Skip to content

Commit 1a6b9f2

Browse files
eparisAl Viro
eparis
authored and
Al Viro
committed
[AUDIT] make audit=0 really stop audit messages
Some audit messages (namely configuration changes) are still emitted even if the audit subsystem has been explicitly disabled. This patch turns those messages off as well. Signed-off-by: Eric Paris <eparis@redhat.com>
1 parent de6bbd1 commit 1a6b9f2

File tree

2 files changed

+93
-152
lines changed

2 files changed

+93
-152
lines changed

‎kernel/audit.c

+60-131
Original file line numberDiff line numberDiff line change
@@ -66,9 +66,9 @@
6666
* (Initialization happens after skb_init is called.) */
6767
static int audit_initialized;
6868

69-
/* 0 - no auditing
70-
* 1 - auditing enabled
71-
* 2 - auditing enabled and configuration is locked/unchangeable. */
69+
#define AUDIT_OFF 0
70+
#define AUDIT_ON 1
71+
#define AUDIT_LOCKED 2
7272
int audit_enabled;
7373

7474
/* Default state when kernel boots without any parameters. */
@@ -240,152 +240,90 @@ void audit_log_lost(const char *message)
240240
}
241241
}
242242

243-
static int audit_set_rate_limit(int limit, uid_t loginuid, u32 sid)
243+
static int audit_log_config_change(char *function_name, int new, int old,
244+
uid_t loginuid, u32 sid, int allow_changes)
244245
{
245-
int res, rc = 0, old = audit_rate_limit;
246-
247-
/* check if we are locked */
248-
if (audit_enabled == 2)
249-
res = 0;
250-
else
251-
res = 1;
246+
struct audit_buffer *ab;
247+
int rc = 0;
252248

249+
ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
250+
audit_log_format(ab, "%s=%d old=%d by auid=%u", function_name, new,
251+
old, loginuid);
253252
if (sid) {
254253
char *ctx = NULL;
255254
u32 len;
256-
if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) {
257-
audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
258-
"audit_rate_limit=%d old=%d by auid=%u"
259-
" subj=%s res=%d",
260-
limit, old, loginuid, ctx, res);
255+
256+
rc = selinux_sid_to_string(sid, &ctx, &len);
257+
if (rc) {
258+
audit_log_format(ab, " sid=%u", sid);
259+
allow_changes = 0; /* Something weird, deny request */
260+
} else {
261+
audit_log_format(ab, " subj=%s", ctx);
261262
kfree(ctx);
262-
} else
263-
res = 0; /* Something weird, deny request */
263+
}
264264
}
265-
audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
266-
"audit_rate_limit=%d old=%d by auid=%u res=%d",
267-
limit, old, loginuid, res);
268-
269-
/* If we are allowed, make the change */
270-
if (res == 1)
271-
audit_rate_limit = limit;
272-
/* Not allowed, update reason */
273-
else if (rc == 0)
274-
rc = -EPERM;
265+
audit_log_format(ab, " res=%d", allow_changes);
266+
audit_log_end(ab);
275267
return rc;
276268
}
277269

278-
static int audit_set_backlog_limit(int limit, uid_t loginuid, u32 sid)
270+
static int audit_do_config_change(char *function_name, int *to_change,
271+
int new, uid_t loginuid, u32 sid)
279272
{
280-
int res, rc = 0, old = audit_backlog_limit;
273+
int allow_changes, rc = 0, old = *to_change;
281274

282275
/* check if we are locked */
283-
if (audit_enabled == 2)
284-
res = 0;
276+
if (audit_enabled == AUDIT_LOCKED)
277+
allow_changes = 0;
285278
else
286-
res = 1;
279+
allow_changes = 1;
287280

288-
if (sid) {
289-
char *ctx = NULL;
290-
u32 len;
291-
if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) {
292-
audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
293-
"audit_backlog_limit=%d old=%d by auid=%u"
294-
" subj=%s res=%d",
295-
limit, old, loginuid, ctx, res);
296-
kfree(ctx);
297-
} else
298-
res = 0; /* Something weird, deny request */
281+
if (audit_enabled != AUDIT_OFF) {
282+
rc = audit_log_config_change(function_name, new, old,
283+
loginuid, sid, allow_changes);
284+
if (rc)
285+
allow_changes = 0;
299286
}
300-
audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
301-
"audit_backlog_limit=%d old=%d by auid=%u res=%d",
302-
limit, old, loginuid, res);
303287

304288
/* If we are allowed, make the change */
305-
if (res == 1)
306-
audit_backlog_limit = limit;
289+
if (allow_changes == 1)
290+
*to_change = new;
307291
/* Not allowed, update reason */
308292
else if (rc == 0)
309293
rc = -EPERM;
310294
return rc;
311295
}
312296

313-
static int audit_set_enabled(int state, uid_t loginuid, u32 sid)
297+
static int audit_set_rate_limit(int limit, uid_t loginuid, u32 sid)
314298
{
315-
int res, rc = 0, old = audit_enabled;
316-
317-
if (state < 0 || state > 2)
318-
return -EINVAL;
299+
return audit_do_config_change("audit_rate_limit", &audit_rate_limit,
300+
limit, loginuid, sid);
301+
}
319302

320-
/* check if we are locked */
321-
if (audit_enabled == 2)
322-
res = 0;
323-
else
324-
res = 1;
303+
static int audit_set_backlog_limit(int limit, uid_t loginuid, u32 sid)
304+
{
305+
return audit_do_config_change("audit_backlog_limit", &audit_backlog_limit,
306+
limit, loginuid, sid);
307+
}
325308

326-
if (sid) {
327-
char *ctx = NULL;
328-
u32 len;
329-
if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) {
330-
audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
331-
"audit_enabled=%d old=%d by auid=%u"
332-
" subj=%s res=%d",
333-
state, old, loginuid, ctx, res);
334-
kfree(ctx);
335-
} else
336-
res = 0; /* Something weird, deny request */
337-
}
338-
audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
339-
"audit_enabled=%d old=%d by auid=%u res=%d",
340-
state, old, loginuid, res);
309+
static int audit_set_enabled(int state, uid_t loginuid, u32 sid)
310+
{
311+
if (state < AUDIT_OFF || state > AUDIT_LOCKED)
312+
return -EINVAL;
341313

342-
/* If we are allowed, make the change */
343-
if (res == 1)
344-
audit_enabled = state;
345-
/* Not allowed, update reason */
346-
else if (rc == 0)
347-
rc = -EPERM;
348-
return rc;
314+
return audit_do_config_change("audit_enabled", &audit_enabled, state,
315+
loginuid, sid);
349316
}
350317

351318
static int audit_set_failure(int state, uid_t loginuid, u32 sid)
352319
{
353-
int res, rc = 0, old = audit_failure;
354-
355320
if (state != AUDIT_FAIL_SILENT
356321
&& state != AUDIT_FAIL_PRINTK
357322
&& state != AUDIT_FAIL_PANIC)
358323
return -EINVAL;
359324

360-
/* check if we are locked */
361-
if (audit_enabled == 2)
362-
res = 0;
363-
else
364-
res = 1;
365-
366-
if (sid) {
367-
char *ctx = NULL;
368-
u32 len;
369-
if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) {
370-
audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
371-
"audit_failure=%d old=%d by auid=%u"
372-
" subj=%s res=%d",
373-
state, old, loginuid, ctx, res);
374-
kfree(ctx);
375-
} else
376-
res = 0; /* Something weird, deny request */
377-
}
378-
audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
379-
"audit_failure=%d old=%d by auid=%u res=%d",
380-
state, old, loginuid, res);
381-
382-
/* If we are allowed, make the change */
383-
if (res == 1)
384-
audit_failure = state;
385-
/* Not allowed, update reason */
386-
else if (rc == 0)
387-
rc = -EPERM;
388-
return rc;
325+
return audit_do_config_change("audit_failure", &audit_failure, state,
326+
loginuid, sid);
389327
}
390328

391329
static int kauditd_thread(void *dummy)
@@ -634,23 +572,14 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
634572
if (err < 0) return err;
635573
}
636574
if (status_get->mask & AUDIT_STATUS_PID) {
637-
int old = audit_pid;
638-
if (sid) {
639-
if ((err = selinux_sid_to_string(
640-
sid, &ctx, &len)))
641-
return err;
642-
else
643-
audit_log(NULL, GFP_KERNEL,
644-
AUDIT_CONFIG_CHANGE,
645-
"audit_pid=%d old=%d by auid=%u subj=%s",
646-
status_get->pid, old,
647-
loginuid, ctx);
648-
kfree(ctx);
649-
} else
650-
audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
651-
"audit_pid=%d old=%d by auid=%u",
652-
status_get->pid, old, loginuid);
653-
audit_pid = status_get->pid;
575+
int new_pid = status_get->pid;
576+
577+
if (audit_enabled != AUDIT_OFF)
578+
audit_log_config_change("audit_pid", new_pid,
579+
audit_pid, loginuid,
580+
sid, 1);
581+
582+
audit_pid = new_pid;
654583
}
655584
if (status_get->mask & AUDIT_STATUS_RATE_LIMIT)
656585
err = audit_set_rate_limit(status_get->rate_limit,
@@ -709,7 +638,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
709638
case AUDIT_DEL:
710639
if (nlmsg_len(nlh) < sizeof(struct audit_rule))
711640
return -EINVAL;
712-
if (audit_enabled == 2) {
641+
if (audit_enabled == AUDIT_LOCKED) {
713642
ab = audit_log_start(NULL, GFP_KERNEL,
714643
AUDIT_CONFIG_CHANGE);
715644
if (ab) {
@@ -743,7 +672,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
743672
case AUDIT_DEL_RULE:
744673
if (nlmsg_len(nlh) < sizeof(struct audit_rule_data))
745674
return -EINVAL;
746-
if (audit_enabled == 2) {
675+
if (audit_enabled == AUDIT_LOCKED) {
747676
ab = audit_log_start(NULL, GFP_KERNEL,
748677
AUDIT_CONFIG_CHANGE);
749678
if (ab) {

‎kernel/auditfilter.c

+33-21
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,8 @@ extern struct inotify_handle *audit_ih;
9595
/* Inotify events we care about. */
9696
#define AUDIT_IN_WATCH IN_MOVE|IN_CREATE|IN_DELETE|IN_DELETE_SELF|IN_MOVE_SELF
9797

98+
extern int audit_enabled;
99+
98100
void audit_free_parent(struct inotify_watch *i_watch)
99101
{
100102
struct audit_parent *parent;
@@ -974,7 +976,6 @@ static void audit_update_watch(struct audit_parent *parent,
974976
struct audit_watch *owatch, *nwatch, *nextw;
975977
struct audit_krule *r, *nextr;
976978
struct audit_entry *oentry, *nentry;
977-
struct audit_buffer *ab;
978979

979980
mutex_lock(&audit_filter_mutex);
980981
list_for_each_entry_safe(owatch, nextw, &parent->watches, wlist) {
@@ -1014,13 +1015,18 @@ static void audit_update_watch(struct audit_parent *parent,
10141015
call_rcu(&oentry->rcu, audit_free_rule_rcu);
10151016
}
10161017

1017-
ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
1018-
audit_log_format(ab, "op=updated rules specifying path=");
1019-
audit_log_untrustedstring(ab, owatch->path);
1020-
audit_log_format(ab, " with dev=%u ino=%lu\n", dev, ino);
1021-
audit_log_format(ab, " list=%d res=1", r->listnr);
1022-
audit_log_end(ab);
1023-
1018+
if (audit_enabled) {
1019+
struct audit_buffer *ab;
1020+
ab = audit_log_start(NULL, GFP_KERNEL,
1021+
AUDIT_CONFIG_CHANGE);
1022+
audit_log_format(ab,
1023+
"op=updated rules specifying path=");
1024+
audit_log_untrustedstring(ab, owatch->path);
1025+
audit_log_format(ab, " with dev=%u ino=%lu\n",
1026+
dev, ino);
1027+
audit_log_format(ab, " list=%d res=1", r->listnr);
1028+
audit_log_end(ab);
1029+
}
10241030
audit_remove_watch(owatch);
10251031
goto add_watch_to_parent; /* event applies to a single watch */
10261032
}
@@ -1039,25 +1045,28 @@ static void audit_remove_parent_watches(struct audit_parent *parent)
10391045
struct audit_watch *w, *nextw;
10401046
struct audit_krule *r, *nextr;
10411047
struct audit_entry *e;
1042-
struct audit_buffer *ab;
10431048

10441049
mutex_lock(&audit_filter_mutex);
10451050
parent->flags |= AUDIT_PARENT_INVALID;
10461051
list_for_each_entry_safe(w, nextw, &parent->watches, wlist) {
10471052
list_for_each_entry_safe(r, nextr, &w->rules, rlist) {
10481053
e = container_of(r, struct audit_entry, rule);
1049-
1050-
ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
1051-
audit_log_format(ab, "op=remove rule path=");
1052-
audit_log_untrustedstring(ab, w->path);
1053-
if (r->filterkey) {
1054-
audit_log_format(ab, " key=");
1055-
audit_log_untrustedstring(ab, r->filterkey);
1056-
} else
1057-
audit_log_format(ab, " key=(null)");
1058-
audit_log_format(ab, " list=%d res=1", r->listnr);
1059-
audit_log_end(ab);
1060-
1054+
if (audit_enabled) {
1055+
struct audit_buffer *ab;
1056+
ab = audit_log_start(NULL, GFP_KERNEL,
1057+
AUDIT_CONFIG_CHANGE);
1058+
audit_log_format(ab, "op=remove rule path=");
1059+
audit_log_untrustedstring(ab, w->path);
1060+
if (r->filterkey) {
1061+
audit_log_format(ab, " key=");
1062+
audit_log_untrustedstring(ab,
1063+
r->filterkey);
1064+
} else
1065+
audit_log_format(ab, " key=(null)");
1066+
audit_log_format(ab, " list=%d res=1",
1067+
r->listnr);
1068+
audit_log_end(ab);
1069+
}
10611070
list_del(&r->rlist);
10621071
list_del_rcu(&e->list);
10631072
call_rcu(&e->rcu, audit_free_rule_rcu);
@@ -1495,6 +1504,9 @@ static void audit_log_rule_change(uid_t loginuid, u32 sid, char *action,
14951504
{
14961505
struct audit_buffer *ab;
14971506

1507+
if (!audit_enabled)
1508+
return;
1509+
14981510
ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
14991511
if (!ab)
15001512
return;

0 commit comments

Comments
 (0)