Commit 66b3f4f0 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'upstream' of git://git.infradead.org/users/pcmoore/audit 

Pull audit fixes from Paul Moore:
 "Four patches to fix various problems with the audit subsystem, all are
  fairly small and straightforward.

  One patch fixes a problem where we weren't using the correct gfp
  allocation flags (GFP_KERNEL regardless of context, oops), one patch
  fixes a problem with old userspace tools (this was broken for a
  while), one patch fixes a problem where we weren't recording pathnames
  correctly, and one fixes a problem with PID based filters.

  In general I don't think there is anything controversial with this
  patchset, and it fixes some rather unfortunate bugs; the allocation
  flag one can be particularly scary looking for users"

* 'upstream' of git://git.infradead.org/users/pcmoore/audit:
  audit: restore AUDIT_LOGINUID unset ABI
  audit: correctly record file names with different path name types
  audit: use supplied gfp_mask from audit_buffer in kauditd_send_multicast_skb
  audit: don't attempt to lookup PIDs when changing PID filtering audit rules
parents 53262d12 041d7b98

include/linux/audit.h

+4 −0
Original line number Diff line number Diff line
@@ -47,6 +47,7 @@ struct sk_buff; 


struct audit_krule {

	int			vers_ops;

	u32			pflags;

	u32			flags;

	u32			listnr;

	u32			action;
@@ -64,6 +65,9 @@ struct audit_krule { 
	u64			prio;

};



/* Flag to indicate legacy AUDIT_LOGINUID unset usage */

#define AUDIT_LOGINUID_LEGACY		0x1



struct audit_field {

	u32				type;

	union {

kernel/audit.c

+4 −4
Original line number Diff line number Diff line
@@ -429,7 +429,7 @@ static void kauditd_send_skb(struct sk_buff *skb) 
 * This function doesn't consume an skb as might be expected since it has to

 * copy it anyways.

 */

static void kauditd_send_multicast_skb(struct sk_buff *skb)

static void kauditd_send_multicast_skb(struct sk_buff *skb, gfp_t gfp_mask)

{

	struct sk_buff		*copy;

	struct audit_net	*aunet = net_generic(&init_net, audit_net_id);
@@ -448,11 +448,11 @@ static void kauditd_send_multicast_skb(struct sk_buff *skb) 
	 * no reason for new multicast clients to continue with this

	 * non-compliance.

	 */

	copy = skb_copy(skb, GFP_KERNEL);

	copy = skb_copy(skb, gfp_mask);

	if (!copy)

		return;



	nlmsg_multicast(sock, copy, 0, AUDIT_NLGRP_READLOG, GFP_KERNEL);

	nlmsg_multicast(sock, copy, 0, AUDIT_NLGRP_READLOG, gfp_mask);

}



/*
@@ -1940,7 +1940,7 @@ void audit_log_end(struct audit_buffer *ab) 
		struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);



		nlh->nlmsg_len = ab->skb->len;

		kauditd_send_multicast_skb(ab->skb);

		kauditd_send_multicast_skb(ab->skb, ab->gfp_mask);



		/*

		 * The original kaudit unicast socket sends up messages with

kernel/auditfilter.c

+10 −13
Original line number Diff line number Diff line
@@ -442,19 +442,7 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data, 
		if ((f->type == AUDIT_LOGINUID) && (f->val == AUDIT_UID_UNSET)) {

			f->type = AUDIT_LOGINUID_SET;

			f->val = 0;

		}



		if ((f->type == AUDIT_PID) || (f->type == AUDIT_PPID)) {

			struct pid *pid;

			rcu_read_lock();

			pid = find_vpid(f->val);

			if (!pid) {

				rcu_read_unlock();

				err = -ESRCH;

				goto exit_free;

			}

			f->val = pid_nr(pid);

			rcu_read_unlock();

			entry->rule.pflags |= AUDIT_LOGINUID_LEGACY;

		}



		err = audit_field_valid(entry, f);
@@ -630,6 +618,13 @@ static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule) 
			data->buflen += data->values[i] =

				audit_pack_string(&bufp, krule->filterkey);

			break;

		case AUDIT_LOGINUID_SET:

			if (krule->pflags & AUDIT_LOGINUID_LEGACY && !f->val) {

				data->fields[i] = AUDIT_LOGINUID;

				data->values[i] = AUDIT_UID_UNSET;

				break;

			}

			/* fallthrough if set */

		default:

			data->values[i] = f->val;

		}
@@ -646,6 +641,7 @@ static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b) 
	int i;



	if (a->flags != b->flags ||

	    a->pflags != b->pflags ||

	    a->listnr != b->listnr ||

	    a->action != b->action ||

	    a->field_count != b->field_count)
@@ -764,6 +760,7 @@ struct audit_entry *audit_dupe_rule(struct audit_krule *old) 
	new = &entry->rule;

	new->vers_ops = old->vers_ops;

	new->flags = old->flags;

	new->pflags = old->pflags;

	new->listnr = old->listnr;

	new->action = old->action;

	for (i = 0; i < AUDIT_BITMASK_SIZE; i++)

kernel/auditsc.c

+10 −4
Original line number Diff line number Diff line
@@ -1877,12 +1877,18 @@ void __audit_inode(struct filename *name, const struct dentry *dentry, 
	}



out_alloc:

	/* unable to find the name from a previous getname(). Allocate a new

	 * anonymous entry.

	 */

	n = audit_alloc_name(context, AUDIT_TYPE_NORMAL);

	/* unable to find an entry with both a matching name and type */

	n = audit_alloc_name(context, AUDIT_TYPE_UNKNOWN);

	if (!n)

		return;

	if (name)

		/* since name is not NULL we know there is already a matching

		 * name record, see audit_getname(), so there must be a type

		 * mismatch; reuse the string path since the original name

		 * record will keep the string valid until we free it in

		 * audit_free_names() */

		n->name = name;



out:

	if (parent) {

		n->name_len = n->name ? parent_len(n->name->name) : AUDIT_NAME_FULL;

CRA Git | Maintained and supported by SUSTech CRA and CCSE