aureport: fix AVC result column always showing "unset" - #546
Open
Cropi wants to merge 1 commit into
Open
Conversation
In parse_avc(), two unrelated concerns were bundled under one guard:
if (event_success != S_UNSET && s->success == S_UNSET) {
an.avc_result = AVC_DENIED / AVC_GRANTED; /* concern 1 */
s->success = S_FAILED / S_SUCCESS; /* concern 2 */
}
The guard was correct for concern 2: only propagate the AVC verdict to
s->success when the caller is filtering by success/failure and s->success
hasn't been set yet (syscall pass/fail is authoritative).
However, it also gated concern 1: populating an.avc_result, which is the
field aureport -a prints in the "result" column. Without --success or
--failed on the command line, event_success == S_UNSET, so the block was
skipped entirely and an.avc_result stayed at its initial AVC_UNSET value.
aulookup_result(AVC_UNSET) returns "unset", making the result column
always show "unset" regardless of what the AVC record actually says.
Fix: unconditionally extract the verdict from the record into an.avc_result,
and move the event_success guard to cover only the s->success assignment.
Signed-off-by: Cropi <alakatos@redhat.com>
Contributor
|
I'm not seeing the problem. All of mine say denied. Is this only on allows? IOW, how do you reproduce this? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When running
aureport -awithout a--successor--failedfilter,the result column in the AVC report always shows "unset" instead of
"denied" or "granted", even though the raw audit record clearly contains
the verdict.
Root cause
In
parse_avc(), two unrelated things were done inside one guard:The guard exists to protect
s->success: only copy the AVC verdictinto the event's success field when the user is actively filtering by
success/failure, and only if it hasn't been set by a SYSCALL record yet
(syscall result is authoritative).
The problem is that
an.avc_result— the field aureport prints in theresult column — was also trapped inside that guard. Without a filter,
event_success == S_UNSET, so the whole block was skipped andan.avc_resultstayed at its initial value ofAVC_UNSET.aulookup_result(AVC_UNSET)returns the string"unset".Fix
Separate the two concerns. Always read the verdict from the record into
an.avc_result. Keep the guard only around thes->successassignment.