Skip to content

Commit 9781db7

Browse files
torvaldstorvalds
committed
Merge branch 'audit.b50' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current
* 'audit.b50' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current: [PATCH] new predicate - AUDIT_FILETYPE [patch 2/2] Use find_task_by_vpid in audit code [patch 1/2] audit: let userspace fully control TTY input auditing [PATCH 2/2] audit: fix sparse shadowed variable warnings [PATCH 1/2] audit: move extern declarations to audit.h Audit: MAINTAINERS update Audit: increase the maximum length of the key field Audit: standardize string audit interfaces Audit: stop deadlock from signals under load Audit: save audit_backlog_limit audit messages in case auditd comes back Audit: collect sessionid in netlink messages Audit: end printk with newline
2 parents 97094dc + 8b67dca commit 9781db7

22 files changed

+346
-233
lines changed

‎MAINTAINERS

+5-3
Original file line numberDiff line numberDiff line change
@@ -752,11 +752,13 @@ W: http://atmelwlandriver.sourceforge.net/
752752
S: Maintained
753753

754754
AUDIT SUBSYSTEM
755-
P: David Woodhouse
756-
M: dwmw2@infradead.org
755+
P: Al Viro
756+
M: viro@zeniv.linux.org.uk
757+
P: Eric Paris
758+
M: eparis@redhat.com
757759
L: linux-audit@redhat.com (subscribers-only)
758760
W: http://people.redhat.com/sgrubb/audit/
759-
T: git kernel.org:/pub/scm/linux/kernel/git/dwmw2/audit-2.6.git
761+
T: git git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current.git
760762
S: Maintained
761763

762764
AUXILIARY DISPLAY DRIVERS

‎drivers/char/tty_audit.c

+6-57
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ static void tty_audit_buf_push(struct task_struct *tsk, uid_t loginuid,
9292
get_task_comm(name, tsk);
9393
audit_log_untrustedstring(ab, name);
9494
audit_log_format(ab, " data=");
95-
audit_log_n_untrustedstring(ab, buf->valid, buf->data);
95+
audit_log_n_untrustedstring(ab, buf->data, buf->valid);
9696
audit_log_end(ab);
9797
}
9898
buf->valid = 0;
@@ -151,14 +151,9 @@ void tty_audit_fork(struct signal_struct *sig)
151151
/**
152152
* tty_audit_push_task - Flush task's pending audit data
153153
*/
154-
void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid)
154+
void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid, u32 sessionid)
155155
{
156156
struct tty_audit_buf *buf;
157-
/* FIXME I think this is correct. Check against netlink once that is
158-
* I really need to read this code more closely. But that's for
159-
* another patch.
160-
*/
161-
unsigned int sessionid = audit_get_sessionid(tsk);
162157

163158
spin_lock_irq(&tsk->sighand->siglock);
164159
buf = tsk->signal->tty_audit_buf;
@@ -238,6 +233,10 @@ void tty_audit_add_data(struct tty_struct *tty, unsigned char *data,
238233
if (unlikely(size == 0))
239234
return;
240235

236+
if (tty->driver->type == TTY_DRIVER_TYPE_PTY
237+
&& tty->driver->subtype == PTY_TYPE_MASTER)
238+
return;
239+
241240
buf = tty_audit_buf_get(tty);
242241
if (!buf)
243242
return;
@@ -300,53 +299,3 @@ void tty_audit_push(struct tty_struct *tty)
300299
tty_audit_buf_put(buf);
301300
}
302301
}
303-
304-
/**
305-
* tty_audit_opening - A TTY is being opened.
306-
*
307-
* As a special hack, tasks that close all their TTYs and open new ones
308-
* are assumed to be system daemons (e.g. getty) and auditing is
309-
* automatically disabled for them.
310-
*/
311-
void tty_audit_opening(void)
312-
{
313-
int disable;
314-
315-
disable = 1;
316-
spin_lock_irq(&current->sighand->siglock);
317-
if (current->signal->audit_tty == 0)
318-
disable = 0;
319-
spin_unlock_irq(&current->sighand->siglock);
320-
if (!disable)
321-
return;
322-
323-
task_lock(current);
324-
if (current->files) {
325-
struct fdtable *fdt;
326-
unsigned i;
327-
328-
/*
329-
* We don't take a ref to the file, so we must hold ->file_lock
330-
* instead.
331-
*/
332-
spin_lock(&current->files->file_lock);
333-
fdt = files_fdtable(current->files);
334-
for (i = 0; i < fdt->max_fds; i++) {
335-
struct file *filp;
336-
337-
filp = fcheck_files(current->files, i);
338-
if (filp && is_tty(filp)) {
339-
disable = 0;
340-
break;
341-
}
342-
}
343-
spin_unlock(&current->files->file_lock);
344-
}
345-
task_unlock(current);
346-
if (!disable)
347-
return;
348-
349-
spin_lock_irq(&current->sighand->siglock);
350-
current->signal->audit_tty = 0;
351-
spin_unlock_irq(&current->sighand->siglock);
352-
}

‎drivers/char/tty_io.c

+1-4
Original file line numberDiff line numberDiff line change
@@ -2755,7 +2755,6 @@ static int tty_open(struct inode *inode, struct file *filp)
27552755
__proc_set_tty(current, tty);
27562756
spin_unlock_irq(&current->sighand->siglock);
27572757
mutex_unlock(&tty_mutex);
2758-
tty_audit_opening();
27592758
return 0;
27602759
}
27612760

@@ -2818,10 +2817,8 @@ static int ptmx_open(struct inode *inode, struct file *filp)
28182817

28192818
check_tty_count(tty, "tty_open");
28202819
retval = ptm_driver->open(tty, filp);
2821-
if (!retval) {
2822-
tty_audit_opening();
2820+
if (!retval)
28232821
return 0;
2824-
}
28252822
out1:
28262823
release_dev(filp);
28272824
return retval;

‎include/linux/audit.h

+18-10
Original file line numberDiff line numberDiff line change
@@ -146,7 +146,7 @@
146146
/* Rule structure sizes -- if these change, different AUDIT_ADD and
147147
* AUDIT_LIST commands must be implemented. */
148148
#define AUDIT_MAX_FIELDS 64
149-
#define AUDIT_MAX_KEY_LEN 32
149+
#define AUDIT_MAX_KEY_LEN 256
150150
#define AUDIT_BITMASK_SIZE 64
151151
#define AUDIT_WORD(nr) ((__u32)((nr)/32))
152152
#define AUDIT_BIT(nr) (1 << ((nr) - AUDIT_WORD(nr)*32))
@@ -209,6 +209,7 @@
209209
#define AUDIT_WATCH 105
210210
#define AUDIT_PERM 106
211211
#define AUDIT_DIR 107
212+
#define AUDIT_FILETYPE 108
212213

213214
#define AUDIT_ARG0 200
214215
#define AUDIT_ARG1 (AUDIT_ARG0+1)
@@ -549,16 +550,20 @@ extern void audit_log_format(struct audit_buffer *ab,
549550
const char *fmt, ...)
550551
__attribute__((format(printf,2,3)));
551552
extern void audit_log_end(struct audit_buffer *ab);
552-
extern void audit_log_hex(struct audit_buffer *ab,
553-
const unsigned char *buf,
554-
size_t len);
555553
extern int audit_string_contains_control(const char *string,
556554
size_t len);
555+
extern void audit_log_n_hex(struct audit_buffer *ab,
556+
const unsigned char *buf,
557+
size_t len);
558+
extern void audit_log_n_string(struct audit_buffer *ab,
559+
const char *buf,
560+
size_t n);
561+
#define audit_log_string(a,b) audit_log_n_string(a, b, strlen(b));
562+
extern void audit_log_n_untrustedstring(struct audit_buffer *ab,
563+
const char *string,
564+
size_t n);
557565
extern void audit_log_untrustedstring(struct audit_buffer *ab,
558566
const char *string);
559-
extern void audit_log_n_untrustedstring(struct audit_buffer *ab,
560-
size_t n,
561-
const char *string);
562567
extern void audit_log_d_path(struct audit_buffer *ab,
563568
const char *prefix,
564569
struct path *path);
@@ -569,17 +574,20 @@ extern int audit_update_lsm_rules(void);
569574
extern int audit_filter_user(struct netlink_skb_parms *cb, int type);
570575
extern int audit_filter_type(int type);
571576
extern int audit_receive_filter(int type, int pid, int uid, int seq,
572-
void *data, size_t datasz, uid_t loginuid, u32 sid);
577+
void *data, size_t datasz, uid_t loginuid,
578+
u32 sessionid, u32 sid);
573579
extern int audit_enabled;
574580
#else
575581
#define audit_log(c,g,t,f,...) do { ; } while (0)
576582
#define audit_log_start(c,g,t) ({ NULL; })
577583
#define audit_log_vformat(b,f,a) do { ; } while (0)
578584
#define audit_log_format(b,f,...) do { ; } while (0)
579585
#define audit_log_end(b) do { ; } while (0)
580-
#define audit_log_hex(a,b,l) do { ; } while (0)
581-
#define audit_log_untrustedstring(a,s) do { ; } while (0)
586+
#define audit_log_n_hex(a,b,l) do { ; } while (0)
587+
#define audit_log_n_string(a,c,l) do { ; } while (0)
588+
#define audit_log_string(a,c) do { ; } while (0)
582589
#define audit_log_n_untrustedstring(a,n,s) do { ; } while (0)
590+
#define audit_log_untrustedstring(a,s) do { ; } while (0)
583591
#define audit_log_d_path(b, p, d) do { ; } while (0)
584592
#define audit_enabled 0
585593
#endif

‎include/linux/netlink.h

+1
Original file line numberDiff line numberDiff line change
@@ -166,6 +166,7 @@ struct netlink_skb_parms
166166
__u32 dst_group;
167167
kernel_cap_t eff_cap;
168168
__u32 loginuid; /* Login (audit) uid */
169+
__u32 sessionid; /* Session id (audit) */
169170
__u32 sid; /* SELinux security id */
170171
};
171172

‎include/linux/tty.h

+2-7
Original file line numberDiff line numberDiff line change
@@ -300,7 +300,6 @@ extern void tty_hangup(struct tty_struct * tty);
300300
extern void tty_vhangup(struct tty_struct * tty);
301301
extern void tty_unhangup(struct file *filp);
302302
extern int tty_hung_up_p(struct file * filp);
303-
extern int is_tty(struct file *filp);
304303
extern void do_SAK(struct tty_struct *tty);
305304
extern void __do_SAK(struct tty_struct *tty);
306305
extern void disassociate_ctty(int priv);
@@ -351,8 +350,7 @@ extern void tty_audit_add_data(struct tty_struct *tty, unsigned char *data,
351350
extern void tty_audit_exit(void);
352351
extern void tty_audit_fork(struct signal_struct *sig);
353352
extern void tty_audit_push(struct tty_struct *tty);
354-
extern void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid);
355-
extern void tty_audit_opening(void);
353+
extern void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid, u32 sessionid);
356354
#else
357355
static inline void tty_audit_add_data(struct tty_struct *tty,
358356
unsigned char *data, size_t size)
@@ -367,10 +365,7 @@ static inline void tty_audit_fork(struct signal_struct *sig)
367365
static inline void tty_audit_push(struct tty_struct *tty)
368366
{
369367
}
370-
static inline void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid)
371-
{
372-
}
373-
static inline void tty_audit_opening(void)
368+
static inline void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid, u32 sessionid)
374369
{
375370
}
376371
#endif

‎include/net/netlabel.h

+1
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,7 @@ struct cipso_v4_doi;
103103
struct netlbl_audit {
104104
u32 secid;
105105
uid_t loginuid;
106+
u32 sessionid;
106107
};
107108

108109
/*

‎include/net/xfrm.h

+12-11
Original file line numberDiff line numberDiff line change
@@ -597,8 +597,9 @@ struct xfrm_spi_skb_cb {
597597
/* Audit Information */
598598
struct xfrm_audit
599599
{
600-
u32 loginuid;
601600
u32 secid;
601+
uid_t loginuid;
602+
u32 sessionid;
602603
};
603604

604605
#ifdef CONFIG_AUDITSYSCALL
@@ -616,13 +617,13 @@ static inline struct audit_buffer *xfrm_audit_start(const char *op)
616617
return audit_buf;
617618
}
618619

619-
static inline void xfrm_audit_helper_usrinfo(u32 auid, u32 secid,
620+
static inline void xfrm_audit_helper_usrinfo(uid_t auid, u32 ses, u32 secid,
620621
struct audit_buffer *audit_buf)
621622
{
622623
char *secctx;
623624
u32 secctx_len;
624625

625-
audit_log_format(audit_buf, " auid=%u", auid);
626+
audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses);
626627
if (secid != 0 &&
627628
security_secid_to_secctx(secid, &secctx, &secctx_len) == 0) {
628629
audit_log_format(audit_buf, " subj=%s", secctx);
@@ -632,13 +633,13 @@ static inline void xfrm_audit_helper_usrinfo(u32 auid, u32 secid,
632633
}
633634

634635
extern void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
635-
u32 auid, u32 secid);
636+
u32 auid, u32 ses, u32 secid);
636637
extern void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
637-
u32 auid, u32 secid);
638+
u32 auid, u32 ses, u32 secid);
638639
extern void xfrm_audit_state_add(struct xfrm_state *x, int result,
639-
u32 auid, u32 secid);
640+
u32 auid, u32 ses, u32 secid);
640641
extern void xfrm_audit_state_delete(struct xfrm_state *x, int result,
641-
u32 auid, u32 secid);
642+
u32 auid, u32 ses, u32 secid);
642643
extern void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
643644
struct sk_buff *skb);
644645
extern void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family);
@@ -647,10 +648,10 @@ extern void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
647648
extern void xfrm_audit_state_icvfail(struct xfrm_state *x,
648649
struct sk_buff *skb, u8 proto);
649650
#else
650-
#define xfrm_audit_policy_add(x, r, a, s) do { ; } while (0)
651-
#define xfrm_audit_policy_delete(x, r, a, s) do { ; } while (0)
652-
#define xfrm_audit_state_add(x, r, a, s) do { ; } while (0)
653-
#define xfrm_audit_state_delete(x, r, a, s) do { ; } while (0)
651+
#define xfrm_audit_policy_add(x, r, a, se, s) do { ; } while (0)
652+
#define xfrm_audit_policy_delete(x, r, a, se, s) do { ; } while (0)
653+
#define xfrm_audit_state_add(x, r, a, se, s) do { ; } while (0)
654+
#define xfrm_audit_state_delete(x, r, a, se, s) do { ; } while (0)
654655
#define xfrm_audit_state_replay_overflow(x, s) do { ; } while (0)
655656
#define xfrm_audit_state_notfound_simple(s, f) do { ; } while (0)
656657
#define xfrm_audit_state_notfound(s, f, sp, sq) do { ; } while (0)

0 commit comments

Comments
 (0)