Commit 53fc7a01 authored Dec 10, 2018 by Richard Guy Briggs Committed by Paul Moore Jan 14, 2019

audit: give a clue what CONFIG_CHANGE op was involved

The failure to add an audit rule due to audit locked gives no clue
what CONFIG_CHANGE operation failed.
Similarly the set operation is the only other operation that doesn't
give the "op=" field to indicate the action.
All other CONFIG_CHANGE records include an op= field to give a clue as
to what sort of configuration change is being executed.

Since these are the only CONFIG_CHANGE records that that do not have an
op= field, add them to bring them in line with the rest.

Old records:
type=CONFIG_CHANGE msg=audit(1519812997.781:374): pid=610 uid=0 auid=0 ses=1 subj=... audit_enabled=2 res=0
type=CONFIG_CHANGE msg=audit(2018-06-14 14:55:04.507:47) : audit_enabled=1 old=1 auid=unset ses=unset subj=... res=yes

New records:
type=CONFIG_CHANGE msg=audit(1520958477.855:100): pid=610 uid=0 auid=0 ses=1 subj=... op=add_rule audit_enabled=2 res=0

type=CONFIG_CHANGE msg=audit(2018-06-14 14:55:04.507:47) : op=set audit_enabled=1 old=1 auid=unset ses=unset subj=... res=yes

See: https://github.com/linux-audit/audit-kernel/issues/59



Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
[PM: fixed checkpatch.pl line length problems]
Signed-off-by: Paul Moore <paul@paul-moore.com>

parent bfeffd15

kernel/audit.c

+5 −2

Original line number	Diff line number	Diff line
		@@ -399,7 +399,7 @@ static int audit_log_config_change(char *function_name, u32 new, u32 old,
		ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
		if (unlikely(!ab))
		return rc;
		audit_log_format(ab, "%s=%u old=%u ", function_name, new, old);
		audit_log_format(ab, "op=set %s=%u old=%u ", function_name, new, old);
		audit_log_session_info(ab);
		rc = audit_log_task_context(ab);
		if (rc)
		@@ -1362,7 +1362,10 @@ static int audit_receive_msg(struct sk_buff skb, struct nlmsghdr nlh)
		return -EINVAL;
		if (audit_enabled == AUDIT_LOCKED) {
		audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE);
		audit_log_format(ab, " audit_enabled=%d res=0", audit_enabled);
		audit_log_format(ab, " op=%s audit_enabled=%d res=0",
		msg_type == AUDIT_ADD_RULE ?
		"add_rule" : "remove_rule",
		audit_enabled);
		audit_log_end(ab);
		return -EPERM;
		}

Admin message