mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 08:15:07 -04:00
Code Issues Packages Projects Releases Wiki Activity

smack: show msgrcv() subject task in audit

Browse Source 
When a task msgrcv()'es some message the SMACK audit log message
looks like:

  fn=smk_tskacc_msq action=denied subject="bar" object="foo" requested=rw
	pid=456 comm="mrcv" ipc_key=2
  fn=smk_tskacc_msq action=granted subject="bar" object="foo" requested=rw
	pid=519 comm="mrcv" ipc_key=2

where pid= is a pid of a “current” task which calls smk_tskacc_msq().
Usually, the caller of smk_tskacc_msq() is also a subject task
which determines its own permission. In the example above
the 'mrcv' process has label 'bar' and wants "rw" for label "foo".

However, when sender task delivers message using

  ipc/msg.c`pipelined_send():
  ` security_msg_queue_msgrcv(,, msr->r_tsk,,)
  ` smp_store_release(&msr->r_msg, msg)

“current” task and “subject” task differ, and
the “subject” task is missed from the audit message.

This patch adds two fields, subj_pid and subj_comm,
into the audit message:

  fn=smk_tskacc_msq action=granted subject="bar" object="foo" requested=rw
	subj_pid=564 subj_comm="mrcv" pid=577 comm="msnd" ipc_key=2

Signed-off-by: Konstantin Andreev <andreev@swemel.ru>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
This commit is contained in:
Konstantin Andreev
2026-05-11 03:17:17 +03:00
committed by Casey Schaufler
parent fba3d32825
commit 0bcb3c5e71
3 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
security/smack/smack.h
View File

@@ -261,6 +261,7 @@ struct smack_audit_data {
char *subject;
char *object;
char *request;
struct task_struct *subj_tsk;
int result;
};

9
security/smack/smack_access.c
View File

@@ -331,6 +331,15 @@ static void smack_log_callback(struct audit_buffer *ab, void *a)
audit_log_format(ab, " labels_differ");
else
audit_log_format(ab, " requested=%s", sad->request);
if (sad->subj_tsk) {
char comm[TASK_COMM_LEN];
audit_log_format(ab, " subj_pid=%d subj_comm=",
task_tgid_nr(sad->subj_tsk));
audit_log_untrustedstring(ab,
get_task_comm(comm, sad->subj_tsk));
}
}
/**

2
security/smack/smack_lsm.c
View File

@@ -3383,6 +3383,8 @@ smk_tskacc_msq(struct task_struct *tsk, struct kern_ipc_perm *isp, int access)
#ifdef CONFIG_AUDIT
smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
ad.a.u.ipc_id = isp->id;
if (!tsk_is_current)
ad.sad.subj_tsk = tsk;
#endif
rc = smk_tskacc(tsp, msp, access, &ad);
rc = smk_bu_tsk_to_obj(tsk, tsp, "msq", msp, access, rc);