Commit 3a6b9f85 authored by Darrel Goeddel's avatar Darrel Goeddel Committed by Al Viro
Browse files

[PATCH] audit: rename AUDIT_SE_* constants 



This patch renames some audit constant definitions and adds
additional definitions used by the following patch.  The renaming
avoids ambiguity with respect to the new definitions.

Signed-off-by: default avatarDarrel Goeddel <dgoeddel@trustedcs.com>

 include/linux/audit.h          |   15 ++++++++----
 kernel/auditfilter.c           |   50 ++++++++++++++++++++---------------------
 kernel/auditsc.c               |   10 ++++----
 security/selinux/ss/services.c |   32 +++++++++++++-------------
 4 files changed, 56 insertions(+), 51 deletions(-)
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 5adc8a6a

include/linux/audit.h

+10 −5
Original line number Diff line number Diff line
@@ -151,12 +151,17 @@ 
#define AUDIT_PERS	10

#define AUDIT_ARCH	11

#define AUDIT_MSGTYPE	12

#define AUDIT_SE_USER	13	/* security label user */

#define AUDIT_SE_ROLE	14	/* security label role */

#define AUDIT_SE_TYPE	15	/* security label type */

#define AUDIT_SE_SEN	16	/* security label sensitivity label */

#define AUDIT_SE_CLR	17	/* security label clearance label */

#define AUDIT_SUBJ_USER	13	/* security label user */

#define AUDIT_SUBJ_ROLE	14	/* security label role */

#define AUDIT_SUBJ_TYPE	15	/* security label type */

#define AUDIT_SUBJ_SEN	16	/* security label sensitivity label */

#define AUDIT_SUBJ_CLR	17	/* security label clearance label */

#define AUDIT_PPID	18

#define AUDIT_OBJ_USER	19

#define AUDIT_OBJ_ROLE	20

#define AUDIT_OBJ_TYPE	21

#define AUDIT_OBJ_LEV_LOW	22

#define AUDIT_OBJ_LEV_HIGH	23



				/* These are ONLY useful when checking

				 * at syscall exit time (AUDIT_AT_EXIT). */

kernel/auditfilter.c

+25 −25
Original line number Diff line number Diff line
@@ -470,11 +470,11 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data, 
		case AUDIT_ARG2:

		case AUDIT_ARG3:

			break;

		case AUDIT_SE_USER:

		case AUDIT_SE_ROLE:

		case AUDIT_SE_TYPE:

		case AUDIT_SE_SEN:

		case AUDIT_SE_CLR:

		case AUDIT_SUBJ_USER:

		case AUDIT_SUBJ_ROLE:

		case AUDIT_SUBJ_TYPE:

		case AUDIT_SUBJ_SEN:

		case AUDIT_SUBJ_CLR:

			str = audit_unpack_string(&bufp, &remain, f->val);

			if (IS_ERR(str))

				goto exit_free;
@@ -611,11 +611,11 @@ static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule) 
		data->fields[i] = f->type;

		data->fieldflags[i] = f->op;

		switch(f->type) {

		case AUDIT_SE_USER:

		case AUDIT_SE_ROLE:

		case AUDIT_SE_TYPE:

		case AUDIT_SE_SEN:

		case AUDIT_SE_CLR:

		case AUDIT_SUBJ_USER:

		case AUDIT_SUBJ_ROLE:

		case AUDIT_SUBJ_TYPE:

		case AUDIT_SUBJ_SEN:

		case AUDIT_SUBJ_CLR:

			data->buflen += data->values[i] =

				audit_pack_string(&bufp, f->se_str);

			break;
@@ -654,11 +654,11 @@ static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b) 
			return 1;



		switch(a->fields[i].type) {

		case AUDIT_SE_USER:

		case AUDIT_SE_ROLE:

		case AUDIT_SE_TYPE:

		case AUDIT_SE_SEN:

		case AUDIT_SE_CLR:

		case AUDIT_SUBJ_USER:

		case AUDIT_SUBJ_ROLE:

		case AUDIT_SUBJ_TYPE:

		case AUDIT_SUBJ_SEN:

		case AUDIT_SUBJ_CLR:

			if (strcmp(a->fields[i].se_str, b->fields[i].se_str))

				return 1;

			break;
@@ -774,11 +774,11 @@ static struct audit_entry *audit_dupe_rule(struct audit_krule *old, 
	 * the originals will all be freed when the old rule is freed. */

	for (i = 0; i < fcount; i++) {

		switch (new->fields[i].type) {

		case AUDIT_SE_USER:

		case AUDIT_SE_ROLE:

		case AUDIT_SE_TYPE:

		case AUDIT_SE_SEN:

		case AUDIT_SE_CLR:

		case AUDIT_SUBJ_USER:

		case AUDIT_SUBJ_ROLE:

		case AUDIT_SUBJ_TYPE:

		case AUDIT_SUBJ_SEN:

		case AUDIT_SUBJ_CLR:

			err = audit_dupe_selinux_field(&new->fields[i],

						       &old->fields[i]);

			break;
@@ -1537,11 +1537,11 @@ static inline int audit_rule_has_selinux(struct audit_krule *rule) 
	for (i = 0; i < rule->field_count; i++) {

		struct audit_field *f = &rule->fields[i];

		switch (f->type) {

		case AUDIT_SE_USER:

		case AUDIT_SE_ROLE:

		case AUDIT_SE_TYPE:

		case AUDIT_SE_SEN:

		case AUDIT_SE_CLR:

		case AUDIT_SUBJ_USER:

		case AUDIT_SUBJ_ROLE:

		case AUDIT_SUBJ_TYPE:

		case AUDIT_SUBJ_SEN:

		case AUDIT_SUBJ_CLR:

			return 1;

		}

	}

kernel/auditsc.c

+5 −5
Original line number Diff line number Diff line
@@ -321,11 +321,11 @@ static int audit_filter_rules(struct task_struct *tsk, 
			if (ctx)

				result = audit_comparator(ctx->loginuid, f->op, f->val);

			break;

		case AUDIT_SE_USER:

		case AUDIT_SE_ROLE:

		case AUDIT_SE_TYPE:

		case AUDIT_SE_SEN:

		case AUDIT_SE_CLR:

		case AUDIT_SUBJ_USER:

		case AUDIT_SUBJ_ROLE:

		case AUDIT_SUBJ_TYPE:

		case AUDIT_SUBJ_SEN:

		case AUDIT_SUBJ_CLR:

			/* NOTE: this may return negative values indicating

			   a temporary error.  We simply treat this as a

			   match for now to avoid losing information that

security/selinux/ss/services.c

+16 −16
Original line number Diff line number Diff line
@@ -1845,15 +1845,15 @@ int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, 
		return -ENOTSUPP;



	switch (field) {

	case AUDIT_SE_USER:

	case AUDIT_SE_ROLE:

	case AUDIT_SE_TYPE:

	case AUDIT_SUBJ_USER:

	case AUDIT_SUBJ_ROLE:

	case AUDIT_SUBJ_TYPE:

		/* only 'equals' and 'not equals' fit user, role, and type */

		if (op != AUDIT_EQUAL && op != AUDIT_NOT_EQUAL)

			return -EINVAL;

		break;

	case AUDIT_SE_SEN:

	case AUDIT_SE_CLR:

	case AUDIT_SUBJ_SEN:

	case AUDIT_SUBJ_CLR:

		/* we do not allow a range, indicated by the presense of '-' */

		if (strchr(rulestr, '-'))

			return -EINVAL;
@@ -1874,29 +1874,29 @@ int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, 
	tmprule->au_seqno = latest_granting;



	switch (field) {

	case AUDIT_SE_USER:

	case AUDIT_SUBJ_USER:

		userdatum = hashtab_search(policydb.p_users.table, rulestr);

		if (!userdatum)

			rc = -EINVAL;

		else

			tmprule->au_ctxt.user = userdatum->value;

		break;

	case AUDIT_SE_ROLE:

	case AUDIT_SUBJ_ROLE:

		roledatum = hashtab_search(policydb.p_roles.table, rulestr);

		if (!roledatum)

			rc = -EINVAL;

		else

			tmprule->au_ctxt.role = roledatum->value;

		break;

	case AUDIT_SE_TYPE:

	case AUDIT_SUBJ_TYPE:

		typedatum = hashtab_search(policydb.p_types.table, rulestr);

		if (!typedatum)

			rc = -EINVAL;

		else

			tmprule->au_ctxt.type = typedatum->value;

		break;

	case AUDIT_SE_SEN:

	case AUDIT_SE_CLR:

	case AUDIT_SUBJ_SEN:

	case AUDIT_SUBJ_CLR:

		rc = mls_from_string(rulestr, &tmprule->au_ctxt, GFP_ATOMIC);

		break;

	}
@@ -1948,7 +1948,7 @@ int selinux_audit_rule_match(u32 ctxid, u32 field, u32 op, 
	/* a field/op pair that is not caught here will simply fall through

	   without a match */

	switch (field) {

	case AUDIT_SE_USER:

	case AUDIT_SUBJ_USER:

		switch (op) {

		case AUDIT_EQUAL:

			match = (ctxt->user == rule->au_ctxt.user);
@@ -1958,7 +1958,7 @@ int selinux_audit_rule_match(u32 ctxid, u32 field, u32 op, 
			break;

		}

		break;

	case AUDIT_SE_ROLE:

	case AUDIT_SUBJ_ROLE:

		switch (op) {

		case AUDIT_EQUAL:

			match = (ctxt->role == rule->au_ctxt.role);
@@ -1968,7 +1968,7 @@ int selinux_audit_rule_match(u32 ctxid, u32 field, u32 op, 
			break;

		}

		break;

	case AUDIT_SE_TYPE:

	case AUDIT_SUBJ_TYPE:

		switch (op) {

		case AUDIT_EQUAL:

			match = (ctxt->type == rule->au_ctxt.type);
@@ -1978,9 +1978,9 @@ int selinux_audit_rule_match(u32 ctxid, u32 field, u32 op, 
			break;

		}

		break;

	case AUDIT_SE_SEN:

	case AUDIT_SE_CLR:

		level = (field == AUDIT_SE_SEN ?

	case AUDIT_SUBJ_SEN:

	case AUDIT_SUBJ_CLR:

		level = (field == AUDIT_SUBJ_SEN ?

		         &ctxt->range.level[0] : &ctxt->range.level[1]);

		switch (op) {

		case AUDIT_EQUAL:

CRA Git | Maintained and supported by SUSTech CRA and CCSE