Commit f9bab267 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'audit-pr-20171113' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit 

Pull audit updates from Paul Moore:
 "Another relatively small pull request for audit, nine patches total.

  The only real new bit of functionality is the patch from Richard which
  adds the ability to filter records based on the filesystem type.

  The remainder are bug fixes and cleanups; the bug fix highlights
  include:

   - ensuring that we properly audit init/PID-1 (me)

   - allowing the audit daemon to shutdown the kernel/auditd connection
     cleanly by setting the audit PID to zero (Steve)"

* tag 'audit-pr-20171113' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
  audit: filter PATH records keyed on filesystem magic
  Audit: remove unused audit_log_secctx function
  audit: Allow auditd to set pid to 0 to end auditing
  audit: Add new syscalls to the perm=w filter
  audit: use audit_set_enabled() in audit_enable()
  audit: convert audit_ever_enabled to a boolean
  audit: don't use simple_strtol() anymore
  audit: initialize the audit subsystem as early as possible
  audit: ensure that 'audit=1' actually enables audit for PID 1
parents 373c4557 42d5e376

include/asm-generic/audit_dir_write.h

+3 −0
Original line number Diff line number Diff line
@@ -31,3 +31,6 @@ __NR_renameat, 
__NR_linkat,

__NR_symlinkat,

#endif

#ifdef __NR_renameat2

__NR_renameat2,

#endif

include/asm-generic/audit_write.h

+3 −0
Original line number Diff line number Diff line
@@ -20,3 +20,6 @@ __NR_ftruncate64, 
#ifdef __NR_bind

__NR_bind,		/* bind can affect fs object only in one way... */

#endif

#ifdef __NR_fallocate

__NR_fallocate,

#endif

include/linux/audit.h

+0 −8
Original line number Diff line number Diff line
@@ -149,12 +149,6 @@ extern void audit_log_key(struct audit_buffer *ab, 
extern void		    audit_log_link_denied(const char *operation,

						  const struct path *link);

extern void		    audit_log_lost(const char *message);

#ifdef CONFIG_SECURITY

extern void 		    audit_log_secctx(struct audit_buffer *ab, u32 secid);

#else

static inline void	    audit_log_secctx(struct audit_buffer *ab, u32 secid)

{ }

#endif



extern int audit_log_task_context(struct audit_buffer *ab);

extern void audit_log_task_info(struct audit_buffer *ab,
@@ -203,8 +197,6 @@ static inline void audit_log_key(struct audit_buffer *ab, char *key) 
static inline void audit_log_link_denied(const char *string,

					 const struct path *link)

{ }

static inline void audit_log_secctx(struct audit_buffer *ab, u32 secid)

{ }

static inline int audit_log_task_context(struct audit_buffer *ab)

{

	return 0;

include/uapi/linux/audit.h

+6 −2
Original line number Diff line number Diff line
@@ -157,8 +157,9 @@ 
#define AUDIT_FILTER_WATCH	0x03	/* Apply rule to file system watches */

#define AUDIT_FILTER_EXIT	0x04	/* Apply rule at syscall exit */

#define AUDIT_FILTER_TYPE	0x05	/* Apply rule at audit_log_start */

#define AUDIT_FILTER_FS		0x06	/* Apply rule at __audit_inode_child */



#define AUDIT_NR_FILTERS	6

#define AUDIT_NR_FILTERS	7



#define AUDIT_FILTER_PREPEND	0x10	/* Prepend to front of list */
@@ -258,6 +259,7 @@ 
#define AUDIT_OBJ_LEV_HIGH	23

#define AUDIT_LOGINUID_SET	24

#define AUDIT_SESSIONID	25	/* Session ID */

#define AUDIT_FSTYPE	26	/* FileSystem Type */



				/* These are ONLY useful when checking

				 * at syscall exit time (AUDIT_AT_EXIT). */
@@ -337,13 +339,15 @@ enum { 
#define AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND	0x00000008

#define AUDIT_FEATURE_BITMAP_SESSIONID_FILTER	0x00000010

#define AUDIT_FEATURE_BITMAP_LOST_RESET		0x00000020

#define AUDIT_FEATURE_BITMAP_FILTER_FS		0x00000040



#define AUDIT_FEATURE_BITMAP_ALL (AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT | \

				  AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME | \

				  AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH | \

				  AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND | \

				  AUDIT_FEATURE_BITMAP_SESSIONID_FILTER | \

				  AUDIT_FEATURE_BITMAP_LOST_RESET)

				  AUDIT_FEATURE_BITMAP_LOST_RESET | \

				  AUDIT_FEATURE_BITMAP_FILTER_FS)



/* deprecated: AUDIT_VERSION_* */

#define AUDIT_VERSION_LATEST 		AUDIT_FEATURE_BITMAP_ALL

kernel/audit.c

+29 −47
Original line number Diff line number Diff line
@@ -85,13 +85,13 @@ static int audit_initialized; 
#define AUDIT_OFF	0

#define AUDIT_ON	1

#define AUDIT_LOCKED	2

u32		audit_enabled;

u32		audit_ever_enabled;

u32		audit_enabled = AUDIT_OFF;

bool		audit_ever_enabled = !!AUDIT_OFF;



EXPORT_SYMBOL_GPL(audit_enabled);



/* Default state when kernel boots without any parameters. */

static u32	audit_default;

static u32	audit_default = AUDIT_OFF;



/* If auditing cannot proceed, audit_failure selects what happens. */

static u32	audit_failure = AUDIT_FAIL_PRINTK;
@@ -1197,26 +1197,29 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) 
			pid_t auditd_pid;

			struct pid *req_pid = task_tgid(current);



			/* sanity check - PID values must match */

			if (new_pid != pid_vnr(req_pid))

			/* Sanity check - PID values must match. Setting

			 * pid to 0 is how auditd ends auditing. */

			if (new_pid && (new_pid != pid_vnr(req_pid)))

				return -EINVAL;



			/* test the auditd connection */

			audit_replace(req_pid);



			auditd_pid = auditd_pid_vnr();

			/* only the current auditd can unregister itself */

			if ((!new_pid) && (new_pid != auditd_pid)) {

				audit_log_config_change("audit_pid", new_pid,

							auditd_pid, 0);

				return -EACCES;

			}

			if (auditd_pid) {

				/* replacing a healthy auditd is not allowed */

			if (auditd_pid && new_pid) {

				audit_log_config_change("audit_pid", new_pid,

							auditd_pid, 0);

				if (new_pid) {

					audit_log_config_change("audit_pid",

							new_pid, auditd_pid, 0);

					return -EEXIST;

				}

				/* only current auditd can unregister itself */

				if (pid_vnr(req_pid) != auditd_pid) {

					audit_log_config_change("audit_pid",

							new_pid, auditd_pid, 0);

					return -EACCES;

				}

			}



			if (new_pid) {

				/* register a new auditd connection */
@@ -1549,8 +1552,6 @@ static int __init audit_init(void) 
	register_pernet_subsys(&audit_net_ops);



	audit_initialized = AUDIT_INITIALIZED;

	audit_enabled = audit_default;

	audit_ever_enabled |= !!audit_default;



	kauditd_task = kthread_run(kauditd_thread, NULL, "kauditd");

	if (IS_ERR(kauditd_task)) {
@@ -1564,14 +1565,21 @@ static int __init audit_init(void) 


	return 0;

}

__initcall(audit_init);

postcore_initcall(audit_init);



/* Process kernel command-line parameter at boot time.  audit=0 or audit=1. */

static int __init audit_enable(char *str)

{

	audit_default = !!simple_strtol(str, NULL, 0);

	if (!audit_default)

	long val;



	if (kstrtol(str, 0, &val))

		panic("audit: invalid 'audit' parameter value (%s)\n", str);

	audit_default = (val ? AUDIT_ON : AUDIT_OFF);



	if (audit_default == AUDIT_OFF)

		audit_initialized = AUDIT_DISABLED;

	if (audit_set_enabled(audit_default))

		panic("audit: error setting audit state (%d)\n", audit_default);



	pr_info("%s\n", audit_default ?

		"enabled (after initialization)" : "disabled (until reboot)");
@@ -2337,32 +2345,6 @@ void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type, 
	}

}



#ifdef CONFIG_SECURITY

/**

 * audit_log_secctx - Converts and logs SELinux context

 * @ab: audit_buffer

 * @secid: security number

 *

 * This is a helper function that calls security_secid_to_secctx to convert

 * secid to secctx and then adds the (converted) SELinux context to the audit

 * log by calling audit_log_format, thus also preventing leak of internal secid

 * to userspace. If secid cannot be converted audit_panic is called.

 */

void audit_log_secctx(struct audit_buffer *ab, u32 secid)

{

	u32 len;

	char *secctx;



	if (security_secid_to_secctx(secid, &secctx, &len)) {

		audit_panic("Cannot convert secid to context");

	} else {

		audit_log_format(ab, " obj=%s", secctx);

		security_release_secctx(secctx, len);

	}

}

EXPORT_SYMBOL(audit_log_secctx);

#endif



EXPORT_SYMBOL(audit_log_start);

EXPORT_SYMBOL(audit_log_end);

EXPORT_SYMBOL(audit_log_format);

CRA Git | Maintained and supported by SUSTech CRA and CCSE