Commit b8989bcc authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'stable-4.11' of git://git.infradead.org/users/pcmoore/audit 

Pull audit updates from Paul Moore:
 "The audit changes for v4.11 are relatively small compared to what we
  did for v4.10, both in terms of size and impact.

   - two patches from Steve tweak the formatting for some of the audit
     records to make them more consistent with other audit records.

   - three patches from Richard record the name of a module on module
     load, fix the logging of sockaddr information when using
     socketcall() on 32-bit systems, and add the ability to reset
     audit's lost record counter.

   - my lone patch just fixes an annoying style nit that I was reminded
     about by one of Richard's patches.

  All these patches pass our test suite"

* 'stable-4.11' of git://git.infradead.org/users/pcmoore/audit:
  audit: remove unnecessary curly braces from switch/case statements
  audit: log module name on init_module
  audit: log 32-bit socketcalls
  audit: add feature audit_lost reset
  audit: Make AUDIT_ANOM_ABEND event normalized
  audit: Make AUDIT_KERNEL event conform to the specification
parents c9341ee0 fe8e52b9

include/linux/audit.h

+32 −0
Original line number Diff line number Diff line
@@ -360,6 +360,7 @@ extern int __audit_log_bprm_fcaps(struct linux_binprm *bprm, 
				  const struct cred *old);

extern void __audit_log_capset(const struct cred *new, const struct cred *old);

extern void __audit_mmap_fd(int fd, int flags);

extern void __audit_log_kern_module(char *name);



static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)

{
@@ -387,6 +388,20 @@ static inline int audit_socketcall(int nargs, unsigned long *args) 
		return __audit_socketcall(nargs, args);

	return 0;

}



static inline int audit_socketcall_compat(int nargs, u32 *args)

{

	unsigned long a[AUDITSC_ARGS];

	int i;



	if (audit_dummy_context())

		return 0;



	for (i = 0; i < nargs; i++)

		a[i] = (unsigned long)args[i];

	return __audit_socketcall(nargs, a);

}



static inline int audit_sockaddr(int len, void *addr)

{

	if (unlikely(!audit_dummy_context()))
@@ -436,6 +451,12 @@ static inline void audit_mmap_fd(int fd, int flags) 
		__audit_mmap_fd(fd, flags);

}



static inline void audit_log_kern_module(char *name)

{

	if (!audit_dummy_context())

		__audit_log_kern_module(name);

}



extern int audit_n_rules;

extern int audit_signals;

#else /* CONFIG_AUDITSYSCALL */
@@ -513,6 +534,12 @@ static inline int audit_socketcall(int nargs, unsigned long *args) 
{

	return 0;

}



static inline int audit_socketcall_compat(int nargs, u32 *args)

{

	return 0;

}



static inline void audit_fd_pair(int fd1, int fd2)

{ }

static inline int audit_sockaddr(int len, void *addr)
@@ -541,6 +568,11 @@ static inline void audit_log_capset(const struct cred *new, 
{ }

static inline void audit_mmap_fd(int fd, int flags)

{ }



static inline void audit_log_kern_module(char *name)

{

}



static inline void audit_ptrace(struct task_struct *t)

{ }

#define audit_n_rules 0

include/uapi/linux/audit.h

+6 −1
Original line number Diff line number Diff line
@@ -111,6 +111,7 @@ 
#define AUDIT_PROCTITLE		1327	/* Proctitle emit event */

#define AUDIT_FEATURE_CHANGE	1328	/* audit log listing feature changes */

#define AUDIT_REPLACE		1329	/* Replace auditd if this packet unanswerd */

#define AUDIT_KERN_MODULE	1330	/* Kernel Module events */



#define AUDIT_AVC		1400	/* SE Linux avc denial or grant */

#define AUDIT_SELINUX_ERR	1401	/* Internal SE Linux Errors */
@@ -326,17 +327,21 @@ enum { 
#define AUDIT_STATUS_RATE_LIMIT		0x0008

#define AUDIT_STATUS_BACKLOG_LIMIT	0x0010

#define AUDIT_STATUS_BACKLOG_WAIT_TIME	0x0020

#define AUDIT_STATUS_LOST		0x0040



#define AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT	0x00000001

#define AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME	0x00000002

#define AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH	0x00000004

#define AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND	0x00000008

#define AUDIT_FEATURE_BITMAP_SESSIONID_FILTER	0x00000010

#define AUDIT_FEATURE_BITMAP_LOST_RESET		0x00000020



#define AUDIT_FEATURE_BITMAP_ALL (AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT | \

				  AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME | \

				  AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH | \

				  AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND | \

				  AUDIT_FEATURE_BITMAP_SESSIONID_FILTER)

				  AUDIT_FEATURE_BITMAP_SESSIONID_FILTER | \

				  AUDIT_FEATURE_BITMAP_LOST_RESET)



/* deprecated: AUDIT_VERSION_* */

#define AUDIT_VERSION_LATEST 		AUDIT_FEATURE_BITMAP_ALL

kernel/audit.c

+10 −2
Original line number Diff line number Diff line
@@ -1058,6 +1058,12 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) 
			if (err < 0)

				return err;

		}

		if (s.mask == AUDIT_STATUS_LOST) {

			u32 lost = atomic_xchg(&audit_lost, 0);



			audit_log_config_change("lost", 0, lost, 1);

			return lost;

		}

		break;

	}

	case AUDIT_GET_FEATURE:
@@ -1349,7 +1355,9 @@ static int __init audit_init(void) 
		panic("audit: failed to start the kauditd thread (%d)\n", err);

	}



	audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized");

	audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL,

		"state=initialized audit_enabled=%u res=1",

		 audit_enabled);



	return 0;

}

kernel/audit.h

+3 −0
Original line number Diff line number Diff line
@@ -199,6 +199,9 @@ struct audit_context { 
		struct {

			int			argc;

		} execve;

		struct {

			char			*name;

		} module;

	};

	int fds[2];

	struct audit_proctitle proctitle;

kernel/auditsc.c

+27 −13
Original line number Diff line number Diff line
@@ -1221,7 +1221,7 @@ static void show_special(struct audit_context *context, int *call_panic) 
				context->ipc.perm_mode);

		}

		break; }

	case AUDIT_MQ_OPEN: {

	case AUDIT_MQ_OPEN:

		audit_log_format(ab,

			"oflag=0x%x mode=%#ho mq_flags=0x%lx mq_maxmsg=%ld "

			"mq_msgsize=%ld mq_curmsgs=%ld",
@@ -1230,8 +1230,8 @@ static void show_special(struct audit_context *context, int *call_panic) 
			context->mq_open.attr.mq_maxmsg,

			context->mq_open.attr.mq_msgsize,

			context->mq_open.attr.mq_curmsgs);

		break; }

	case AUDIT_MQ_SENDRECV: {

		break;

	case AUDIT_MQ_SENDRECV:

		audit_log_format(ab,

			"mqdes=%d msg_len=%zd msg_prio=%u "

			"abs_timeout_sec=%ld abs_timeout_nsec=%ld",
@@ -1240,12 +1240,12 @@ static void show_special(struct audit_context *context, int *call_panic) 
			context->mq_sendrecv.msg_prio,

			context->mq_sendrecv.abs_timeout.tv_sec,

			context->mq_sendrecv.abs_timeout.tv_nsec);

		break; }

	case AUDIT_MQ_NOTIFY: {

		break;

	case AUDIT_MQ_NOTIFY:

		audit_log_format(ab, "mqdes=%d sigev_signo=%d",

				context->mq_notify.mqdes,

				context->mq_notify.sigev_signo);

		break; }

		break;

	case AUDIT_MQ_GETSETATTR: {

		struct mq_attr *attr = &context->mq_getsetattr.mqstat;

		audit_log_format(ab,
@@ -1255,19 +1255,24 @@ static void show_special(struct audit_context *context, int *call_panic) 
			attr->mq_flags, attr->mq_maxmsg,

			attr->mq_msgsize, attr->mq_curmsgs);

		break; }

	case AUDIT_CAPSET: {

	case AUDIT_CAPSET:

		audit_log_format(ab, "pid=%d", context->capset.pid);

		audit_log_cap(ab, "cap_pi", &context->capset.cap.inheritable);

		audit_log_cap(ab, "cap_pp", &context->capset.cap.permitted);

		audit_log_cap(ab, "cap_pe", &context->capset.cap.effective);

		break; }

	case AUDIT_MMAP: {

		break;

	case AUDIT_MMAP:

		audit_log_format(ab, "fd=%d flags=0x%x", context->mmap.fd,

				 context->mmap.flags);

		break; }

	case AUDIT_EXECVE: {

		break;

	case AUDIT_EXECVE:

		audit_log_execve_info(context, &ab);

		break; }

		break;

	case AUDIT_KERN_MODULE:

		audit_log_format(ab, "name=");

		audit_log_untrustedstring(ab, context->module.name);

		kfree(context->module.name);

		break;

	}

	audit_log_end(ab);

}
@@ -2368,6 +2373,15 @@ void __audit_mmap_fd(int fd, int flags) 
	context->type = AUDIT_MMAP;

}



void __audit_log_kern_module(char *name)

{

	struct audit_context *context = current->audit_context;



	context->module.name = kmalloc(strlen(name) + 1, GFP_KERNEL);

	strcpy(context->module.name, name);

	context->type = AUDIT_KERN_MODULE;

}



static void audit_log_task(struct audit_buffer *ab)

{

	kuid_t auid, uid;
@@ -2411,7 +2425,7 @@ void audit_core_dumps(long signr) 
	if (unlikely(!ab))

		return;

	audit_log_task(ab);

	audit_log_format(ab, " sig=%ld", signr);

	audit_log_format(ab, " sig=%ld res=1", signr);

	audit_log_end(ab);

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE