Add a new audit-based table to collect SELinux events #4224

alessandrogario · 2018-03-27T20:18:34Z

This PR adds a new table called selinux_events that collects SELinux events using audit.

Here's how it looks:

osquery> SELECT * FROM selinux_events;
+------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------+--------+
| type | msg                                                                                                                                                                                                                             | time       | uptime |
+------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------+--------+
| AVC  | audit(1522338316.682:32): avc:  denied  { getattr } for  pid=12900 comm="httpd" path="/var/www/html/testfile" dev="dm-0" ino=37944206 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=file    | 1522338318 | 3697   |
| AVC  | audit(1522338316.682:33): avc:  denied  { getattr } for  pid=12900 comm="httpd" path="/var/www/html/testfile" dev="dm-0" ino=37944206 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=file    | 1522338318 | 3697   |
+------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------+--------+

Possible values for the type column:

USER_AVC
AVC
SELINUX_ERR
AVC_PATH
MAC_POLICY_LOAD
MAC_STATUS
MAC_CONFIG_CHANGE
MAC_UNLBL_ALLOW
MAC_CIPSOV4_ADD
MAC_CIPSOV4_DEL
MAC_MAP_ADD
MAC_MAP_DEL
MAC_IPSEC_ADDSA
MAC_IPSEC_DELSA
MAC_IPSEC_ADDSPD
MAC_IPSEC_DELSPD
MAC_IPSEC_EVENT
MAC_UNLBL_STCADD
MAC_UNLBL_STCDEL

How it works

The SELinux subsystem does not conform to the audit record syntax, meaning that the messages we receive can't be correctly parsed. To work around this issue, the data is stored and shown in raw format, similar to how it appears in the usual SELinux log files.

How to test it

As with the other audit-based tables, it is mandatory to enable audit, events and the required audit tables:

sudo ./build/linux/osquery/osqueryi --verbose --disable_audit=false \
--disable_events=false --audit_allow_config=true --audit_allow_selinux_events=true \
--audit_persist --audit_force_reconfigure=true --audit_force_unconfigure=true \
--disable_audit=false

facebook-github-bot · 2018-03-29T15:33:26Z

@alessandrogario has updated the pull request. View: changes

muffins · 2018-05-10T20:59:12Z

ok to test

theopolis · 2018-05-14T13:51:51Z

specs/linux/selinux_events.table

+description("Track SELinux events.")
+schema([
+    Column("type", TEXT, "Event type"),
+    Column("msg", TEXT, "Message"),


I will get back to a more-complete review later, but I don't want to forget things. I would recommend message as that is already used in asl and user_events. The msg shorthand is not used anywhere.

The field names are trying to match what is shown in the default (i.e. without osquery) auditd log so that (hopefully) the syntax is similar. I can rename it to "message" if you prefer!

EDIT:
This also applies to the "type" field.

Reference I used for the syntax: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sec-understanding_audit_log_files

Ah, my vote is still for message please :)

theopolis · 2018-05-14T13:51:51Z

specs/linux/selinux_events.table

+table_name("selinux_events")
+description("Track SELinux events.")
+schema([
+    Column("type", TEXT, "Event type"),


note, in user_events this is an Integer.

I have renamed msg to message, but for the type column I'm using text labels; would you like me to change this? I could move the label to another column (like type_name) and change type back to integer

facebook-github-bot · 2018-05-16T11:12:05Z

@alessandrogario has updated the pull request.

theopolis · 2018-05-17T02:37:26Z

osquery/tables/events/linux/selinux_events.cpp

+// clang-format off
+// This map must contain exactly the same elements that
+// SELinuxEventSubscriber::GetEventSet() returns!
+const std::map<int, std::string> record_type_to_label = {


This should be named kSELinuxRecordLabels or something similar.

theopolis · 2018-05-17T02:37:26Z

osquery/tables/events/linux/selinux_events.cpp

+  // - USER_MAC_POLICY_LOAD
+  // - USER_ROLE_CHANGE
+  // - USER_LABEL_EXPORT
+  static const std::set<int> selinux_event_list = {


This is weird, too many statics. I would define this const set somewhere outside of the class. Similar to the record-label lookup.

If there's a requirement to have each of these in the label map above, please include a test!

theopolis · 2018-05-17T02:37:26Z

specs/linux/selinux_events.table

+description("Track SELinux events.")
+schema([
+    Column("type", TEXT, "Event type"),
+    Column("msg", TEXT, "Message"),


Ah, my vote is still for message please :)

facebook-github-bot · 2018-05-17T10:17:08Z

@alessandrogario has updated the pull request. View: changes

osqueryer · 2018-05-17T10:21:06Z

👎 The commit e005708 (Job results: 3160) failed one or more tests (macOS/OS X).

osqueryer · 2018-05-17T10:25:14Z

👎 The commit e005708 (Job results: 3161) failed one or more tests (macOS/OS X).

osqueryer · 2018-05-17T10:27:09Z

👎 The commit e005708 (Job results: 4073) failed one or more tests (Windows).

osqueryer · 2018-05-17T10:39:33Z

👎 The commit e005708 (Job results: 4074) failed one or more tests (Windows).

facebook-github-bot · 2018-05-17T10:44:45Z

@alessandrogario has updated the pull request.

theopolis · 2018-05-17T21:52:44Z

Does this change include any performance impact to machines configured to do process and socket auditing?

Although there's already a windows-only 3.4[1], the latest release for Unix systems is 3.3.2[2] with the following changes: * SELinux event recording[3] * SMART drive information[4] * ELF parsing to monitor compiler-level protections for binaries[5] The diff became rather big in the end due to the following changes: * The SMART information feature uses a custom fork of smartmontools to retrieve SMART data programatically[6]. * Replaced the old, bloated `misc.patch` by a simpler patch that only fixes two (actual) issues in the CMake build, unnecessary link targets and an invalid compiler flag. * I tried to clean the derivation's code up a little bit by simplifying the `preConfigure` hook and adding only one build-input per line (that makes merging of several changes to the derivation easier as well). [1] https://github.com/facebook/osquery/releases/tag/3.4.0 [2] https://github.com/facebook/osquery/releases/tag/3.3.2 [3] osquery/osquery#4224 [4] osquery/osquery#4133 [5] osquery/osquery#4708 [6] https://github.com/allanliu/smartmontools

facebook-github-bot added the cla signed label Mar 27, 2018

alessandrogario changed the title ~~WIP: Add a new audit-based table to collect SELinux events~~ Add a new audit-based table to collect SELinux events Mar 29, 2018

muffins added Linux events labels May 10, 2018

muffins added this to the 3.3.0 milestone May 10, 2018

theopolis reviewed May 14, 2018

View changes

theopolis requested changes May 17, 2018

View changes

alessandrogario added 2 commits Mar 27, 2018

Add a new audit-based table to collect SELinux events

c03c5de

SELinux: Renamed the 'record' column to 'msg'. Add 'type' column.

737b92a

Code review changes

Loading status checks…

c0b7d4d

theopolis approved these changes May 17, 2018

View changes

theopolis merged commit 9497df6 into osquery:master Jul 8, 2018
5 checks passed

5 checks passed

Code Audit Build finished.
Details

FreeBSD Build finished.
Details

Linux Build finished.
Details

Windows Build finished.
Details

macOS/OS X Build finished.
Details

alessandrogario deleted the alessandro/feature/selinux-audit-event-support branch Jul 9, 2018

trizt added a commit to trizt/osquery that referenced this pull request May 24, 2019

Add a new audit-based table to collect SELinux events (osquery#4224)

f32dd84

Smjert mentioned this pull request Dec 28, 2019

Add an selinux_events table #3740

Closed

osquery / osquery

Add a new audit-based table to collect SELinux events #4224

Add a new audit-based table to collect SELinux events #4224

alessandrogario commented Mar 27, 2018 •

edited

facebook-github-bot commented Mar 29, 2018

muffins commented May 10, 2018

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

facebook-github-bot commented May 16, 2018

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

facebook-github-bot commented May 17, 2018

osqueryer commented May 17, 2018

osqueryer commented May 17, 2018

osqueryer commented May 17, 2018

osqueryer commented May 17, 2018

facebook-github-bot commented May 17, 2018

theopolis commented May 17, 2018

osquery / osquery

Join GitHub today

Add a new audit-based table to collect SELinux events #4224

Add a new audit-based table to collect SELinux events #4224

Conversation

alessandrogario commented Mar 27, 2018 • edited

How it works

How to test it

facebook-github-bot commented Mar 29, 2018

muffins commented May 10, 2018

This comment has been minimized.

theopolis May 14, 2018 Member

This comment has been minimized.

alessandrogario May 14, 2018 • edited Author Contributor

This comment has been minimized.

theopolis May 17, 2018 Member

This comment has been minimized.

theopolis May 14, 2018 Member

This comment has been minimized.

alessandrogario May 17, 2018 Author Contributor

facebook-github-bot commented May 16, 2018

This comment has been minimized.

theopolis May 17, 2018 Member

This comment has been minimized.

theopolis May 17, 2018 Member

This comment has been minimized.

theopolis May 17, 2018 Member

This comment has been minimized.

theopolis May 17, 2018 Member

facebook-github-bot commented May 17, 2018

osqueryer commented May 17, 2018

osqueryer commented May 17, 2018

osqueryer commented May 17, 2018

osqueryer commented May 17, 2018

facebook-github-bot commented May 17, 2018

theopolis commented May 17, 2018

Essential cookies

Always active

Analytics cookies

alessandrogario commented Mar 27, 2018 •

edited

theopolis May 14, 2018
Member

alessandrogario May 14, 2018 •

edited

Author Contributor

theopolis May 17, 2018
Member

theopolis May 14, 2018
Member

alessandrogario May 17, 2018
Author Contributor

theopolis May 17, 2018
Member

theopolis May 17, 2018
Member

theopolis May 17, 2018
Member

theopolis May 17, 2018
Member