Skip to content

Commit

Permalink
audit: set nlmsg_len for multicast messages.
Browse files Browse the repository at this point in the history
Report:
	Looking at your example code in
	http://people.redhat.com/rbriggs/audit-multicast-listen/audit-multicast-listen.c,
	it seems that nlmsg_len field in the received messages is supposed to
	contain the length of the header + payload, but it is always set to the
	size of the header only, i.e. 16. The example program works, because
	the printf format specifies the minimum width, not "precision", so it
	simply prints out the payload until the first zero byte. This isn't too
	much of a problem, but precludes the use of recvmmsg, iiuc?

	(gdb) p *(struct nlmsghdr*)nlh
	$14 = {nlmsg_len = 16, nlmsg_type = 1100, nlmsg_flags = 0, nlmsg_seq = 0, nlmsg_pid = 9910}

The only time nlmsg_len would have been updated was at audit_buffer_alloc()
inside audit_log_start() and never updated after.  It should arguably be done
in audit_log_vformat(), but would be more efficient in audit_log_end().

Reported-by: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
  • Loading branch information
rgbriggs authored and eparis committed Sep 23, 2014
1 parent 219ca39 commit 54e05ed
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion kernel/audit.c
Original file line number Diff line number Diff line change
Expand Up @@ -1949,6 +1949,7 @@ void audit_log_end(struct audit_buffer *ab)
} else {
struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);

nlh->nlmsg_len = ab->skb->len;
kauditd_send_multicast_skb(ab->skb);

/*
Expand All @@ -1960,7 +1961,7 @@ void audit_log_end(struct audit_buffer *ab)
* protocol between the kaudit kernel subsystem and the auditd
* userspace code.
*/
nlh->nlmsg_len = ab->skb->len - NLMSG_HDRLEN;
nlh->nlmsg_len -= NLMSG_HDRLEN;

if (audit_pid) {
skb_queue_tail(&audit_skb_queue, ab->skb);
Expand Down

0 comments on commit 54e05ed

Please sign in to comment.