Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[WIP] apparmor_events table in osquery #4982

Merged
merged 6 commits into from
Aug 30, 2020
Merged

[WIP] apparmor_events table in osquery #4982

merged 6 commits into from
Aug 30, 2020

Conversation

luc-lynx
Copy link
Contributor

Changes description:

This PR adds a new apparmor_events table that contains events from AppArmor which is a Mandatory Access Control System. AppArmor is considered to be more user friendly and easy to audit though it's not as feature-rich as SELinux.

Motivation for the PR:

  • All the events from Linux Security Modules are logged into selinux_events table so the table gets messy
  • There's no way to filter out AppArmor events in selinux_events table the table contains raw messages that aren't parsed and tokenised. There's no way to run queries on AppArmor events.
  • If OSQUERY events monitoring is in use it opens Audit's netlink socket. AppArmor during its work reports events using Linux's Audit system, so the only way to get logs from AppArmor in this case is to get them from selinux_events table.
  • I wanted to separate AppArmor events from other LSM events in OSQUERY

Technical details:

  • I filter out AppArmor events by looking for records containing apparmor= substring as it's always added to AppArmor messages
  • The whole audit message from AppArmor is also written into message column in apparmor_events column
  • AppAprmor messages don't go to selinux_event table anymore

@facebook-github-bot
Copy link

Thank you for your pull request and welcome to our community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. In order for us to review and merge your code, please sign up at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need the corporate CLA signed.

If you have received this in error or have any questions, please contact us at cla@fb.com. Thanks!

@luc-lynx
Copy link
Contributor Author

I accepted the CLA

@facebook-github-bot facebook-github-bot added the cla signed Automated label: Pull Request author has signed the osquery CLA label Aug 17, 2018
@facebook-github-bot
Copy link

Thank you for signing our Contributor License Agreement. We can now accept your code for this (and any) Facebook open source project. Thanks!

@muffins muffins added Linux events Related to osquery's evented tables or eventing subsystem virtual tables labels Aug 17, 2018
@muffins
Copy link
Contributor

muffins commented Aug 17, 2018

ok to test

@guliashvili
Copy link
Contributor

You can run make format_master to fix code audit. Failing FreeBSD should be our problem

@luc-lynx
Copy link
Contributor Author

Sorry for that, I'd run make format before submitting the PR but it seems I should have used make format_master.

Should I merge two commits in one?

@guliashvili
Copy link
Contributor

Feel free to push as many commits as you want to. While merging they will be squashed into the single commit

@guliashvili
Copy link
Contributor

ok to test

@guliashvili
Copy link
Contributor

To pass FreeBSD rebase is needed on new master

@luc-lynx
Copy link
Contributor Author

Did rebase

@luc-lynx
Copy link
Contributor Author

Any chance to have it reviewed?

Copy link
Contributor

@muffins muffins left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A couple of notes/questions, largely nits. Overall looks pretty strait forward to me, I'd be curious if someone with a bit more experience with SELinux/AppArmor could take a look, as my knowledge of these things is limited.

osquery/events/linux/auditeventpublisher.cpp Outdated Show resolved Hide resolved
std::string apparmor_status;
if (!GetStringFieldFromMap(
apparmor_status, audit_event_record.fields, "apparmor")) {
VLOG(1) << "Malformed AUDIT_APPARMOR record received. The "
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: Try to keep status logging such as this to one sentence to fit on one line of text, perhaps something to the effect of VLOG(1) << "AUDIT_APPARMOR record did not contain apparmor field."; or the like?

osquery/events/linux/auditeventpublisher.cpp Outdated Show resolved Hide resolved
}

Status AppArmorEventSubscriber::Callback(const ECRef& ec, const SCRef& sc) {
std::vector<Row> emitted_row_list;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A QueryData is precisely this, let's just use that instead.

osquery/tables/events/linux/apparmor_events.cpp Outdated Show resolved Hide resolved
specs/linux/apparmor_events.table Outdated Show resolved Hide resolved
specs/linux/apparmor_events.table Show resolved Hide resolved
specs/linux/apparmor_events.table Outdated Show resolved Hide resolved
specs/linux/apparmor_events.table Outdated Show resolved Hide resolved
osquery/events/linux/auditeventpublisher.cpp Outdated Show resolved Hide resolved
Copy link
Contributor

@obelisk obelisk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mostly nits but I'm also concerned about the casing in this file and it seems it was started by @alessandrogario .

@alessandrogario is there a reason for this? A convention for audit I'm missing or something of that nature?

osquery/events/linux/auditdnetlink.cpp Show resolved Hide resolved
osquery/events/linux/auditdnetlink.cpp Outdated Show resolved Hide resolved
osquery/tables/events/linux/apparmor_events.cpp Outdated Show resolved Hide resolved
osquery/tables/events/linux/apparmor_events.cpp Outdated Show resolved Hide resolved
osquery/tables/events/linux/apparmor_events.cpp Outdated Show resolved Hide resolved
osquery/tables/events/linux/apparmor_events.cpp Outdated Show resolved Hide resolved
osquery/tables/events/linux/apparmor_events.cpp Outdated Show resolved Hide resolved
osquery/tables/events/linux/apparmor_events.cpp Outdated Show resolved Hide resolved
@alessandrogario alessandrogario changed the title AppArmor table in osquery apparmor_events table in osquery Jan 2, 2020
@linux-foundation-easycla
Copy link

linux-foundation-easycla bot commented Jul 27, 2020

CLA Check
The committers are authorized under a signed CLA.

@theopolis theopolis dismissed stale reviews from obelisk and muffins July 27, 2020 03:29

outdated

@theopolis
Copy link
Member

Hi @luc-lynx, I really like the idea of having this table in osquery. I rebased this table onto our current master to help get this going again. There's work that still remains, for example reviewing our new CLA, adding the new files to our CMake build, and iterating on a few more code reviews. I am happy to help along the way, let me know if you have time.

@luc-lynx
Copy link
Contributor Author

Thanks for your message. I'll definitely find time to carry on work on the PR.

@luc-lynx
Copy link
Contributor Author

luc-lynx commented Aug 3, 2020

Just a little update that I've started to work on that and will get back with some updates shortly.

@theopolis
Copy link
Member

The Linux jobs fail due to required code-format changes, run: make format_check to see what changes you need to apply.

@luc-lynx
Copy link
Contributor Author

luc-lynx commented Aug 4, 2020

@theopolis Yes, I'm trying to run it but I'm getting a huge bunch of complains about the code I didn't touch... Do you happen to know how it can be scoped only to my changeset?

@luc-lynx luc-lynx changed the title apparmor_events table in osquery [WIP]apparmor_events table in osquery Aug 4, 2020
@luc-lynx luc-lynx changed the title [WIP]apparmor_events table in osquery [WIP] apparmor_events table in osquery Aug 4, 2020
@Smjert
Copy link
Member

Smjert commented Aug 4, 2020

@luc-lynx
It's possible to have clang-format itself to format the code, but you need to to have it in the git stage.
Normally you have to format before commiting, if you've already committed then you need to go on every commit you have, put it temporarily in the stage, format it, add the changes (if any) in stage and commit it again.

So this process would be:

git rebase -i <oldest commit of your PR>~1
// mark all commits to be edited, then proceed
git reset --soft HEAD~1 // Removed the commit but keeps the changes in the stage
// now from the build folder
cmake --build . --target format
// if there are changes, back in the source folder
git add <changed files>
// otherwise jump directly here
git commit -C ORIG_HEAD
git rebase --continue
// repeat, back to the git reset

As you can see formatting after the fact is a bit more annoying.
In your case it might be worth to squash all the commits you have now into one, so that you just need to put that into stage, without having to do a rebase, and format it.

@luc-lynx
Copy link
Contributor Author

luc-lynx commented Aug 6, 2020

@theopolis could you please review the PR?

Copy link
Member

@theopolis theopolis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Heads up @alessandrogario.

osquery/events/linux/auditdnetlink.cpp Show resolved Hide resolved
osquery/events/linux/auditeventpublisher.cpp Show resolved Hide resolved
osquery/events/linux/auditeventpublisher.cpp Show resolved Hide resolved
@luc-lynx
Copy link
Contributor Author

Thanks for the review, I'll get back with the updates in a week.

@luc-lynx
Copy link
Contributor Author

@theopolis could you please take a look at my comments in the review?

theopolis
theopolis previously approved these changes Aug 29, 2020
Copy link
Member

@theopolis theopolis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If builds pass this LGTM

@luc-lynx
Copy link
Contributor Author

If builds pass this LGTM

I've fixed imports and spec (turned out it was also missing). Should be fine now.

@theopolis theopolis merged commit c799afb into osquery:master Aug 30, 2020
@luc-lynx luc-lynx deleted the apparmor3 branch August 30, 2020 18:06
nabilschear pushed a commit to nabilschear/osquery that referenced this pull request Aug 31, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
cla signed Automated label: Pull Request author has signed the osquery CLA events Related to osquery's evented tables or eventing subsystem Linux virtual tables
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

8 participants