Re: [PATCH] audit: add CLONE3 auxiliary record to log process cloning

On Tuesday, July 28, 2026 12:31:02=E2=80=AFPM Eastern Daylight Time Richard=
 Guy=20
Briggs wrote:
> On 2026-07-24 12:02, Ricardo Robaina wrote:
> > The clone3(2) syscall moves most parameters to struct clone_args.
> > For this reason, the generic SYSCALL audit record does not capture
> > the structured arguments.
> >=20
> > Add a CLONE3 auxiliary record that logs: flags, exit_signal, cgroup,
> > and pidfd fields from struct clone_args. When CLONE_PIDFD is set and
> > the syscall succeeds, the resolved pidfd is logged; otherwise
> > pidfd=3D(null).
> >=20
> >  ----
> >  type=3DSYSCALL : syscall=3Dclone3 a0=3D0x7ffe7f1ec640 a1=3D0x58 a2=3D0=
x0 ...
> >  type=3DCLONE3 : cl3_flags=3D0x1000 exit_signal=3D17 cgroup=3D0 pidfd=
=3D3
> >=20
> > Link: https://github.com/linux-audit/audit-kernel/issues/151
> > Signed-off-by: Ricardo Robaina <[email protected]>
> > ---
> >=20
> >  include/linux/audit.h      | 10 ++++++++++
> >  include/uapi/linux/audit.h |  1 +
> >  kernel/auditsc.c           | 20 ++++++++++++++++++++
> >  kernel/fork.c              |  4 +++-
> >  4 files changed, 34 insertions(+), 1 deletion(-)
> >=20
> > diff --git a/include/linux/audit.h b/include/linux/audit.h
> > index 45abb3722d30..833f349bf415 100644
> > --- a/include/linux/audit.h
> > +++ b/include/linux/audit.h
> > @@ -449,6 +449,7 @@ extern void __audit_tk_injoffset(struct timespec64
> > offset);>=20
> >  extern void __audit_ntp_log(const struct audit_ntp_data *ad);
> >  extern void __audit_log_nfcfg(const char *name, u8 af, unsigned int
> >  nentries,> =20
> >  =09=09=09      enum audit_nfcfgop op, gfp_t gfp);
> >=20
> > +extern void __audit_log_clone3(struct kernel_clone_args *kargs, int
> > ret);
> >=20
> >  static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
> >  {
> >=20
> > @@ -598,6 +599,12 @@ static inline void audit_log_nfcfg(const char *nam=
e,
> > u8 af,>=20
> >  =09=09__audit_log_nfcfg(name, af, nentries, op, gfp);
> > =20
> >  }
> >=20
> > +static inline void audit_log_clone3(struct kernel_clone_args *kargs, i=
nt
> > ret) +{
> > +=09if (!audit_dummy_context())
> > +=09=09__audit_log_clone3(kargs, ret);
> > +}
> > +
> >=20
> >  extern int audit_n_rules;
> >  extern int audit_signals;
> >  #else /* CONFIG_AUDITSYSCALL */
> >=20
> > @@ -730,6 +737,9 @@ static inline void audit_log_nfcfg(const char *name=
,
> > u8 af,>=20
> >  =09=09=09=09   enum audit_nfcfgop op, gfp_t gfp)
> > =20
> >  { }
> >=20
> > +static inline void audit_log_clone3(struct kernel_clone_args *kargs, i=
nt
> > ret) +{ }
> > +
> >=20
> >  #define audit_n_rules 0
> >  #define audit_signals 0
> >  #endif /* CONFIG_AUDITSYSCALL */
> >=20
> > diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
> > index e8f5ce677df7..37357e17adbf 100644
> > --- a/include/uapi/linux/audit.h
> > +++ b/include/uapi/linux/audit.h
> > @@ -122,6 +122,7 @@
> >=20
> >  #define AUDIT_OPENAT2=09=091337=09/* Record showing openat2 how args=
=20
*/
> >  #define AUDIT_DM_CTRL=09=091338=09/* Device Mapper target control */
> >  #define AUDIT_DM_EVENT=09=091339=09/* Device Mapper events */
> >=20
> > +#define AUDIT_CLONE3=09=091343=09/* Record showing clone3 args */
> >=20
> >  #define AUDIT_AVC=09=091400=09/* SE Linux avc denial or grant */
> >  #define AUDIT_SELINUX_ERR=091401=09/* Internal SE Linux Errors */
> >=20
> > diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> > index 6610e667c728..c0106bb71c19 100644
> > --- a/kernel/auditsc.c
> > +++ b/kernel/auditsc.c
> > @@ -2882,6 +2882,26 @@ void __audit_log_nfcfg(const char *name, u8 af,
> > unsigned int nentries,>=20
> >  }
> >  EXPORT_SYMBOL_GPL(__audit_log_nfcfg);
> >=20
> > +void __audit_log_clone3(struct kernel_clone_args *kargs, int ret)
> > +{
> > +=09struct audit_buffer *ab;
> > +=09int pidfd;
> > +
> > +=09ab =3D audit_log_start(audit_context(), GFP_KERNEL,
> > +=09=09=09     AUDIT_CLONE3);
> > +=09if (!ab)
> > +=09=09return;
> > +
> > +=09audit_log_format(ab, "cl3_flags=3D0x%llx exit_signal=3D%d cgroup=3D=
%d",
> > +=09=09=09 kargs->flags, kargs->exit_signal, kargs->cgroup);
>=20
> Would there be any confusion if this were simply "flags=3D..." since it i=
s
> already a record type AUDIT_CLONE3?

flags is already used in mmap records and will require workarounds to have=
=20
the same field name here. Separating them by name is better.

> > +=09if ((kargs->flags & CLONE_PIDFD) && ret >=3D 0 &&
> > +=09    !get_user(pidfd, kargs->pidfd))
> > +=09=09audit_log_format(ab, " pidfd=3D%d", pidfd);
> > +=09else
> > +=09=09audit_log_format(ab, " pidfd=3D(null)");
>=20
> Is there any interest in:
> =09child_tid (was captured by generic audit syscall arg 4)
> =09parent_tid (was captured by generic audit syscall arg 3 or 4)
> =09tls (was captured by generic audit syscall arg 4)
> =09set_tid

Nope. Those are more resource related and not security focused. Even if you=
=20
wanted it, these are pointers to the answer and not the answer. The patch h=
as=20
everything needed from a security PoV.

Ack.

> Is there a situation where a valid pid is returned without CLONE_PIDFD se=
t?

No idea. The man page makes it sound like it is only valid when CLONE_PIDFD=
.=20
Besides, its a pointer to an int from what the man page said.

-Steve

> Otherwise, looks reasonable to me.
>=20
> > +=09audit_log_end(ab);
> > +}
> > +
> >=20
> >  static void audit_log_task(struct audit_buffer *ab)
> >  {
> > =20
> >  =09kuid_t auid, uid;
> >=20
> > diff --git a/kernel/fork.c b/kernel/fork.c
> > index f0e2e131a9a5..0f52e8c0e900 100644
> > --- a/kernel/fork.c
> > +++ b/kernel/fork.c
> > @@ -3047,7 +3047,9 @@ SYSCALL_DEFINE2(clone3, struct clone_args __user =
*,
> > uargs, size_t, size)>=20
> >  =09if (!clone3_args_valid(&kargs))
> >  =09
> >  =09=09return -EINVAL;
> >=20
> > -=09return kernel_clone(&kargs);
> > +=09err =3D kernel_clone(&kargs);
> > +=09audit_log_clone3(&kargs, err);
> > +=09return err;
> >=20
> >  }
> > =20
> >  void walk_process_tree(struct task_struct *top, proc_visitor visitor,
> >  void *data)
> - RGB
>=20
> --
> Richard Guy Briggs <[email protected]>
> Sr. S/W Engineer, Kernel Security, Base Operating Systems
> Remote, Ottawa, Red Hat Canada
> Upstream IRC: SunRaycer
> Voice: +1.613.860 2354 SMS: +1.613.518.6570