ntp: Audit NTP parameters adjustment

Emit an audit record every time selected NTP parameters are modified
from userspace (via adjtimex(2) or clock_adjtime(2)). These parameters
may be used to indirectly change system clock, and thus their
modifications should be audited.

Such events will now generate records of type AUDIT_TIME_ADJNTPVAL
containing the following fields:
  - op -- which value was adjusted:
    - offset -- corresponding to the time_offset variable
    - freq   -- corresponding to the time_freq variable
    - status -- corresponding to the time_status variable
    - adjust -- corresponding to the time_adjust variable
    - tick   -- corresponding to the tick_usec variable
    - tai    -- corresponding to the timekeeping's TAI offset
  - old -- the old value
  - new -- the new value

Example records:

type=TIME_ADJNTPVAL msg=audit(1530616044.507:7): op=status old=64 new=8256
type=TIME_ADJNTPVAL msg=audit(1530616044.511:11): op=freq old=0 new=49180377088000

The records of this type will be associated with the corresponding
syscall records.

An overview of parameter changes that can be done via do_adjtimex()
(based on information from Miroslav Lichvar) and whether they are
audited:
  __timekeeping_set_tai_offset() -- sets the offset from the
                                    International Atomic Time
                                    (AUDITED)
  NTP variables:
    time_offset -- can adjust the clock by up to 0.5 seconds per call
                   and also speed it up or slow down by up to about
                   0.05% (43 seconds per day) (AUDITED)
    time_freq -- can speed up or slow down by up to about 0.05%
                 (AUDITED)
    time_status -- can insert/delete leap seconds and it also enables/
                   disables synchronization of the hardware real-time
                   clock (AUDITED)
    time_maxerror, time_esterror -- change error estimates used to
                                    inform userspace applications
                                    (NOT AUDITED)
    time_constant -- controls the speed of the clock adjustments that
                     are made when time_offset is set (NOT AUDITED)
    time_adjust -- can temporarily speed up or slow down the clock by up
                   to 0.05% (AUDITED)
    tick_usec -- a more extreme version of time_freq; can speed up or
                 slow down the clock by up to 10% (AUDITED)

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Paul Moore <paul@paul-moore.com>

1 files changed, 19 insertions, 3 deletions

diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
index 92a90014a925..ac5555e25733 100644
--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -17,6 +17,7 @@
 #include <linux/mm.h>
 #include <linux/module.h>
 #include <linux/rtc.h>
+#include <linux/audit.h>
 
 #include "ntp_internal.h"
 #include "timekeeping_internal.h"
@@ -709,7 +710,7 @@ static inline void process_adjtimex_modes(const struct __kernel_timex *txc,
  * kernel time-keeping variables. used by xntpd.
  */
 int __do_adjtimex(struct __kernel_timex *txc, const struct timespec64 *ts,
-                  s32 *time_tai)
+                  s32 *time_tai, struct audit_ntp_data *ad)
 {
         int result;
 
@@ -720,14 +721,29 @@ int __do_adjtimex(struct __kernel_timex *txc, const struct timespec64 *ts,
                         /* adjtime() is independent from ntp_adjtime() */
                         time_adjust = txc->offset;
                         ntp_update_frequency();
+
+                        audit_ntp_set_old(ad, AUDIT_NTP_ADJUST, save_adjust);
+                        audit_ntp_set_new(ad, AUDIT_NTP_ADJUST, time_adjust);
                 }
                 txc->offset = save_adjust;
         } else {
-
                 /* If there are input parameters, then process them: */
-                if (txc->modes)
+                if (txc->modes) {
+                        audit_ntp_set_old(ad, AUDIT_NTP_OFFSET, time_offset);
+                        audit_ntp_set_old(ad, AUDIT_NTP_FREQ,   time_freq);
+                        audit_ntp_set_old(ad, AUDIT_NTP_STATUS, time_status);
+                        audit_ntp_set_old(ad, AUDIT_NTP_TAI,    *time_tai);
+                        audit_ntp_set_old(ad, AUDIT_NTP_TICK,   tick_usec);
+
                         process_adjtimex_modes(txc, time_tai);
 
+                        audit_ntp_set_new(ad, AUDIT_NTP_OFFSET, time_offset);
+                        audit_ntp_set_new(ad, AUDIT_NTP_FREQ,   time_freq);
+                        audit_ntp_set_new(ad, AUDIT_NTP_STATUS, time_status);
+                        audit_ntp_set_new(ad, AUDIT_NTP_TAI,    *time_tai);
+                        audit_ntp_set_new(ad, AUDIT_NTP_TICK,   tick_usec);
+                }
+
                 txc->offset = shift_right(time_offset * NTP_INTERVAL_FREQ,
                                   NTP_SCALE_SHIFT);
                 if (!(time_status & STA_NANO))