On Friday, December 22, 2017 4:02:41 PM EST Paul Moore wrote:
> On Fri, Dec 22, 2017 at 3:01 PM, Casey Schaufler <casey schaufler-ca com> wrote:
> > The audit rule field types AUDIT_SUBJ_* and AUDIT_OBJ_* are
> > defined generically and used by both SELinux and Smack to identify
> > fields that are interesting to them. If SELinux and Smack are running
> > concurrently both modules will identify audit rules as theirs if
> > either has requested the field. Before I go off and create a clever
> > solution I think it wise to ask if anyone has thought about or has
> > strong opinions on how best to address this unfortunate situation.
> > We know that SELinux and Smack together is not an especially
> > interesting configuration. It is, however, a grand test case for
> > generality of the solution. Any module that wanted to audit fields
> > that are defined generically will have this sort of problem.
> I think the biggest concern here is going to be what Steve's audit
> userspace will tolerate. I might suggest simply duplicating the
> fields for each LSM that is running, e.g. "subj=<selinux_label>
> subj=<smack_label> subj=<lsmX_label> ...", but I have no idea if
> Steve's userspace can handle multiple instances of the same field in a
> single record.
That would be bad in general because we have a field dictionary that defines the value side of the field=value. Another alternative might be to prepend an lsm specific abbreviation? This keeps the field dictionary correct.
I originally thought we were talking about AVC's and reusing the same record type for the different LSM's. That would be simple to fix by just adding a "lsm=x" field at the beginning.
But if we are talking about each and every syscall or path record, I think this will make things ugly fast. I'd prefer prepending an identifier to the field name so that we can do LSM specific reporting. I have never seen or heard of a system that has a subject or object with multiple labels. We don't even include supplemental groups in syscall records and that is usually pretty important information.
> My initial thinking is that adding LSM-specific subj/obj fields would
> be a mistake.
How so? If someone wanted a selinux specific report, how else would you detangle which representation is selinux's?