Commit be37f21a authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'audit-pr-20190305' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit 

Pull audit updates from Paul Moore:
 "A lucky 13 audit patches for v5.1.

  Despite the rather large diffstat, most of the changes are from two
  bug fix patches that move code from one Kconfig option to another.

  Beyond that bit of churn, the remaining changes are largely cleanups
  and bug-fixes as we slowly march towards container auditing. It isn't
  all boring though, we do have a couple of new things: file
  capabilities v3 support, and expanded support for filtering on
  filesystems to solve problems with remote filesystems.

  All changes pass the audit-testsuite.  Please merge for v5.1"

* tag 'audit-pr-20190305' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
  audit: mark expected switch fall-through
  audit: hide auditsc_get_stamp and audit_serial prototypes
  audit: join tty records to their syscall
  audit: remove audit_context when CONFIG_ AUDIT and not AUDITSYSCALL
  audit: remove unused actx param from audit_rule_match
  audit: ignore fcaps on umount
  audit: clean up AUDITSYSCALL prototypes and stubs
  audit: more filter PATH records keyed on filesystem magic
  audit: add support for fcaps v3
  audit: move loginuid and sessionid from CONFIG_AUDITSYSCALL to CONFIG_AUDIT
  audit: add syscall information to CONFIG_CHANGE records
  audit: hand taken context to audit_kill_trees for syscall logging
  audit: give a clue what CONFIG_CHANGE op was involved
parents 3ac96c30 131d34cb

drivers/tty/tty_audit.c

+1 −1
Original line number Diff line number Diff line
@@ -66,7 +66,7 @@ static void tty_audit_log(const char *description, dev_t dev, 
	uid_t loginuid = from_kuid(&init_user_ns, audit_get_loginuid(current));

	unsigned int sessionid = audit_get_sessionid(current);



	ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_TTY);

	ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_TTY);

	if (ab) {

		char name[sizeof(current->comm)];

fs/namei.c

+1 −1
Original line number Diff line number Diff line
@@ -2720,7 +2720,7 @@ filename_mountpoint(int dfd, struct filename *name, struct path *path, 
	if (unlikely(error == -ESTALE))

		error = path_mountpoint(&nd, flags | LOOKUP_REVAL, path);

	if (likely(!error))

		audit_inode(name, path->dentry, 0);

		audit_inode(name, path->dentry, flags & LOOKUP_NO_EVAL);

	restore_nameidata();

	putname(name);

	return error;

fs/namespace.c

+2 −0
Original line number Diff line number Diff line
@@ -1640,6 +1640,8 @@ int ksys_umount(char __user *name, int flags) 
	if (!(flags & UMOUNT_NOFOLLOW))

		lookup_flags |= LOOKUP_FOLLOW;



	lookup_flags |= LOOKUP_NO_EVAL;



	retval = user_path_mountpoint_at(AT_FDCWD, name, lookup_flags, &path);

	if (retval)

		goto out;

fs/proc/base.c

+3 −3
Original line number Diff line number Diff line
@@ -1210,7 +1210,7 @@ static const struct file_operations proc_oom_score_adj_operations = { 
	.llseek		= default_llseek,

};



#ifdef CONFIG_AUDITSYSCALL

#ifdef CONFIG_AUDIT

#define TMPBUFLEN 11

static ssize_t proc_loginuid_read(struct file * file, char __user * buf,

				  size_t count, loff_t *ppos)
@@ -3044,7 +3044,7 @@ static const struct pid_entry tgid_base_stuff[] = { 
	ONE("oom_score",  S_IRUGO, proc_oom_score),

	REG("oom_adj",    S_IRUGO|S_IWUSR, proc_oom_adj_operations),

	REG("oom_score_adj", S_IRUGO|S_IWUSR, proc_oom_score_adj_operations),

#ifdef CONFIG_AUDITSYSCALL

#ifdef CONFIG_AUDIT

	REG("loginuid",   S_IWUSR|S_IRUGO, proc_loginuid_operations),

	REG("sessionid",  S_IRUGO, proc_sessionid_operations),

#endif
@@ -3432,7 +3432,7 @@ static const struct pid_entry tid_base_stuff[] = { 
	ONE("oom_score", S_IRUGO, proc_oom_score),

	REG("oom_adj",   S_IRUGO|S_IWUSR, proc_oom_adj_operations),

	REG("oom_score_adj", S_IRUGO|S_IWUSR, proc_oom_score_adj_operations),

#ifdef CONFIG_AUDITSYSCALL

#ifdef CONFIG_AUDIT

	REG("loginuid",  S_IWUSR|S_IRUGO, proc_loginuid_operations),

	REG("sessionid",  S_IRUGO, proc_sessionid_operations),

#endif

include/linux/audit.h

+33 −33
Original line number Diff line number Diff line
@@ -25,6 +25,7 @@ 


#include <linux/sched.h>

#include <linux/ptrace.h>

#include <linux/namei.h>  /* LOOKUP_* */

#include <uapi/linux/audit.h>



#define AUDIT_INO_UNSET ((unsigned long)-1)
@@ -159,6 +160,18 @@ extern int audit_update_lsm_rules(void); 
extern int audit_rule_change(int type, int seq, void *data, size_t datasz);

extern int audit_list_rules_send(struct sk_buff *request_skb, int seq);



extern int audit_set_loginuid(kuid_t loginuid);



static inline kuid_t audit_get_loginuid(struct task_struct *tsk)

{

	return tsk->loginuid;

}



static inline unsigned int audit_get_sessionid(struct task_struct *tsk)

{

	return tsk->sessionid;

}



extern u32 audit_enabled;

#else /* CONFIG_AUDIT */

static inline __printf(4, 5)
@@ -201,6 +214,17 @@ static inline int audit_log_task_context(struct audit_buffer *ab) 
}

static inline void audit_log_task_info(struct audit_buffer *ab)

{ }



static inline kuid_t audit_get_loginuid(struct task_struct *tsk)

{

	return INVALID_UID;

}



static inline unsigned int audit_get_sessionid(struct task_struct *tsk)

{

	return AUDIT_SID_UNSET;

}



#define audit_enabled AUDIT_OFF

#endif /* CONFIG_AUDIT */
@@ -225,6 +249,7 @@ extern void __audit_getname(struct filename *name); 


#define AUDIT_INODE_PARENT	1	/* dentry represents the parent */

#define AUDIT_INODE_HIDDEN	2	/* audit record should be hidden */

#define AUDIT_INODE_NOEVAL	4	/* audit record incomplete */

extern void __audit_inode(struct filename *name, const struct dentry *dentry,

				unsigned int flags);

extern void __audit_file(const struct file *);
@@ -285,12 +310,15 @@ static inline void audit_getname(struct filename *name) 
}

static inline void audit_inode(struct filename *name,

				const struct dentry *dentry,

				unsigned int parent) {

				unsigned int flags) {

	if (unlikely(!audit_dummy_context())) {

		unsigned int flags = 0;

		if (parent)

			flags |= AUDIT_INODE_PARENT;

		__audit_inode(name, dentry, flags);

		unsigned int aflags = 0;



		if (flags & LOOKUP_PARENT)

			aflags |= AUDIT_INODE_PARENT;

		if (flags & LOOKUP_NO_EVAL)

			aflags |= AUDIT_INODE_NOEVAL;

		__audit_inode(name, dentry, aflags);

	}

}

static inline void audit_file(struct file *file)
@@ -320,21 +348,6 @@ static inline void audit_ptrace(struct task_struct *t) 
}



				/* Private API (for audit.c only) */

extern unsigned int audit_serial(void);

extern int auditsc_get_stamp(struct audit_context *ctx,

			      struct timespec64 *t, unsigned int *serial);

extern int audit_set_loginuid(kuid_t loginuid);



static inline kuid_t audit_get_loginuid(struct task_struct *tsk)

{

	return tsk->loginuid;

}



static inline unsigned int audit_get_sessionid(struct task_struct *tsk)

{

	return tsk->sessionid;

}



extern void __audit_ipc_obj(struct kern_ipc_perm *ipcp);

extern void __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode);

extern void __audit_bprm(struct linux_binprm *bprm);
@@ -514,19 +527,6 @@ static inline void audit_seccomp(unsigned long syscall, long signr, int code) 
static inline void audit_seccomp_actions_logged(const char *names,

						const char *old_names, int res)

{ }

static inline int auditsc_get_stamp(struct audit_context *ctx,

			      struct timespec64 *t, unsigned int *serial)

{

	return 0;

}

static inline kuid_t audit_get_loginuid(struct task_struct *tsk)

{

	return INVALID_UID;

}

static inline unsigned int audit_get_sessionid(struct task_struct *tsk)

{

	return AUDIT_SID_UNSET;

}

static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)

{ }

static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid,

CRA Git | Maintained and supported by SUSTech CRA and CCSE