Commit dd6ccfe6 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'audit.b39' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current 

* 'audit.b39' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current:
  [PATCH] get rid of AVC_PATH postponed treatment
  [PATCH] allow audit filtering on bit & operations
  [PATCH] audit: fix broken class-based syscall audit
  [PATCH] Make IPC mode consistent
parents dc797470 4259fa01

include/linux/audit.h

+17 −15
Original line number Diff line number Diff line
@@ -161,7 +161,7 @@ 
 * are currently used in an audit field constant understood by the kernel.

 * If you are adding a new #define AUDIT_<whatever>, please ensure that

 * AUDIT_UNUSED_BITS is updated if need be. */

#define AUDIT_UNUSED_BITS	0x0FFFFC00

#define AUDIT_UNUSED_BITS	0x07FFFC00





/* Rule fields */
@@ -213,25 +213,29 @@ 
#define AUDIT_NEGATE			0x80000000



/* These are the supported operators.

 *	4  2  1

 *	=  >  <

 *	-------

 *	0  0  0		0	nonsense

 *	0  0  1		1	<

 *	0  1  0		2	>

 *	0  1  1		3	!=

 *	1  0  0		4	=

 *	1  0  1		5	<=

 *	1  1  0		6	>=

 *	1  1  1		7	all operators

 *	4  2  1  8

 *	=  >  <  ?

 *	----------

 *	0  0  0	 0	00	nonsense

 *	0  0  0	 1	08	&  bit mask

 *	0  0  1	 0	10	<

 *	0  1  0	 0	20	>

 *	0  1  1	 0	30	!=

 *	1  0  0	 0	40	=

 *	1  0  0	 1	48	&=  bit test

 *	1  0  1	 0	50	<=

 *	1  1  0	 0	60	>=

 *	1  1  1	 1	78	all operators

 */

#define AUDIT_BIT_MASK			0x08000000

#define AUDIT_LESS_THAN			0x10000000

#define AUDIT_GREATER_THAN		0x20000000

#define AUDIT_NOT_EQUAL			0x30000000

#define AUDIT_EQUAL			0x40000000

#define AUDIT_BIT_TEST			(AUDIT_BIT_MASK|AUDIT_EQUAL)

#define AUDIT_LESS_THAN_OR_EQUAL	(AUDIT_LESS_THAN|AUDIT_EQUAL)

#define AUDIT_GREATER_THAN_OR_EQUAL	(AUDIT_GREATER_THAN|AUDIT_EQUAL)

#define AUDIT_OPERATORS			(AUDIT_EQUAL|AUDIT_NOT_EQUAL)

#define AUDIT_OPERATORS			(AUDIT_EQUAL|AUDIT_NOT_EQUAL|AUDIT_BIT_MASK)



/* Status symbols */

				/* Mask values */
@@ -407,7 +411,6 @@ extern int audit_bprm(struct linux_binprm *bprm); 
extern int audit_socketcall(int nargs, unsigned long *args);

extern int audit_sockaddr(int len, void *addr);

extern int __audit_fd_pair(int fd1, int fd2);

extern int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt);

extern int audit_set_macxattr(const char *name);

extern int __audit_mq_open(int oflag, mode_t mode, struct mq_attr __user *u_attr);

extern int __audit_mq_timedsend(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec __user *u_abs_timeout);
@@ -487,7 +490,6 @@ extern int audit_signals; 
#define audit_socketcall(n,a) ({ 0; })

#define audit_fd_pair(n,a) ({ 0; })

#define audit_sockaddr(len, addr) ({ 0; })

#define audit_avc_path(dentry, mnt) ({ 0; })

#define audit_set_macxattr(n) do { ; } while (0)

#define audit_mq_open(o,m,a) ({ 0; })

#define audit_mq_timedsend(d,l,p,t) ({ 0; })

kernel/auditfilter.c

+12 −1
Original line number Diff line number Diff line
@@ -304,7 +304,7 @@ int __init audit_register_class(int class, unsigned *list) 


int audit_match_class(int class, unsigned syscall)

{

	if (unlikely(syscall >= AUDIT_BITMASK_SIZE * sizeof(__u32)))

	if (unlikely(syscall >= AUDIT_BITMASK_SIZE * 32))

		return 0;

	if (unlikely(class >= AUDIT_SYSCALL_CLASSES || !classes[class]))

		return 0;
@@ -456,6 +456,13 @@ static struct audit_entry *audit_rule_to_entry(struct audit_rule *rule) 
		case AUDIT_DEVMINOR:

		case AUDIT_EXIT:

		case AUDIT_SUCCESS:

			/* bit ops are only useful on syscall args */

			if (f->op == AUDIT_BIT_MASK ||

						f->op == AUDIT_BIT_TEST) {

				err = -EINVAL;

				goto exit_free;

			}

			break;

		case AUDIT_ARG0:

		case AUDIT_ARG1:

		case AUDIT_ARG2:
@@ -1566,6 +1573,10 @@ int audit_comparator(const u32 left, const u32 op, const u32 right) 
		return (left > right);

	case AUDIT_GREATER_THAN_OR_EQUAL:

		return (left >= right);

	case AUDIT_BIT_MASK:

		return (left & right);

	case AUDIT_BIT_TEST:

		return ((left & right) == right);

	}

	BUG();

	return 0;

kernel/auditsc.c

+2 −49
Original line number Diff line number Diff line
@@ -173,12 +173,6 @@ struct audit_aux_data_fd_pair { 
	int	fd[2];

};



struct audit_aux_data_path {

	struct audit_aux_data	d;

	struct dentry		*dentry;

	struct vfsmount		*mnt;

};



struct audit_aux_data_pids {

	struct audit_aux_data	d;

	pid_t			target_pid[AUDIT_AUX_PIDS];
@@ -654,12 +648,6 @@ static inline void audit_free_aux(struct audit_context *context) 
	struct audit_aux_data *aux;



	while ((aux = context->aux)) {

		if (aux->type == AUDIT_AVC_PATH) {

			struct audit_aux_data_path *axi = (void *)aux;

			dput(axi->dentry);

			mntput(axi->mnt);

		}



		context->aux = aux->next;

		kfree(aux);

	}
@@ -995,7 +983,7 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts 
		case AUDIT_IPC: {

			struct audit_aux_data_ipcctl *axi = (void *)aux;

			audit_log_format(ab, 

				 "ouid=%u ogid=%u mode=%x",

				 "ouid=%u ogid=%u mode=%#o",

				 axi->uid, axi->gid, axi->mode);

			if (axi->osid != 0) {

				char *ctx = NULL;
@@ -1014,7 +1002,7 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts 
		case AUDIT_IPC_SET_PERM: {

			struct audit_aux_data_ipcctl *axi = (void *)aux;

			audit_log_format(ab,

				"qbytes=%lx ouid=%u ogid=%u mode=%x",

				"qbytes=%lx ouid=%u ogid=%u mode=%#o",

				axi->qbytes, axi->uid, axi->gid, axi->mode);

			break; }
@@ -1038,11 +1026,6 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts 
			audit_log_hex(ab, axs->a, axs->len);

			break; }



		case AUDIT_AVC_PATH: {

			struct audit_aux_data_path *axi = (void *)aux;

			audit_log_d_path(ab, "path=", axi->dentry, axi->mnt);

			break; }



		case AUDIT_FD_PAIR: {

			struct audit_aux_data_fd_pair *axs = (void *)aux;

			audit_log_format(ab, "fd0=%d fd1=%d", axs->fd[0], axs->fd[1]);
@@ -1990,36 +1973,6 @@ void __audit_ptrace(struct task_struct *t) 
	selinux_get_task_sid(t, &context->target_sid);

}



/**

 * audit_avc_path - record the granting or denial of permissions

 * @dentry: dentry to record

 * @mnt: mnt to record

 *

 * Returns 0 for success or NULL context or < 0 on error.

 *

 * Called from security/selinux/avc.c::avc_audit()

 */

int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt)

{

	struct audit_aux_data_path *ax;

	struct audit_context *context = current->audit_context;



	if (likely(!context))

		return 0;



	ax = kmalloc(sizeof(*ax), GFP_ATOMIC);

	if (!ax)

		return -ENOMEM;



	ax->dentry = dget(dentry);

	ax->mnt = mntget(mnt);



	ax->d.type = AUDIT_AVC_PATH;

	ax->d.next = context->aux;

	context->aux = (void *)ax;

	return 0;

}



/**

 * audit_signal_info - record signal info for shutting down audit subsystem

 * @sig: signal value

security/selinux/avc.c

+8 −7
Original line number Diff line number Diff line
@@ -570,10 +570,12 @@ void avc_audit(u32 ssid, u32 tsid, 
		case AVC_AUDIT_DATA_FS:

			if (a->u.fs.dentry) {

				struct dentry *dentry = a->u.fs.dentry;

				if (a->u.fs.mnt)

					audit_avc_path(dentry, a->u.fs.mnt);

				if (a->u.fs.mnt) {

					audit_log_d_path(ab, "path=", dentry, a->u.fs.mnt);

				} else {

					audit_log_format(ab, " name=");

					audit_log_untrustedstring(ab, dentry->d_name.name);

				}

				inode = dentry->d_inode;

			} else if (a->u.fs.inode) {

				struct dentry *dentry;
@@ -624,9 +626,8 @@ void avc_audit(u32 ssid, u32 tsid, 
				case AF_UNIX:

					u = unix_sk(sk);

					if (u->dentry) {

						audit_avc_path(u->dentry, u->mnt);

						audit_log_format(ab, " name=");

						audit_log_untrustedstring(ab, u->dentry->d_name.name);

						audit_log_d_path(ab, "path=",

								 u->dentry, u->mnt);

						break;

					}

					if (!u->addr)

CRA Git | Maintained and supported by SUSTech CRA and CCSE