Commit 33e8a907 authored by Steve Grubb's avatar Steve Grubb Committed by Paul Moore
Browse files

audit: Allow auditd to set pid to 0 to end auditing 

The API to end auditing has historically been for auditd to set the
pid to 0. This patch restores that functionality.

See: https://github.com/linux-audit/audit-kernel/issues/69



Reviewed-by: default avatarRichard Guy Briggs <rgb@redhat.com>
Signed-off-by: default avatarSteve Grubb <sgrubb@redhat.com>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 6e66ec3c

kernel/audit.c

+16 −13
Original line number Diff line number Diff line
@@ -1197,26 +1197,29 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) 
			pid_t auditd_pid;

			struct pid *req_pid = task_tgid(current);



			/* sanity check - PID values must match */

			if (new_pid != pid_vnr(req_pid))

			/* Sanity check - PID values must match. Setting

			 * pid to 0 is how auditd ends auditing. */

			if (new_pid && (new_pid != pid_vnr(req_pid)))

				return -EINVAL;



			/* test the auditd connection */

			audit_replace(req_pid);



			auditd_pid = auditd_pid_vnr();

			/* only the current auditd can unregister itself */

			if ((!new_pid) && (new_pid != auditd_pid)) {

				audit_log_config_change("audit_pid", new_pid,

							auditd_pid, 0);

				return -EACCES;

			}

			if (auditd_pid) {

				/* replacing a healthy auditd is not allowed */

			if (auditd_pid && new_pid) {

				audit_log_config_change("audit_pid", new_pid,

							auditd_pid, 0);

				if (new_pid) {

					audit_log_config_change("audit_pid",

							new_pid, auditd_pid, 0);

					return -EEXIST;

				}

				/* only current auditd can unregister itself */

				if (pid_vnr(req_pid) != auditd_pid) {

					audit_log_config_change("audit_pid",

							new_pid, auditd_pid, 0);

					return -EACCES;

				}

			}



			if (new_pid) {

				/* register a new auditd connection */

CRA Git | Maintained and supported by SUSTech CRA and CCSE