Commit 90462a5b authored by Richard Guy Briggs's avatar Richard Guy Briggs Committed by Paul Moore
Browse files

audit: remove unused actx param from audit_rule_match 

The audit_rule_match() struct audit_context *actx parameter is not used
by any in-tree consumers (selinux, apparmour, integrity, smack).

The audit context is an internal audit structure that should only be
accessed by audit accessor functions.

It was part of commit 03d37d25 ("LSM/Audit: Introduce generic
Audit LSM hooks") but appears to have never been used.

Remove it.

Please see the github issue
https://github.com/linux-audit/audit-kernel/issues/107



Signed-off-by: default avatarRichard Guy Briggs <rgb@redhat.com>
[PM: fixed the referenced commit title]
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 57d46577

include/linux/lsm_hooks.h

+1 −3
Original line number Diff line number Diff line
@@ -1344,7 +1344,6 @@ 
 *	@field contains the field which relates to current LSM.

 *	@op contains the operator that will be used for matching.

 *	@rule points to the audit rule that will be checked against.

 *	@actx points to the audit context associated with the check.

 *	Return 1 if secid matches the rule, 0 if it does not, -ERRNO on failure.

 *

 * @audit_rule_free:
@@ -1764,8 +1763,7 @@ union security_list_options { 
	int (*audit_rule_init)(u32 field, u32 op, char *rulestr,

				void **lsmrule);

	int (*audit_rule_known)(struct audit_krule *krule);

	int (*audit_rule_match)(u32 secid, u32 field, u32 op, void *lsmrule,

				struct audit_context *actx);

	int (*audit_rule_match)(u32 secid, u32 field, u32 op, void *lsmrule);

	void (*audit_rule_free)(void *lsmrule);

#endif /* CONFIG_AUDIT */

include/linux/security.h

+2 −3
Original line number Diff line number Diff line
@@ -1674,8 +1674,7 @@ static inline int security_key_getsecurity(struct key *key, char **_buffer) 
#ifdef CONFIG_SECURITY

int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule);

int security_audit_rule_known(struct audit_krule *krule);

int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule,

			      struct audit_context *actx);

int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule);

void security_audit_rule_free(void *lsmrule);



#else
@@ -1692,7 +1691,7 @@ static inline int security_audit_rule_known(struct audit_krule *krule) 
}



static inline int security_audit_rule_match(u32 secid, u32 field, u32 op,

				   void *lsmrule, struct audit_context *actx)

					    void *lsmrule)

{

	return 0;

}

kernel/auditfilter.c

+1 −1
Original line number Diff line number Diff line
@@ -1355,7 +1355,7 @@ int audit_filter(int msgtype, unsigned int listtype) 
				if (f->lsm_rule) {

					security_task_getsecid(current, &sid);

					result = security_audit_rule_match(sid,

							f->type, f->op, f->lsm_rule, NULL);

						   f->type, f->op, f->lsm_rule);

				}

				break;

			case AUDIT_EXE:

kernel/auditsc.c

+12 −9
Original line number Diff line number Diff line
@@ -632,8 +632,7 @@ static int audit_filter_rules(struct task_struct *tsk, 
				}

				result = security_audit_rule_match(sid, f->type,

								   f->op,

				                                  f->lsm_rule,

				                                  ctx);

								   f->lsm_rule);

			}

			break;

		case AUDIT_OBJ_USER:
@@ -647,13 +646,17 @@ static int audit_filter_rules(struct task_struct *tsk, 
				/* Find files that match */

				if (name) {

					result = security_audit_rule_match(

					           name->osid, f->type, f->op,

					           f->lsm_rule, ctx);

								name->osid,

								f->type,

								f->op,

								f->lsm_rule);

				} else if (ctx) {

					list_for_each_entry(n, &ctx->names_list, list) {

						if (security_audit_rule_match(n->osid, f->type,

									      f->op, f->lsm_rule,

									      ctx)) {

						if (security_audit_rule_match(

								n->osid,

								f->type,

								f->op,

								f->lsm_rule)) {

							++result;

							break;

						}
@@ -664,7 +667,7 @@ static int audit_filter_rules(struct task_struct *tsk, 
					break;

				if (security_audit_rule_match(ctx->ipc.osid,

							      f->type, f->op,

							      f->lsm_rule, ctx))

							      f->lsm_rule))

					++result;

			}

			break;

security/apparmor/audit.c

+1 −2
Original line number Diff line number Diff line
@@ -225,8 +225,7 @@ int aa_audit_rule_known(struct audit_krule *rule) 
	return 0;

}



int aa_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule,

			struct audit_context *actx)

int aa_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule)

{

	struct aa_audit_rule *rule = vrule;

	struct aa_label *label;

CRA Git | Maintained and supported by SUSTech CRA and CCSE