Re: Sycall Rules vs Watch Rules
Amjad Gabbar <[email protected]> Sat, 7 Oct 2023 23:46:30 -0500
| Newsgroups | com.redhat.linux-audit |
|---|---|
| Message-ID | <CAJcJf=QJYgrR_+PJekYTcUJ+Kk2wpcuH-LKFDTQ_0jj1k-EdNQ@mail.gmail.com> |
--===============8759640658854739157== Content-Type: multipart/alternative; boundary="000000000000e8ee4d06072d28e9" --000000000000e8ee4d06072d28e9 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Tested out all different combinations and performed performance experiments and tests using different permutations and combinations of rules. Can confirm the changes work as expected. 1. The old -w rule format is slower since it encompasses 'all' syscalls. A warning is emitted on using the -w notation that 'Old style watch rules are slower'. 2. On making use of the syscall format but without specifying the arch, a warning is emitted - 'perm used without an arch is slower`. The rules are similar to the old style -w watch rules encompassing 'all' syscalls and hampering performance significantly. 3. On specifying an arch with the syscall format, the respective syscalls are added based on the permissions field. Tested all different permissions to ensure that the respective syscalls are added. Works as expected and massively improves performance as well. Thanks for working together on this. Hopefully the end users are able to see the boost in performance post these changes. Regards Ali Adnan On Fri, Sep 29, 2023 at 11:39=E2=80=AFAM Amjad Gabbar <amjadgabbar11@gmail.= com> wrote: > Sounds good. I will test this out. > > Regards > Ali Adnan > > On Thu, Sep 28, 2023 at 11:30 AM Steve Grubb <[email protected]> wrote: > >> On Thursday, September 28, 2023 11:53:26 AM EDT Steve Grubb wrote: >> > On Thursday, September 21, 2023 4:02:49 PM EDT Amjad Gabbar wrote: >> > > > The best solution would be a kernel modification so that there are >> no >> > > > mismatched lists. >> > > >> > > I agree as well....This would be the cleanest solution. This would >> also >> > > solve the userspace problem of maintaining different lists which can >> get >> > > out of hand fairly quickly. >> > >> > After looking into this, a kernel patch would also not work well. It >> has to >> > be arch specific >> > >> > > > I guess we can warn on that to rewrite in syscall notation. >> > > >> > > We certainly should. I think the user should know that there is a >> > > performance cost associated with watches and we should explicitly >> mention >> > > how it can be optimized in the manpages also. The reason being I am >> > > pretty sure, numerous users/repos still do make use of the -w notati= on >> > > and we do want to let them know the issue here. We also need to make >> > > quite a few changes to the manpages also regarding this. Because, >> > > initially even I was very confused when reading the man pages and >> seeing >> > > the actual implementation of and results were not quite in sync. >> > >> > I have made the changes to the master and audit-3.1-maint branches. >> Please >> > everyone concerned give them tests. The short of it is that if you use >> the >> > '- w' notation for watches, it will remain the same and slower. >> >> Actually, ths is the one that draws the warning to urge people to migrat= e. >> >> > If you use >> > the syscall notation without "-F arch", you will get a warning that it >> > cannot be optimized without adding "-Farch". >> >> Actually, you won't in order to preserve intentional behavior. >> >> > If you add "-F arch", you >> > will possibly need one for both arches which means doubling the rules. >> If >> > you do not want to double the rules, you might place a syscall rule fo= r >> > any 32 system call (21-no32bit.rules). Or you can leave it as is and n= ot >> > care. The sample rules and all man pages have been updated. >> >> I should have provided an example of what this means. If you have this >> kind >> of rule: >> >> -w /etc/shadow -p wa -k shadow >> >> And when applied draws a warning: >> >> # auditctl -w /etc/shadow -p wa -k shadow >> Old style watch rules are slower >> >> It should be rewritten as >> >> -a always,exit -F arch=3Db64 -F path=3D/etc/shadow -F perm=3Dwa -F key= =3Dshadow >> >> Then it looks like this when loaded: >> >> #auditctl -l >> -a always,exit -F arch=3Db64 -S >> open,bind,truncate,ftruncate,rename,mkdir,rmdir,creat,link,unlink,symlin= k,chmod,fchmod,chown,fchown,lchown,mknod,acct,swapon,quotactl,setxattr,lset= xattr,fsetxattr,removexattr,lremovexattr,fremovexattr,openat,mkdirat,mknoda= t,fchownat,unlinkat,renameat,linkat,symlinkat,fchmodat,fallocate,renameat2,= openat2 >> -F path=3D/etc/shadow -F perm=3Dwa -F key=3Dshadow >> >> And to delete the rule, >> auditctl -d always,exit -F arch=3Db64 -F path=3D/etc/shadow -F perm=3Dwa= -F >> key=3Dshadow >> >> or the long way >> >> auditctl -d always,exit -F arch=3Db64 -S >> open,bind,truncate,ftruncate,rename,mkdir,rmdir,creat,link,unlink,symlin= k,chmod,fchmod,chown,fchown,lchown,mknod,acct,swapon,quotactl,setxattr,lset= xattr,fsetxattr,removexattr,lremovexattr,fremovexattr,openat,mkdirat,mknoda= t,fchownat,unlinkat,renameat,linkat,symlinkat,fchmodat,fallocate,renameat2,= openat2 >> -F path=3D/etc/shadow -F perm=3Dwa -F key=3Dshadow >> >> Hopefully this is clearer what the change is. >> >> -Steve >> >> >> >> --000000000000e8ee4d06072d28e9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Tested out all different combinations and performed perfor= mance experiments and tests using different permutations and combinations o= f rules.<br><br>Can confirm the changes work as expected.<br><br>1. The old= -w rule format is slower since it encompasses 'all' syscalls. A wa= rning is emitted on using the -w notation that 'Old style watch rules a= re slower'.<br><br>2. On making use of the syscall format but without s= pecifying the arch, a warning is emitted - 'perm used without an arch i= s slower`.<br>The rules are similar to the old style -w watch rules encompa= ssing 'all' syscalls and hampering performance significantly.<br><b= r>3. On specifying=C2=A0an arch with the syscall format, the respective sys= calls are added based on the permissions field. Tested all different permis= sions to ensure that the respective syscalls are added.<br>Works as expecte= d and massively improves performance as well.<br><br>Thanks for working tog= ether on this. Hopefully the end users are able to see the boost in perform= ance post these changes.<br><br>Regards=C2=A0<br>Ali Adnan</div><br><div cl= ass=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Fri, Sep 29, 2= 023 at 11:39=E2=80=AFAM Amjad Gabbar <<a href=3D"mailto:amjadgabbar11@gm= ail.com">[email protected]</a>> wrote:<br></div><blockquote class= =3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rg= b(204,204,204);padding-left:1ex"><div dir=3D"auto">Sounds good. I will test= this out.</div><div dir=3D"auto"><br></div><div dir=3D"auto">Regards</div>= <div dir=3D"auto">Ali Adnan</div><div><br><div class=3D"gmail_quote"><div d= ir=3D"ltr" class=3D"gmail_attr">On Thu, Sep 28, 2023 at 11:30 AM Steve Grub= b <<a href=3D"mailto:[email protected]" target=3D"_blank">sgrubb@redhat.= com</a>> wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"marg= in:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1e= x">On Thursday, September 28, 2023 11:53:26 AM EDT Steve Grubb wrote:<br> > On Thursday, September 21, 2023 4:02:49 PM EDT Amjad Gabbar wrote:<br> > > > The best solution would be a kernel modification so that the= re are no<br> > > > mismatched lists.<br> > > <br> > > I agree as well....This would be the cleanest solution. This woul= d also<br> > > solve the userspace problem of maintaining different lists which = can get<br> > > out of hand fairly quickly.<br> > <br> > After looking into this, a kernel patch would also not work well. It h= as to<br> > be arch specific<br> > <br> > > > I guess we can warn on that to rewrite in syscall notation.<= br> > > <br> > > We certainly should. I think the user should know that there is a= <br> > > performance cost associated with watches and we should explicitly= mention<br> > > how it can be optimized in the manpages also. The reason being I = am<br> > > pretty sure, numerous users/repos still do make use of the -w not= ation<br> > > and we do want to let them know the issue here. We also need to m= ake<br> > > quite a few changes to the manpages also regarding this. Because,= <br> > > initially even I was=C2=A0 very confused when reading the man pag= es and seeing<br> > > the actual implementation of and results were not quite in sync.<= br> > <br> > I have made the changes to the master and audit-3.1-maint branches. Pl= ease<br> > everyone concerned give them tests. The short of it is that if you use= the<br> > '- w' notation for watches, it will remain the same and slower= .<br> <br> Actually, ths is the one that draws the warning to urge people to migrate.<= br> <br> > If you use<br> > the syscall notation without "-F arch", you will get a warni= ng that it<br> > cannot be optimized without adding "-Farch".<br> <br> Actually, you won't in order to preserve intentional behavior.<br> <br> > If you add "-F arch", you<br> > will possibly need one for both arches which means doubling the rules.= If<br> > you do not want to double the rules, you might place a syscall rule fo= r<br> > any 32 system call (21-no32bit.rules). Or you can leave it as is and n= ot<br> > care. The sample rules and all man pages have been updated.<br> <br> I should have provided an example of what this means. If you have this kind= <br> of rule:<br> <br> -w /etc/shadow -p wa -k shadow<br> <br> And when applied draws a warning:<br> <br> # auditctl -w /etc/shadow -p wa -k shadow<br> Old style watch rules are slower<br> <br> It should be rewritten as<br> <br> -a always,exit -F arch=3Db64 -F path=3D/etc/shadow -F perm=3Dwa -F key=3Dsh= adow<br> <br> Then it looks like this when loaded:<br> <br> #auditctl -l<br> -a always,exit -F arch=3Db64 -S open,bind,truncate,ftruncate,rename,mkdir,r= mdir,creat,link,unlink,symlink,chmod,fchmod,chown,fchown,lchown,mknod,acct,= swapon,quotactl,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremo= vexattr,openat,mkdirat,mknodat,fchownat,unlinkat,renameat,linkat,symlinkat,= fchmodat,fallocate,renameat2,openat2 -F path=3D/etc/shadow -F perm=3Dwa -F = key=3Dshadow<br> <br> And to delete=C2=A0 the rule, <br> auditctl -d always,exit -F arch=3Db64 -F path=3D/etc/shadow -F perm=3Dwa -F= key=3Dshadow<br> <br> or the long way<br> <br> auditctl -d always,exit -F arch=3Db64 -S open,bind,truncate,ftruncate,renam= e,mkdir,rmdir,creat,link,unlink,symlink,chmod,fchmod,chown,fchown,lchown,mk= nod,acct,swapon,quotactl,setxattr,lsetxattr,fsetxattr,removexattr,lremovexa= ttr,fremovexattr,openat,mkdirat,mknodat,fchownat,unlinkat,renameat,linkat,s= ymlinkat,fchmodat,fallocate,renameat2,openat2 -F path=3D/etc/shadow -F perm= =3Dwa -F key=3Dshadow<br> <br> Hopefully this is clearer what the change is.<br> <br> -Steve<br> <br> <br> <br> </blockquote></div></div> </blockquote></div> --000000000000e8ee4d06072d28e9-- --===============8759640658854739157== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline -- Linux-audit mailing list [email protected] https://listman.redhat.com/mailman/listinfo/linux-audit --===============8759640658854739157==--