• Paul Moore's avatar
    audit,io_uring,io-wq: add some basic audit support to io_uring · 5bd2182d
    Paul Moore authored
    This patch adds basic auditing to io_uring operations, regardless of
    their context.  This is accomplished by allocating audit_context
    structures for the io-wq worker and io_uring SQPOLL kernel threads
    as well as explicitly auditing the io_uring operations in
    io_issue_sqe().  Individual io_uring operations can bypass auditing
    through the "audit_skip" field in the struct io_op_def definition for
    the operation; although great care must be taken so that security
    relevant io_uring operations do not bypass auditing; please contact
    the audit mailing list (see the MAINTAINERS file) with any questions.
    
    The io_uring operations are audited using a new AUDIT_URINGOP record,
    an example is shown below:
    
      type=UNKNOWN[1336] msg=audit(1631800225.981:37289):
        uring_op=19 success=yes exit=0 items=0 ppid=15454 pid=15681
        uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
        subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
        key=(null)
    
    Thanks to Richard Guy Briggs for review and feedback.
    Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
    5bd2182d
io-wq.c 31 KB