Commit 8b5c6a3a authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'audit-pr-20180605' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit 

Pull audit updates from Paul Moore:
 "Another reasonable chunk of audit changes for v4.18, thirteen patches
  in total.

  The thirteen patches can mostly be broken down into one of four
  categories: general bug fixes, accessor functions for audit state
  stored in the task_struct, negative filter matches on executable
  names, and extending the (relatively) new seccomp logging knobs to the
  audit subsystem.

  The main driver for the accessor functions from Richard are the
  changes we're working on to associate audit events with containers,
  but I think they have some standalone value too so I figured it would
  be good to get them in now.

  The seccomp/audit patches from Tyler apply the seccomp logging
  improvements from a few releases ago to audit's seccomp logging;
  starting with this patchset the changes in
  /proc/sys/kernel/seccomp/actions_logged should apply to both the
  standard kernel logging and audit.

  As usual, everything passes the audit-testsuite and it happens to
  merge cleanly with your tree"

[ Heh, except it had trivial merge conflicts with the SELinux tree that
  also came in from Paul   - Linus ]

* tag 'audit-pr-20180605' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
  audit: Fix wrong task in comparison of session ID
  audit: use existing session info function
  audit: normalize loginuid read access
  audit: use new audit_context access funciton for seccomp_actions_logged
  audit: use inline function to set audit context
  audit: use inline function to get audit context
  audit: convert sessionid unset to a macro
  seccomp: Don't special case audited processes when logging
  seccomp: Audit attempts to modify the actions_logged sysctl
  seccomp: Configurable separator for the actions_logged string
  seccomp: Separate read and write code for actions_logged sysctl
  audit: allow not equal op for audit by executable
  audit: add syscall information to FEATURE_CHANGE records
parents 8b70543e 5b713886

Documentation/userspace-api/seccomp_filter.rst

+0 −7
Original line number Diff line number Diff line
@@ -207,13 +207,6 @@ directory. Here's a description of each file in that directory: 
	to the file do not need to be in ordered form but reads from the file

	will be ordered in the same way as the actions_avail sysctl.



	It is important to note that the value of ``actions_logged`` does not

	prevent certain actions from being logged when the audit subsystem is

	configured to audit a task. If the action is not found in

	``actions_logged`` list, the final decision on whether to audit the

	action for that task is ultimately left up to the audit subsystem to

	decide for all seccomp return values other than ``SECCOMP_RET_ALLOW``.



	The ``allow`` string is not accepted in the ``actions_logged`` sysctl

	as it is not possible to log ``SECCOMP_RET_ALLOW`` actions. Attempting

	to write ``allow`` to the sysctl will result in an EINVAL being

include/linux/audit.h

+26 −13
Original line number Diff line number Diff line
@@ -232,12 +232,24 @@ extern void __audit_file(const struct file *); 
extern void __audit_inode_child(struct inode *parent,

				const struct dentry *dentry,

				const unsigned char type);

extern void __audit_seccomp(unsigned long syscall, long signr, int code);

extern void audit_seccomp(unsigned long syscall, long signr, int code);

extern void audit_seccomp_actions_logged(const char *names,

					 const char *old_names, int res);

extern void __audit_ptrace(struct task_struct *t);



static inline void audit_set_context(struct task_struct *task, struct audit_context *ctx)

{

	task->audit_context = ctx;

}



static inline struct audit_context *audit_context(void)

{

	return current->audit_context;

}



static inline bool audit_dummy_context(void)

{

	void *p = current->audit_context;

	void *p = audit_context();

	return !p || *(int *)p;

}

static inline void audit_free(struct task_struct *task)
@@ -249,12 +261,12 @@ static inline void audit_syscall_entry(int major, unsigned long a0, 
				       unsigned long a1, unsigned long a2,

				       unsigned long a3)

{

	if (unlikely(current->audit_context))

	if (unlikely(audit_context()))

		__audit_syscall_entry(major, a0, a1, a2, a3);

}

static inline void audit_syscall_exit(void *pt_regs)

{

	if (unlikely(current->audit_context)) {

	if (unlikely(audit_context())) {

		int success = is_syscall_success(pt_regs);

		long return_code = regs_return_value(pt_regs);
@@ -302,12 +314,6 @@ static inline void audit_inode_child(struct inode *parent, 
}

void audit_core_dumps(long signr);



static inline void audit_seccomp(unsigned long syscall, long signr, int code)

{

	if (audit_enabled && unlikely(!audit_dummy_context()))

		__audit_seccomp(syscall, signr, code);

}



static inline void audit_ptrace(struct task_struct *t)

{

	if (unlikely(!audit_dummy_context()))
@@ -468,6 +474,12 @@ static inline bool audit_dummy_context(void) 
{

	return true;

}

static inline void audit_set_context(struct task_struct *task, struct audit_context *ctx)

{ }

static inline struct audit_context *audit_context(void)

{

	return NULL;

}

static inline struct filename *audit_reusename(const __user char *name)

{

	return NULL;
@@ -498,10 +510,11 @@ static inline void audit_inode_child(struct inode *parent, 
{ }

static inline void audit_core_dumps(long signr)

{ }

static inline void __audit_seccomp(unsigned long syscall, long signr, int code)

{ }

static inline void audit_seccomp(unsigned long syscall, long signr, int code)

{ }

static inline void audit_seccomp_actions_logged(const char *names,

						const char *old_names, int res)

{ }

static inline int auditsc_get_stamp(struct audit_context *ctx,

			      struct timespec64 *t, unsigned int *serial)

{
@@ -513,7 +526,7 @@ static inline kuid_t audit_get_loginuid(struct task_struct *tsk) 
}

static inline unsigned int audit_get_sessionid(struct task_struct *tsk)

{

	return -1;

	return AUDIT_SID_UNSET;

}

static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)

{ }

include/net/xfrm.h

+2 −2
Original line number Diff line number Diff line
@@ -737,7 +737,7 @@ static inline struct audit_buffer *xfrm_audit_start(const char *op) 


	if (audit_enabled == 0)

		return NULL;

	audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC,

	audit_buf = audit_log_start(audit_context(), GFP_ATOMIC,

				    AUDIT_MAC_IPSEC_EVENT);

	if (audit_buf == NULL)

		return NULL;
@@ -752,7 +752,7 @@ static inline void xfrm_audit_helper_usrinfo(bool task_valid, 
					    audit_get_loginuid(current) :

					    INVALID_UID);

	const unsigned int ses = task_valid ? audit_get_sessionid(current) :

		(unsigned int) -1;

		AUDIT_SID_UNSET;



	audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses);

	audit_log_task_context(audit_buf);

include/uapi/linux/audit.h

+1 −0
Original line number Diff line number Diff line
@@ -465,6 +465,7 @@ struct audit_tty_status { 
};



#define AUDIT_UID_UNSET (unsigned int)-1

#define AUDIT_SID_UNSET ((unsigned int)-1)



/* audit_rule_data supports filter rules with both integer and string

 * fields.  It corresponds with AUDIT_ADD_RULE, AUDIT_DEL_RULE and

init/init_task.c

+2 −1
Original line number Diff line number Diff line
@@ -9,6 +9,7 @@ 
#include <linux/init.h>

#include <linux/fs.h>

#include <linux/mm.h>

#include <linux/audit.h>



#include <asm/pgtable.h>

#include <linux/uaccess.h>
@@ -119,7 +120,7 @@ struct task_struct init_task 
	.thread_node	= LIST_HEAD_INIT(init_signals.thread_head),

#ifdef CONFIG_AUDITSYSCALL

	.loginuid	= INVALID_UID,

	.sessionid	= (unsigned int)-1,

	.sessionid	= AUDIT_SID_UNSET,

#endif

#ifdef CONFIG_PERF_EVENTS

	.perf_event_mutex = __MUTEX_INITIALIZER(init_task.perf_event_mutex),

CRA Git | Maintained and supported by SUSTech CRA and CCSE