com>
[PM: comment tweak to fit an 80 char line width]
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 4b7d248b

include/linux/capability.h

+3 −2
Original line number Diff line number Diff line
@@ -14,7 +14,7 @@ 
#define _LINUX_CAPABILITY_H



#include <uapi/linux/capability.h>



#include <linux/uidgid.h>



#define _KERNEL_CAPABILITY_VERSION _LINUX_CAPABILITY_VERSION_3

#define _KERNEL_CAPABILITY_U32S    _LINUX_CAPABILITY_U32S_3
@@ -25,11 +25,12 @@ typedef struct kernel_cap_struct { 
	__u32 cap[_KERNEL_CAPABILITY_U32S];

} kernel_cap_t;



/* exact same as vfs_cap_data but in cpu endian and always filled completely */

/* same as vfs_ns_cap_data but in cpu endian and always filled completely */

struct cpu_vfs_cap_data {

	__u32 magic_etc;

	kernel_cap_t permitted;

	kernel_cap_t inheritable;

	kuid_t rootid;

};



#define _USER_CAP_HEADER_SIZE  (sizeof(struct __user_cap_header_struct))

kernel/audit.c

+4 −2
Original line number Diff line number Diff line
@@ -2084,8 +2084,9 @@ static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name) 
{

	audit_log_cap(ab, "cap_fp", &name->fcap.permitted);

	audit_log_cap(ab, "cap_fi", &name->fcap.inheritable);

	audit_log_format(ab, " cap_fe=%d cap_fver=%x",

			 name->fcap.fE, name->fcap_ver);

	audit_log_format(ab, " cap_fe=%d cap_fver=%x cap_frootid=%d",

			 name->fcap.fE, name->fcap_ver,

			 from_kuid(&init_user_ns, name->fcap.rootid));

}



static inline int audit_copy_fcaps(struct audit_names *name,
@@ -2104,6 +2105,7 @@ static inline int audit_copy_fcaps(struct audit_names *name, 
	name->fcap.permitted = caps.permitted;

	name->fcap.inheritable = caps.inheritable;

	name->fcap.fE = !!(caps.magic_etc & VFS_CAP_FLAGS_EFFECTIVE);

	name->fcap.rootid = caps.rootid;

	name->fcap_ver = (caps.magic_etc & VFS_CAP_REVISION_MASK) >>

				VFS_CAP_REVISION_SHIFT;

kernel/audit.h

+1 −0
Original line number Diff line number Diff line
@@ -69,6 +69,7 @@ struct audit_cap_data { 
		kernel_cap_t	effective;	/* effective set of process */

	};

	kernel_cap_t		ambient;

	kuid_t			rootid;

};



/* When fs/namei.c:getname() is called, we store the pointer in name and bump

kernel/auditsc.c

+4 −0
Original line number Diff line number Diff line
@@ -1358,6 +1358,9 @@ static void audit_log_exit(void) 
			audit_log_cap(ab, "pi", &axs->new_pcap.inheritable);

			audit_log_cap(ab, "pe", &axs->new_pcap.effective);

			audit_log_cap(ab, "pa", &axs->new_pcap.ambient);

			audit_log_format(ab, " frootid=%d",

					 from_kuid(&init_user_ns,

						   axs->fcap.rootid));

			break; }



		}
@@ -2271,6 +2274,7 @@ int __audit_log_bprm_fcaps(struct linux_binprm *bprm, 
	ax->fcap.permitted = vcaps.permitted;

	ax->fcap.inheritable = vcaps.inheritable;

	ax->fcap.fE = !!(vcaps.magic_etc & VFS_CAP_FLAGS_EFFECTIVE);

	ax->fcap.rootid = vcaps.rootid;

	ax->fcap_ver = (vcaps.magic_etc & VFS_CAP_REVISION_MASK) >> VFS_CAP_REVISION_SHIFT;



	ax->old_pcap.permitted   = old->cap_permitted;

security/commoncap.c

+2 −0
Original line number Diff line number Diff line
@@ -643,6 +643,8 @@ int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data 
	cpu_caps->permitted.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;

	cpu_caps->inheritable.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;



	cpu_caps->rootid = rootkuid;



	return 0;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE