30969bc8e0
This patch adds further attributes to the event. These attributes are
helpful to understand the context of the message and can be used
to filter the events.
There are three common items. Source context, target context and tclass.
There are also items from the outcome of operation performed.
An event is similar to:
<...>-1309 [002] .... 6346.691689: selinux_audited:
requested=0x4000000 denied=0x4000000 audited=0x4000000
result=-13
scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023
tcontext=system_u:object_r:bin_t:s0 tclass=file
With systems where many denials are occurring, it is useful to apply a
filter. The filtering is a set of logic that is inserted with
the filter file. Example:
echo "tclass==\"file\" " > events/avc/selinux_audited/filter
This adds that we only get tclass=file.
The trace can also have extra properties. Adding the user stack
can be done with
echo 1 > options/userstacktrace
Now the output will be
runcon-1365 [003] .... 6960.955530: selinux_audited:
requested=0x4000000 denied=0x4000000 audited=0x4000000
result=-13
scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023
tcontext=system_u:object_r:bin_t:s0 tclass=file
runcon-1365 [003] .... 6960.955560: <user stack trace>
=> <00007f325b4ce45b>
=> <00005607093efa57>
Signed-off-by: Peter Enderborg <peter.enderborg@sony.com>
Reviewed-by: Thiébaud Weksteen <tweek@google.com>
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
54 lines
1.3 KiB
C
54 lines
1.3 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
/*
|
|
* Authors: Thiébaud Weksteen <tweek@google.com>
|
|
* Peter Enderborg <Peter.Enderborg@sony.com>
|
|
*/
|
|
#undef TRACE_SYSTEM
|
|
#define TRACE_SYSTEM avc
|
|
|
|
#if !defined(_TRACE_SELINUX_H) || defined(TRACE_HEADER_MULTI_READ)
|
|
#define _TRACE_SELINUX_H
|
|
|
|
#include <linux/tracepoint.h>
|
|
|
|
TRACE_EVENT(selinux_audited,
|
|
|
|
TP_PROTO(struct selinux_audit_data *sad,
|
|
char *scontext,
|
|
char *tcontext,
|
|
const char *tclass
|
|
),
|
|
|
|
TP_ARGS(sad, scontext, tcontext, tclass),
|
|
|
|
TP_STRUCT__entry(
|
|
__field(u32, requested)
|
|
__field(u32, denied)
|
|
__field(u32, audited)
|
|
__field(int, result)
|
|
__string(scontext, scontext)
|
|
__string(tcontext, tcontext)
|
|
__string(tclass, tclass)
|
|
),
|
|
|
|
TP_fast_assign(
|
|
__entry->requested = sad->requested;
|
|
__entry->denied = sad->denied;
|
|
__entry->audited = sad->audited;
|
|
__entry->result = sad->result;
|
|
__assign_str(tcontext, tcontext);
|
|
__assign_str(scontext, scontext);
|
|
__assign_str(tclass, tclass);
|
|
),
|
|
|
|
TP_printk("requested=0x%x denied=0x%x audited=0x%x result=%d scontext=%s tcontext=%s tclass=%s",
|
|
__entry->requested, __entry->denied, __entry->audited, __entry->result,
|
|
__get_str(scontext), __get_str(tcontext), __get_str(tclass)
|
|
)
|
|
);
|
|
|
|
#endif
|
|
|
|
/* This part must be outside protection */
|
|
#include <trace/define_trace.h>
|