bpf: Emit audit messages upon successful prog load and unload
Allow for audit messages to be emitted upon BPF program load and unload for having a timeline of events. The load itself is in syscall context, so additional info about the process initiating the BPF prog creation can be logged and later directly correlated to the unload event. The only info really needed from BPF side is the globally unique prog ID where then audit user space tooling can query / dump all info needed about the specific BPF program right upon load event and enrich the record, thus these changes needed here can be kept small and non-intrusive to the core. Raw example output: # auditctl -D # auditctl -a always,exit -F arch=x86_64 -S bpf # ausearch --start recent -m 1334 [...] ---- time->Wed Nov 20 12:45:51 2019 type=PROCTITLE msg=audit(1574271951.590:8974): proctitle="./test_verifier" type=SYSCALL msg=audit(1574271951.590:8974): arch=c000003e syscall=321 success=yes exit=14 a0=5 a1=7ffe2d923e80 a2=78 a3=0 items=0 ppid=742 pid=949 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm="test_verifier" exe="/root/bpf-next/tools/testing/selftests/bpf/test_verifier" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) type=UNKNOWN[1334] msg=audit(1574271951.590:8974): auid=0 uid=0 gid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=949 comm="test_verifier" exe="/root/bpf-next/tools/testing/selftests/bpf/test_verifier" prog-id=3260 event=LOAD ---- time->Wed Nov 20 12:45:51 2019 type=UNKNOWN[1334] msg=audit(1574271951.590:8975): prog-id=3260 event=UNLOAD ---- [...] Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20191120213816.8186-1-jolsa@kernel.org
This commit is contained in:
parent
b2e2f0e6a6
commit
91e6015b08
|
@ -159,6 +159,7 @@ extern void audit_log_key(struct audit_buffer *ab,
|
|||
extern void audit_log_link_denied(const char *operation);
|
||||
extern void audit_log_lost(const char *message);
|
||||
|
||||
extern void audit_log_task(struct audit_buffer *ab);
|
||||
extern int audit_log_task_context(struct audit_buffer *ab);
|
||||
extern void audit_log_task_info(struct audit_buffer *ab);
|
||||
|
||||
|
@ -219,6 +220,8 @@ static inline void audit_log_key(struct audit_buffer *ab, char *key)
|
|||
{ }
|
||||
static inline void audit_log_link_denied(const char *string)
|
||||
{ }
|
||||
static inline void audit_log_task(struct audit_buffer *ab)
|
||||
{ }
|
||||
static inline int audit_log_task_context(struct audit_buffer *ab)
|
||||
{
|
||||
return 0;
|
||||
|
|
|
@ -116,6 +116,7 @@
|
|||
#define AUDIT_FANOTIFY 1331 /* Fanotify access decision */
|
||||
#define AUDIT_TIME_INJOFFSET 1332 /* Timekeeping offset injected */
|
||||
#define AUDIT_TIME_ADJNTPVAL 1333 /* NTP value adjustment */
|
||||
#define AUDIT_BPF 1334 /* BPF subsystem */
|
||||
|
||||
#define AUDIT_AVC 1400 /* SE Linux avc denial or grant */
|
||||
#define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */
|
||||
|
|
|
@ -2545,7 +2545,7 @@ void __audit_ntp_log(const struct audit_ntp_data *ad)
|
|||
audit_log_ntp_val(ad, "adjust", AUDIT_NTP_ADJUST);
|
||||
}
|
||||
|
||||
static void audit_log_task(struct audit_buffer *ab)
|
||||
void audit_log_task(struct audit_buffer *ab)
|
||||
{
|
||||
kuid_t auid, uid;
|
||||
kgid_t gid;
|
||||
|
|
|
@ -23,6 +23,7 @@
|
|||
#include <linux/timekeeping.h>
|
||||
#include <linux/ctype.h>
|
||||
#include <linux/nospec.h>
|
||||
#include <linux/audit.h>
|
||||
#include <uapi/linux/btf.h>
|
||||
|
||||
#define IS_FD_ARRAY(map) ((map)->map_type == BPF_MAP_TYPE_PROG_ARRAY || \
|
||||
|
@ -1318,6 +1319,34 @@ static void free_used_maps(struct bpf_prog_aux *aux)
|
|||
kfree(aux->used_maps);
|
||||
}
|
||||
|
||||
enum bpf_event {
|
||||
BPF_EVENT_LOAD,
|
||||
BPF_EVENT_UNLOAD,
|
||||
};
|
||||
|
||||
static const char * const bpf_event_audit_str[] = {
|
||||
[BPF_EVENT_LOAD] = "LOAD",
|
||||
[BPF_EVENT_UNLOAD] = "UNLOAD",
|
||||
};
|
||||
|
||||
static void bpf_audit_prog(const struct bpf_prog *prog, enum bpf_event event)
|
||||
{
|
||||
bool has_task_context = event == BPF_EVENT_LOAD;
|
||||
struct audit_buffer *ab;
|
||||
|
||||
if (audit_enabled == AUDIT_OFF)
|
||||
return;
|
||||
ab = audit_log_start(audit_context(), GFP_ATOMIC, AUDIT_BPF);
|
||||
if (unlikely(!ab))
|
||||
return;
|
||||
if (has_task_context)
|
||||
audit_log_task(ab);
|
||||
audit_log_format(ab, "%sprog-id=%u event=%s",
|
||||
has_task_context ? " " : "",
|
||||
prog->aux->id, bpf_event_audit_str[event]);
|
||||
audit_log_end(ab);
|
||||
}
|
||||
|
||||
int __bpf_prog_charge(struct user_struct *user, u32 pages)
|
||||
{
|
||||
unsigned long memlock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
|
||||
|
@ -1434,6 +1463,7 @@ static void __bpf_prog_put(struct bpf_prog *prog, bool do_idr_lock)
|
|||
{
|
||||
if (atomic64_dec_and_test(&prog->aux->refcnt)) {
|
||||
perf_event_bpf_event(prog, PERF_BPF_EVENT_PROG_UNLOAD, 0);
|
||||
bpf_audit_prog(prog, BPF_EVENT_UNLOAD);
|
||||
/* bpf_prog_free_id() must be called first */
|
||||
bpf_prog_free_id(prog, do_idr_lock);
|
||||
__bpf_prog_put_noref(prog, true);
|
||||
|
@ -1843,6 +1873,7 @@ static int bpf_prog_load(union bpf_attr *attr, union bpf_attr __user *uattr)
|
|||
*/
|
||||
bpf_prog_kallsyms_add(prog);
|
||||
perf_event_bpf_event(prog, PERF_BPF_EVENT_PROG_LOAD, 0);
|
||||
bpf_audit_prog(prog, BPF_EVENT_LOAD);
|
||||
|
||||
err = bpf_prog_new_fd(prog);
|
||||
if (err < 0)
|
||||
|
|
Loading…
Reference in a new issue