From owner-dev-commits-src-main@freebsd.org Tue Feb 23 17:59:23 2021 Return-Path: Delivered-To: dev-commits-src-main@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 4D5CC54C3A6; Tue, 23 Feb 2021 17:59:23 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4DlRdR1n68z3tK1; Tue, 23 Feb 2021 17:59:23 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 2FFBC1DC55; Tue, 23 Feb 2021 17:59:23 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 11NHxN77035549; Tue, 23 Feb 2021 17:59:23 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 11NHxN7b035548; Tue, 23 Feb 2021 17:59:23 GMT (envelope-from git) Date: Tue, 23 Feb 2021 17:59:23 GMT Message-Id: <202102231759.11NHxN7b035548@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Alex Richardson Subject: git: fa32350347b4 - main - close_range: add audit support MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: arichardson X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: fa32350347b4e351a144b5423f0fb2ca9d67f4ca Auto-Submitted: auto-generated X-BeenThere: dev-commits-src-main@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Commit messages for the main branch of the src repository List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Feb 2021 17:59:23 -0000 The branch main has been updated by arichardson: URL: https://cgit.FreeBSD.org/src/commit/?id=fa32350347b4e351a144b5423f0fb2ca9d67f4ca commit fa32350347b4e351a144b5423f0fb2ca9d67f4ca Author: Alex Richardson AuthorDate: 2021-02-23 17:47:07 +0000 Commit: Alex Richardson CommitDate: 2021-02-23 17:47:07 +0000 close_range: add audit support This fixes the closefrom test in sys/audit. Includes cherry-picks of the following commits from openbsm: https://github.com/openbsm/openbsm/commit/4dfc628aafe589d68848f7033f3d3488c4d979e0 https://github.com/openbsm/openbsm/commit/99ff6fe32aebc5a4b8d40d60062b8574697df557 https://github.com/openbsm/openbsm/commit/da48a0399e95448693d3fa2be48454ca564c1be8 Reviewed By: kevans Differential Revision: https://reviews.freebsd.org/D28388 --- contrib/openbsm/etc/audit_event | 2 ++ contrib/openbsm/sys/bsm/audit_kevents.h | 2 ++ sys/kern/kern_descrip.c | 4 ++++ sys/security/audit/audit_bsm.c | 15 +++++++++++++++ tests/sys/audit/file-close.c | 4 ++-- 5 files changed, 25 insertions(+), 2 deletions(-) diff --git a/contrib/openbsm/etc/audit_event b/contrib/openbsm/etc/audit_event index b397674564c6..be3557597eee 100644 --- a/contrib/openbsm/etc/audit_event +++ b/contrib/openbsm/etc/audit_event @@ -614,6 +614,8 @@ 43261:AUE_LGETUUID:lgetuuid(2):ip 43262:AUE_EXECVEAT:execveat(2):pc,ex 43263:AUE_SHMRENAME:shm_rename(2):ip +43264:AUE_REALPATHAT:realpathat(2):fa +43265:AUE_CLOSERANGE:close_range(2):cl # # Solaris userspace events. # diff --git a/contrib/openbsm/sys/bsm/audit_kevents.h b/contrib/openbsm/sys/bsm/audit_kevents.h index afa8c0f37a31..ec51f501e3a7 100644 --- a/contrib/openbsm/sys/bsm/audit_kevents.h +++ b/contrib/openbsm/sys/bsm/audit_kevents.h @@ -653,6 +653,8 @@ #define AUE_LGETUUID 43261 /* CADETS. */ #define AUE_EXECVEAT 43262 /* FreeBSD/Linux. */ #define AUE_SHMRENAME 43263 /* FreeBSD-specific. */ +#define AUE_REALPATHAT 43264 /* FreeBSD-specific. */ +#define AUE_CLOSERANGE 43265 /* FreeBSD-specific. */ /* * Darwin BSM uses a number of AUE_O_* definitions, which are aliased to the diff --git a/sys/kern/kern_descrip.c b/sys/kern/kern_descrip.c index 0813b6c8f3b8..67350f4ad71e 100644 --- a/sys/kern/kern_descrip.c +++ b/sys/kern/kern_descrip.c @@ -1422,6 +1422,10 @@ int sys_close_range(struct thread *td, struct close_range_args *uap) { + AUDIT_ARG_FD(uap->lowfd); + AUDIT_ARG_CMD(uap->highfd); + AUDIT_ARG_FFLAGS(uap->flags); + /* No flags currently defined */ if (uap->flags != 0) return (EINVAL); diff --git a/sys/security/audit/audit_bsm.c b/sys/security/audit/audit_bsm.c index 6742470c9578..d350ef3cf3c2 100644 --- a/sys/security/audit/audit_bsm.c +++ b/sys/security/audit/audit_bsm.c @@ -941,6 +941,21 @@ kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau) } break; + case AUE_CLOSERANGE: + if (ARG_IS_VALID(kar, ARG_FD)) { + tok = au_to_arg32(1, "lowfd", ar->ar_arg_fd); + kau_write(rec, tok); + } + if (ARG_IS_VALID(kar, ARG_CMD)) { + tok = au_to_arg32(2, "highfd", ar->ar_arg_cmd); + kau_write(rec, tok); + } + if (ARG_IS_VALID(kar, ARG_FFLAGS)) { + tok = au_to_arg32(3, "flags", ar->ar_arg_fflags); + kau_write(rec, tok); + } + break; + case AUE_CORE: if (ARG_IS_VALID(kar, ARG_SIGNUM)) { tok = au_to_arg32(1, "signal", ar->ar_arg_signum); diff --git a/tests/sys/audit/file-close.c b/tests/sys/audit/file-close.c index 54d0e60977e3..f85a8e39b67d 100644 --- a/tests/sys/audit/file-close.c +++ b/tests/sys/audit/file-close.c @@ -154,10 +154,10 @@ ATF_TC_HEAD(closefrom_success, tc) ATF_TC_BODY(closefrom_success, tc) { - const char *regex = "closefrom.*return,success"; + const char *regex = "close_range\\(2\\),.*,0x7fffffff,lowfd,.*" + "0xffffffff,highfd,.*return,success"; FILE *pipefd = setup(fds, auclass); - atf_tc_expect_fail("closefrom was converted to close_range"); /* closefrom(2) returns 'void' */ closefrom(INT_MAX); check_audit(fds, regex, pipefd);