Commit 041d7b98 authored by Richard Guy Briggs's avatar Richard Guy Briggs Committed by Paul Moore
Browse files

audit: restore AUDIT_LOGINUID unset ABI 



A regression was caused by commit 780a7654:
	 audit: Make testing for a valid loginuid explicit.
(which in turn attempted to fix a regression caused by e1760bd5)

When audit_krule_to_data() fills in the rules to get a listing, there was a
missing clause to convert back from AUDIT_LOGINUID_SET to AUDIT_LOGINUID.

This broke userspace by not returning the same information that was sent and
expected.

The rule:
	auditctl -a exit,never -F auid=-1
gives:
	auditctl -l
		LIST_RULES: exit,never f24=0 syscall=all
when it should give:
		LIST_RULES: exit,never auid=-1 (0xffffffff) syscall=all

Tag it so that it is reported the same way it was set.  Create a new
private flags audit_krule field (pflags) to store it that won't interact with
the public one from the API.

Cc: stable@vger.kernel.org # v3.10-rc1+
Signed-off-by: default avatarRichard Guy Briggs <rgb@redhat.com>
Signed-off-by: default avatarPaul Moore <pmoore@redhat.com>
parent 4a928436

include/linux/audit.h

+4 −0
Original line number Diff line number Diff line
@@ -47,6 +47,7 @@ struct sk_buff; 


struct audit_krule {

	int			vers_ops;

	u32			pflags;

	u32			flags;

	u32			listnr;

	u32			action;
@@ -64,6 +65,9 @@ struct audit_krule { 
	u64			prio;

};



/* Flag to indicate legacy AUDIT_LOGINUID unset usage */

#define AUDIT_LOGINUID_LEGACY		0x1



struct audit_field {

	u32				type;

	union {

kernel/auditfilter.c

+10 −0
Original line number Diff line number Diff line
@@ -442,6 +442,7 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data, 
		if ((f->type == AUDIT_LOGINUID) && (f->val == AUDIT_UID_UNSET)) {

			f->type = AUDIT_LOGINUID_SET;

			f->val = 0;

			entry->rule.pflags |= AUDIT_LOGINUID_LEGACY;

		}



		err = audit_field_valid(entry, f);
@@ -617,6 +618,13 @@ static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule) 
			data->buflen += data->values[i] =

				audit_pack_string(&bufp, krule->filterkey);

			break;

		case AUDIT_LOGINUID_SET:

			if (krule->pflags & AUDIT_LOGINUID_LEGACY && !f->val) {

				data->fields[i] = AUDIT_LOGINUID;

				data->values[i] = AUDIT_UID_UNSET;

				break;

			}

			/* fallthrough if set */

		default:

			data->values[i] = f->val;

		}
@@ -633,6 +641,7 @@ static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b) 
	int i;



	if (a->flags != b->flags ||

	    a->pflags != b->pflags ||

	    a->listnr != b->listnr ||

	    a->action != b->action ||

	    a->field_count != b->field_count)
@@ -751,6 +760,7 @@ struct audit_entry *audit_dupe_rule(struct audit_krule *old) 
	new = &entry->rule;

	new->vers_ops = old->vers_ops;

	new->flags = old->flags;

	new->pflags = old->pflags;

	new->listnr = old->listnr;

	new->action = old->action;

	for (i = 0; i < AUDIT_BITMASK_SIZE; i++)

CRA Git | Maintained and supported by SUSTech CRA and CCSE