Commit 8ac68dc4 authored by Paul Moore's avatar Paul Moore
Browse files

revert: 1320a405 ("audit: trigger accompanying records when no rules present") 



Unfortunately the commit listed in the subject line above failed
to ensure that the task's audit_context was properly initialized/set
before enabling the "accompanying records".  Depending on the
situation, the resulting audit_context could have invalid values in
some of it's fields which could cause a kernel panic/oops when the
task/syscall exists and the audit records are generated.

We will revisit the original patch, with the necessary fixes, in a
future kernel but right now we just want to fix the kernel panic
with the least amount of added risk.

Cc: stable@vger.kernel.org
Fixes: 1320a405 ("audit: trigger accompanying records when no rules present")
Reported-by: default avatar <j2468h@googlemail.com>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 9d44a121

kernel/audit.c

+0 −1
Original line number Diff line number Diff line
@@ -1848,7 +1848,6 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, 
	}



	audit_get_stamp(ab->ctx, &t, &serial);

	audit_clear_dummy(ab->ctx);

	audit_log_format(ab, "audit(%llu.%03lu:%u): ",

			 (unsigned long long)t.tv_sec, t.tv_nsec/1000000, serial);

kernel/audit.h

+0 −8
Original line number Diff line number Diff line
@@ -290,13 +290,6 @@ extern int audit_signal_info_syscall(struct task_struct *t); 
extern void audit_filter_inodes(struct task_struct *tsk,

				struct audit_context *ctx);

extern struct list_head *audit_killed_trees(void);



static inline void audit_clear_dummy(struct audit_context *ctx)

{

	if (ctx)

		ctx->dummy = 0;

}



#else /* CONFIG_AUDITSYSCALL */

#define auditsc_get_stamp(c, t, s) 0

#define audit_put_watch(w) {}
@@ -330,7 +323,6 @@ static inline int audit_signal_info_syscall(struct task_struct *t) 
}



#define audit_filter_inodes(t, c) AUDIT_DISABLED

#define audit_clear_dummy(c) {}

#endif /* CONFIG_AUDITSYSCALL */



extern char *audit_unpack_string(void **bufp, size_t *remain, size_t len);

kernel/auditsc.c

+3 −0
Original line number Diff line number Diff line
@@ -1417,6 +1417,9 @@ static void audit_log_proctitle(void) 
	struct audit_context *context = audit_context();

	struct audit_buffer *ab;



	if (!context || context->dummy)

		return;



	ab = audit_log_start(context, GFP_KERNEL, AUDIT_PROCTITLE);

	if (!ab)

		return;	/* audit_panic or being filtered */

CRA Git | Maintained and supported by SUSTech CRA and CCSE