Comments (6)
@stevegrubb and I just discussed this a bit offline; I'm not sure it makes sense to convert this to a USER_MAC_POLICY_LOAD record (this is a userspace AVC invalidation event due to the kernel loading a new SELinux policy), but I agree that we could/should be doing a better job with the record's "msg" formatting.
from audit-kernel.
I noticed another related issue with this message. One might argue that message should appear only once for each policy reload. However, this is not the case.
[root@f28 ~]# load_policy && systemctl status >/dev/null # by calling status I force systemd to make access check against the policy
[root@f28 ~]# ausearch -ts recent -m user_avc
time->Tue Sep 11 12:14:30 2018
type=USER_AVC msg=audit(1536668070.055:678): pid=469 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: received policyload notice (seqno=3) exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
----
time->Tue Sep 11 12:14:30 2018
type=USER_AVC msg=audit(1536668070.070:680): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: received policyload notice (seqno=3) exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
Notice that one message is generated by dbus-daemon while other is from systemd. I assume that on a system with X11 I'd probably see third such message from xorg. The problem is that each application that uses libselinux, and has overridden default logging callback with one that forwards libselinux messages to auditd, will produce one of those messages as soon as the application calls selinux_check_access()
.
I think it should be the kernel who generates the message. User-space should only take notice of the change and silently (by default) invalidate its AVC (or do whatever else is necessary to make sure that followup checks against policy don't generate incorrect results).
from audit-kernel.
@msekletar I believe the issue with the multiple notices in this case is due to both dbus and systemd acting as userspace object managers and thus they both receive AVC policy load notices so they can take whatever actions are necessary.
The issue isn't so much with the audit subsystem in the kernel, or auditd, but rather how these userspace object managers use libselinux. I would suggest brining this up on the SELinux developers list so it can be discussed.
from audit-kernel.
I will start a discussion there. Thank you!
from audit-kernel.
@stevegrubb and I just discussed this a bit offline; I'm not sure it makes sense to convert this to a USER_MAC_POLICY_LOAD record (this is a userspace AVC invalidation event due to the kernel loading a new SELinux policy), but I agree that we could/should be doing a better job with the record's "msg" formatting.
Since this is the format of a user-generated message this doesn't appear to be a kernel issue. Can we close this here and open in in audit-userspace if that is even appropriate?
from audit-kernel.
Since this is the format of a user-generated message this doesn't appear to be a kernel issue. Can we close this here and open in in audit-userspace if that is even appropriate?
I think that's the right decision. Although honestly, I'm not even 100% certain it really belongs in audit-userspace either. This really looks like an issue with the individual SELinux userspace object managers, or the SELinux userspace libraries; it all depends on where the message is being generated (application or library).
from audit-kernel.
Related Issues (20)
- BUG: incorrect PARENT path when removing a folder with files HOT 8
- Q: can't add rules using '-a task,always -S fork' HOT 6
- RFE: provide a mechanism to shut down auditd with auid accountability via systemd HOT 1
- BUG: memory leak from __audit_log_kern_module() HOT 4
- BUG: rules with 'exit' filter do not generate any audit events HOT 16
- BUG: PATH record contains (null) for file descriptor operation HOT 2
- RFE: support filtering by openat2(2) oflags HOT 2
- Q: elogind stops incrementing session ID after some uptime HOT 4
- RFE: be able to filter out AVCs based on operation and "kmod" field HOT 6
- Q/BUG: process stuck in audit_backlog_wait for a longtime HOT 8
- RFE: improve filtering events by exe for containers HOT 2
- Q/BUG: cannot disable Ubuntu kernel's audit system via auditctl HOT 3
- Q: why does the kernel audit module not record the absolute path of the file HOT 8
- Q: adding system call monitoring rule on aarch64 fails HOT 2
- Q: pervasive security.capability xattr reads HOT 2
- RFE: clone3() syscall needs a dedicated record
- RFE: fsopen missing info
- RFE: fsconfig missing info
- BUG: error receiving audit netlink packet (No buffer space available) HOT 3
- BUG: audit init message shows 0-second timestamp on aarch64 HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from audit-kernel.