History

Merge tag 'audit-pr-20210629' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit

Pull audit updates from Paul Moore: "Another merge window, another small audit pull request. Four patches in total: one is cosmetic, one removes an unnecessary initialization, one renames some enum values to prevent name collisions, and one converts list_del()/list_add() to list_move(). None of these are earth shattering and all pass the audit-testsuite tests while merging cleanly on top of your tree from earlier today" * tag 'audit-pr-20210629' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: remove unnecessary 'ret' initialization audit: remove trailing spaces and tabs audit: Use list_move instead of list_del/list_add audit: Rename enum audit_state constants to avoid AUDIT_DISABLED redefinition audit: add blank line after variable declarations

Linus Torvalds committed 5 years ago

Commit 290fe0f2 parents 6bd344e 0ecc6175 files · +53 −37Browse files

Unified · Split

5 files
  1. include/uapi/linux/audit.h +2 −2
  2. kernel/audit.h +5 −5
  3. kernel/audit_tree.c +4 −8
  4. kernel/auditsc.c +42 −21
  5. security/lsm_audit.c +0 −1
include/uapi/linux/audit.h+2−2
@@ -48,7 +48,7 @@ · 47 unmodified lines
48 * 2500 - 2999 future user space (maybe integrity labels and related events)48 * 2500 - 2999 future user space (maybe integrity labels and related events)
49 *49 *
50 * Messages from 1000-1199 are bi-directional. 1200-1299 & 2100 - 2999 are50 * Messages from 1000-1199 are bi-directional. 1200-1299 & 2100 - 2999 are
51 * exclusively user space. 1300-2099 is kernel --> user space 51 * exclusively user space. 1300-2099 is kernel --> user space
52 * communication.52 * communication.
53 */53 */
54#define AUDIT_GET 1000 /* Get status */54#define AUDIT_GET 1000 /* Get status */
@@ -78,7 +78,7 @@ · 23 unmodified lines
78#define AUDIT_LAST_USER_MSG 119978#define AUDIT_LAST_USER_MSG 1199
79#define AUDIT_FIRST_USER_MSG2 2100 /* More user space messages */79#define AUDIT_FIRST_USER_MSG2 2100 /* More user space messages */
80#define AUDIT_LAST_USER_MSG2 299980#define AUDIT_LAST_USER_MSG2 2999
81 81
82#define AUDIT_DAEMON_START 1200 /* Daemon startup record */82#define AUDIT_DAEMON_START 1200 /* Daemon startup record */
83#define AUDIT_DAEMON_END 1201 /* Daemon normal stop record */83#define AUDIT_DAEMON_END 1201 /* Daemon normal stop record */
84#define AUDIT_DAEMON_ABORT 1202 /* Daemon error stop record */84#define AUDIT_DAEMON_ABORT 1202 /* Daemon error stop record */
kernel/audit.h+5−5
@@ -1,5 +1,5 @@
1/* SPDX-License-Identifier: GPL-2.0-or-later */1/* SPDX-License-Identifier: GPL-2.0-or-later */
2/* audit -- definition of audit_context structure and supporting types 2/* audit -- definition of audit_context structure and supporting types
3 *3 *
4 * Copyright 2003-2004 Red Hat, Inc.4 * Copyright 2003-2004 Red Hat, Inc.
5 * Copyright 2005 Hewlett-Packard Development Company, L.P.5 * Copyright 2005 Hewlett-Packard Development Company, L.P.
@@ -21,16 +21,16 @@ · 15 unmodified lines
21 a per-task filter. At syscall entry, the audit_state is augmented by21 a per-task filter. At syscall entry, the audit_state is augmented by
22 the syscall filter. */22 the syscall filter. */
23enum audit_state {23enum audit_state {
24 AUDIT_DISABLED, /* Do not create per-task audit_context.24 AUDIT_STATE_DISABLED, /* Do not create per-task audit_context.
25 * No syscall-specific audit records can25 * No syscall-specific audit records can
26 * be generated. */26 * be generated. */
27 AUDIT_BUILD_CONTEXT, /* Create the per-task audit_context,27 AUDIT_STATE_BUILD, /* Create the per-task audit_context,
28 * and fill it in at syscall28 * and fill it in at syscall
29 * entry time. This makes a full29 * entry time. This makes a full
30 * syscall record available if some30 * syscall record available if some
31 * other part of the kernel decides it31 * other part of the kernel decides it
32 * should be recorded. */32 * should be recorded. */
33 AUDIT_RECORD_CONTEXT /* Create the per-task audit_context,33 AUDIT_STATE_RECORD /* Create the per-task audit_context,
34 * always fill it in at syscall entry34 * always fill it in at syscall entry
35 * time, and always write out the audit35 * time, and always write out the audit
36 * record at syscall exit time. */36 * record at syscall exit time. */
@@ -322,7 +322,7 @@ static inline int audit_signal_info_syscall(struct task_struct *t) · 285 unmodified lines
322 return 0;322 return 0;
323}323}
324 324
325#define audit_filter_inodes(t, c) AUDIT_DISABLED325#define audit_filter_inodes(t, c) AUDIT_STATE_DISABLED
326#endif /* CONFIG_AUDITSYSCALL */326#endif /* CONFIG_AUDITSYSCALL */
327 327
328extern char *audit_unpack_string(void **bufp, size_t *remain, size_t len);328extern char *audit_unpack_string(void **bufp, size_t *remain, size_t len);
kernel/audit_tree.c+4−8
@@ -689,8 +689,7 @@ void audit_trim_trees(void) · 688 unmodified lines
689 689
690 tree = container_of(cursor.next, struct audit_tree, list);690 tree = container_of(cursor.next, struct audit_tree, list);
691 get_tree(tree);691 get_tree(tree);
692 list_del(&cursor);692 list_move(&cursor, &tree->list);
693 list_add(&cursor, &tree->list);
694 mutex_unlock(&audit_filter_mutex);693 mutex_unlock(&audit_filter_mutex);
695 694
696 err = kern_path(tree->pathname, 0, &path);695 err = kern_path(tree->pathname, 0, &path);
@@ -899,8 +898,7 @@ int audit_tag_tree(char *old, char *new) · 202 unmodified lines
899 898
900 tree = container_of(cursor.next, struct audit_tree, list);899 tree = container_of(cursor.next, struct audit_tree, list);
901 get_tree(tree);900 get_tree(tree);
902 list_del(&cursor);901 list_move(&cursor, &tree->list);
903 list_add(&cursor, &tree->list);
904 mutex_unlock(&audit_filter_mutex);902 mutex_unlock(&audit_filter_mutex);
905 903
906 err = kern_path(tree->pathname, 0, &path2);904 err = kern_path(tree->pathname, 0, &path2);
@@ -925,8 +923,7 @@ int audit_tag_tree(char *old, char *new) · 18 unmodified lines
925 mutex_lock(&audit_filter_mutex);923 mutex_lock(&audit_filter_mutex);
926 spin_lock(&hash_lock);924 spin_lock(&hash_lock);
927 if (!tree->goner) {925 if (!tree->goner) {
928 list_del(&tree->list);926 list_move(&tree->list, &tree_list);
929 list_add(&tree->list, &tree_list);
930 }927 }
931 spin_unlock(&hash_lock);928 spin_unlock(&hash_lock);
932 put_tree(tree);929 put_tree(tree);
@@ -937,8 +934,7 @@ int audit_tag_tree(char *old, char *new) · 4 unmodified lines
937 934
938 tree = container_of(barrier.prev, struct audit_tree, list);935 tree = container_of(barrier.prev, struct audit_tree, list);
939 get_tree(tree);936 get_tree(tree);
940 list_del(&tree->list);937 list_move(&tree->list, &barrier);
941 list_add(&tree->list, &barrier);
942 mutex_unlock(&audit_filter_mutex);938 mutex_unlock(&audit_filter_mutex);
943 939
944 if (!failed) {940 if (!failed) {
kernel/auditsc.c+42−21
@@ -160,6 +160,7 @@ static const struct audit_nfcfgop_tab audit_nfcfgs[] = { · 159 unmodified lines
160static int audit_match_perm(struct audit_context *ctx, int mask)160static int audit_match_perm(struct audit_context *ctx, int mask)
161{161{
162 unsigned n;162 unsigned n;
163
163 if (unlikely(!ctx))164 if (unlikely(!ctx))
164 return 0;165 return 0;
165 n = ctx->major;166 n = ctx->major;
@@ -231,7 +232,7 @@ static void audit_set_auditable(struct audit_context *ctx) · 65 unmodified lines
231{232{
232 if (!ctx->prio) {233 if (!ctx->prio) {
233 ctx->prio = 1;234 ctx->prio = 1;
234 ctx->current_state = AUDIT_RECORD_CONTEXT;235 ctx->current_state = AUDIT_STATE_RECORD;
235 }236 }
236}237}
237 238
@@ -239,6 +240,7 @@ static int put_tree_ref(struct audit_context *ctx, struct audit_chunk *chunk) · 1 unmodified line
239{240{
240 struct audit_tree_refs *p = ctx->trees;241 struct audit_tree_refs *p = ctx->trees;
241 int left = ctx->tree_count;242 int left = ctx->tree_count;
243
242 if (likely(left)) {244 if (likely(left)) {
243 p->c[--left] = chunk;245 p->c[--left] = chunk;
244 ctx->tree_count = left;246 ctx->tree_count = left;
@@ -259,6 +261,7 @@ static int put_tree_ref(struct audit_context *ctx, struct audit_chunk *chunk) · 14 unmodified lines
259static int grow_tree_refs(struct audit_context *ctx)261static int grow_tree_refs(struct audit_context *ctx)
260{262{
261 struct audit_tree_refs *p = ctx->trees;263 struct audit_tree_refs *p = ctx->trees;
264
262 ctx->trees = kzalloc(sizeof(struct audit_tree_refs), GFP_KERNEL);265 ctx->trees = kzalloc(sizeof(struct audit_tree_refs), GFP_KERNEL);
263 if (!ctx->trees) {266 if (!ctx->trees) {
264 ctx->trees = p;267 ctx->trees = p;
@@ -277,6 +280,7 @@ static void unroll_tree_refs(struct audit_context *ctx, · 12 unmodified lines
277{280{
278 struct audit_tree_refs *q;281 struct audit_tree_refs *q;
279 int n;282 int n;
283
280 if (!p) {284 if (!p) {
281 /* we started with empty chain */285 /* we started with empty chain */
282 p = ctx->first_trees;286 p = ctx->first_trees;
@@ -303,6 +307,7 @@ static void unroll_tree_refs(struct audit_context *ctx, · 20 unmodified lines
303static void free_tree_refs(struct audit_context *ctx)307static void free_tree_refs(struct audit_context *ctx)
304{308{
305 struct audit_tree_refs *p, *q;309 struct audit_tree_refs *p, *q;
310
306 for (p = ctx->first_trees; p; p = q) {311 for (p = ctx->first_trees; p; p = q) {
307 q = p->next;312 q = p->next;
308 kfree(p);313 kfree(p);
@@ -313,6 +318,7 @@ static int match_tree_refs(struct audit_context *ctx, struct audit_tree *tree) · 4 unmodified lines
313{318{
314 struct audit_tree_refs *p;319 struct audit_tree_refs *p;
315 int n;320 int n;
321
316 if (!tree)322 if (!tree)
317 return 0;323 return 0;
318 /* full ones */324 /* full ones */
@@ -337,13 +343,13 @@ static int audit_compare_uid(kuid_t uid, · 18 unmodified lines
337{343{
338 struct audit_names *n;344 struct audit_names *n;
339 int rc;345 int rc;
340 346
341 if (name) {347 if (name) {
342 rc = audit_uid_comparator(uid, f->op, name->uid);348 rc = audit_uid_comparator(uid, f->op, name->uid);
343 if (rc)349 if (rc)
344 return rc;350 return rc;
345 }351 }
346 352
347 if (ctx) {353 if (ctx) {
348 list_for_each_entry(n, &ctx->names_list, list) {354 list_for_each_entry(n, &ctx->names_list, list) {
349 rc = audit_uid_comparator(uid, f->op, n->uid);355 rc = audit_uid_comparator(uid, f->op, n->uid);
@@ -361,13 +367,13 @@ static int audit_compare_gid(kgid_t gid, · 11 unmodified lines
361{367{
362 struct audit_names *n;368 struct audit_names *n;
363 int rc;369 int rc;
364 370
365 if (name) {371 if (name) {
366 rc = audit_gid_comparator(gid, f->op, name->gid);372 rc = audit_gid_comparator(gid, f->op, name->gid);
367 if (rc)373 if (rc)
368 return rc;374 return rc;
369 }375 }
370 376
371 if (ctx) {377 if (ctx) {
372 list_for_each_entry(n, &ctx->names_list, list) {378 list_for_each_entry(n, &ctx->names_list, list) {
373 rc = audit_gid_comparator(gid, f->op, n->gid);379 rc = audit_gid_comparator(gid, f->op, n->gid);
@@ -751,10 +757,10 @@ static int audit_filter_rules(struct task_struct *tsk, · 377 unmodified lines
751 }757 }
752 switch (rule->action) {758 switch (rule->action) {
753 case AUDIT_NEVER:759 case AUDIT_NEVER:
754 *state = AUDIT_DISABLED;760 *state = AUDIT_STATE_DISABLED;
755 break;761 break;
756 case AUDIT_ALWAYS:762 case AUDIT_ALWAYS:
757 *state = AUDIT_RECORD_CONTEXT;763 *state = AUDIT_STATE_RECORD;
758 break;764 break;
759 }765 }
760 return 1;766 return 1;
@@ -773,14 +779,14 @@ static enum audit_state audit_filter_task(struct task_struct *tsk, char **key) · 12 unmodified lines
773 list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TASK], list) {779 list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TASK], list) {
774 if (audit_filter_rules(tsk, &e->rule, NULL, NULL,780 if (audit_filter_rules(tsk, &e->rule, NULL, NULL,
775 &state, true)) {781 &state, true)) {
776 if (state == AUDIT_RECORD_CONTEXT)782 if (state == AUDIT_STATE_RECORD)
777 *key = kstrdup(e->rule.filterkey, GFP_ATOMIC);783 *key = kstrdup(e->rule.filterkey, GFP_ATOMIC);
778 rcu_read_unlock();784 rcu_read_unlock();
779 return state;785 return state;
780 }786 }
781 }787 }
782 rcu_read_unlock();788 rcu_read_unlock();
783 return AUDIT_BUILD_CONTEXT;789 return AUDIT_STATE_BUILD;
784}790}
785 791
786static int audit_in_mask(const struct audit_krule *rule, unsigned long val)792static int audit_in_mask(const struct audit_krule *rule, unsigned long val)
@@ -802,7 +808,7 @@ static int audit_in_mask(const struct audit_krule *rule, unsigned long val) · 15 unmodified lines
802/* At syscall exit time, this filter is called if the audit_state is808/* At syscall exit time, this filter is called if the audit_state is
803 * not low enough that auditing cannot take place, but is also not809 * not low enough that auditing cannot take place, but is also not
804 * high enough that we already know we have to write an audit record810 * high enough that we already know we have to write an audit record
805 * (i.e., the state is AUDIT_SETUP_CONTEXT or AUDIT_BUILD_CONTEXT).811 * (i.e., the state is AUDIT_STATE_BUILD).
806 */812 */
807static void audit_filter_syscall(struct task_struct *tsk,813static void audit_filter_syscall(struct task_struct *tsk,
808 struct audit_context *ctx)814 struct audit_context *ctx)
@@ -923,7 +929,7 @@ static inline struct audit_context *audit_alloc_context(enum audit_state state) · 114 unmodified lines
923 if (!context)929 if (!context)
924 return NULL;930 return NULL;
925 context->state = state;931 context->state = state;
926 context->prio = state == AUDIT_RECORD_CONTEXT ? ~0ULL : 0;932 context->prio = state == AUDIT_STATE_RECORD ? ~0ULL : 0;
927 INIT_LIST_HEAD(&context->killed_trees);933 INIT_LIST_HEAD(&context->killed_trees);
928 INIT_LIST_HEAD(&context->names_list);934 INIT_LIST_HEAD(&context->names_list);
929 context->fds[0] = -1;935 context->fds[0] = -1;
@@ -950,7 +956,7 @@ int audit_alloc(struct task_struct *tsk) · 20 unmodified lines
950 return 0; /* Return if not auditing. */956 return 0; /* Return if not auditing. */
951 957
952 state = audit_filter_task(tsk, &key);958 state = audit_filter_task(tsk, &key);
953 if (state == AUDIT_DISABLED) {959 if (state == AUDIT_STATE_DISABLED) {
954 clear_task_syscall_work(tsk, SYSCALL_AUDIT);960 clear_task_syscall_work(tsk, SYSCALL_AUDIT);
955 return 0;961 return 0;
956 }962 }
@@ -1225,6 +1231,7 @@ static void show_special(struct audit_context *context, int *call_panic) · 268 unmodified lines
1225 switch (context->type) {1231 switch (context->type) {
1226 case AUDIT_SOCKETCALL: {1232 case AUDIT_SOCKETCALL: {
1227 int nargs = context->socketcall.nargs;1233 int nargs = context->socketcall.nargs;
1234
1228 audit_log_format(ab, "nargs=%d", nargs);1235 audit_log_format(ab, "nargs=%d", nargs);
1229 for (i = 0; i < nargs; i++)1236 for (i = 0; i < nargs; i++)
1230 audit_log_format(ab, " a%d=%lx", i,1237 audit_log_format(ab, " a%d=%lx", i,
@@ -1240,6 +1247,7 @@ static void show_special(struct audit_context *context, int *call_panic) · 9 unmodified lines
1240 if (osid) {1247 if (osid) {
1241 char *ctx = NULL;1248 char *ctx = NULL;
1242 u32 len;1249 u32 len;
1250
1243 if (security_secid_to_secctx(osid, &ctx, &len)) {1251 if (security_secid_to_secctx(osid, &ctx, &len)) {
1244 audit_log_format(ab, " osid=%u", osid);1252 audit_log_format(ab, " osid=%u", osid);
1245 *call_panic = 1;1253 *call_panic = 1;
@@ -1289,6 +1297,7 @@ static void show_special(struct audit_context *context, int *call_panic) · 43 unmodified lines
1289 break;1297 break;
1290 case AUDIT_MQ_GETSETATTR: {1298 case AUDIT_MQ_GETSETATTR: {
1291 struct mq_attr *attr = &context->mq_getsetattr.mqstat;1299 struct mq_attr *attr = &context->mq_getsetattr.mqstat;
1300
1292 audit_log_format(ab,1301 audit_log_format(ab,
1293 "mqdes=%d mq_flags=0x%lx mq_maxmsg=%ld mq_msgsize=%ld "1302 "mqdes=%d mq_flags=0x%lx mq_maxmsg=%ld mq_msgsize=%ld "
1294 "mq_curmsgs=%ld ",1303 "mq_curmsgs=%ld ",
@@ -1325,6 +1334,7 @@ static void show_special(struct audit_context *context, int *call_panic) · 30 unmodified lines
1325static inline int audit_proctitle_rtrim(char *proctitle, int len)1334static inline int audit_proctitle_rtrim(char *proctitle, int len)
1326{1335{
1327 char *end = proctitle + len - 1;1336 char *end = proctitle + len - 1;
1337
1328 while (end > proctitle && !isprint(*end))1338 while (end > proctitle && !isprint(*end))
1329 end--;1339 end--;
1330 1340
@@ -1513,6 +1523,7 @@ static void audit_log_exit(void) · 182 unmodified lines
1513 1523
1514 case AUDIT_BPRM_FCAPS: {1524 case AUDIT_BPRM_FCAPS: {
1515 struct audit_aux_data_bprm_fcaps *axs = (void *)aux;1525 struct audit_aux_data_bprm_fcaps *axs = (void *)aux;
1526
1516 audit_log_format(ab, "fver=%x", axs->fcap_ver);1527 audit_log_format(ab, "fver=%x", axs->fcap_ver);
1517 audit_log_cap(ab, "fp", &axs->fcap.permitted);1528 audit_log_cap(ab, "fp", &axs->fcap.permitted);
1518 audit_log_cap(ab, "fi", &axs->fcap.inheritable);1529 audit_log_cap(ab, "fi", &axs->fcap.inheritable);
@@ -1628,7 +1639,7 @@ void __audit_free(struct task_struct *tsk) · 109 unmodified lines
1628 1639
1629 audit_filter_syscall(tsk, context);1640 audit_filter_syscall(tsk, context);
1630 audit_filter_inodes(tsk, context);1641 audit_filter_inodes(tsk, context);
1631 if (context->current_state == AUDIT_RECORD_CONTEXT)1642 if (context->current_state == AUDIT_STATE_RECORD)
1632 audit_log_exit();1643 audit_log_exit();
1633 }1644 }
1634 1645
@@ -1647,7 +1658,7 @@ void __audit_free(struct task_struct *tsk) · 12 unmodified lines
1647 * Fill in audit context at syscall entry. This only happens if the1658 * Fill in audit context at syscall entry. This only happens if the
1648 * audit context was created when the task was created and the state or1659 * audit context was created when the task was created and the state or
1649 * filters demand the audit context be built. If the state from the1660 * filters demand the audit context be built. If the state from the
1650 * per-task filter or from the per-syscall filter is AUDIT_RECORD_CONTEXT,1661 * per-task filter or from the per-syscall filter is AUDIT_STATE_RECORD,
1651 * then the record will be written at syscall exit time (otherwise, it1662 * then the record will be written at syscall exit time (otherwise, it
1652 * will only be written if another part of the kernel requests that it1663 * will only be written if another part of the kernel requests that it
1653 * be written).1664 * be written).
@@ -1664,11 +1675,11 @@ void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2, · 10 unmodified lines
1664 BUG_ON(context->in_syscall || context->name_count);1675 BUG_ON(context->in_syscall || context->name_count);
1665 1676
1666 state = context->state;1677 state = context->state;
1667 if (state == AUDIT_DISABLED)1678 if (state == AUDIT_STATE_DISABLED)
1668 return;1679 return;
1669 1680
1670 context->dummy = !audit_n_rules;1681 context->dummy = !audit_n_rules;
1671 if (!context->dummy && state == AUDIT_BUILD_CONTEXT) {1682 if (!context->dummy && state == AUDIT_STATE_BUILD) {
1672 context->prio = 0;1683 context->prio = 0;
1673 if (auditd_test_task(current))1684 if (auditd_test_task(current))
1674 return;1685 return;
@@ -1693,7 +1704,7 @@ void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2, · 18 unmodified lines
1693 * @return_code: return value of the syscall1704 * @return_code: return value of the syscall
1694 *1705 *
1695 * Tear down after system call. If the audit context has been marked as1706 * Tear down after system call. If the audit context has been marked as
1696 * auditable (either because of the AUDIT_RECORD_CONTEXT state from1707 * auditable (either because of the AUDIT_STATE_RECORD state from
1697 * filtering, or because some other part of the kernel wrote an audit1708 * filtering, or because some other part of the kernel wrote an audit
1698 * message), then write out the syscall information. In call cases,1709 * message), then write out the syscall information. In call cases,
1699 * free the names stored from getname().1710 * free the names stored from getname().
@@ -1735,12 +1746,12 @@ void __audit_syscall_exit(int success, long return_code) · 35 unmodified lines
1735 1746
1736 audit_filter_syscall(current, context);1747 audit_filter_syscall(current, context);
1737 audit_filter_inodes(current, context);1748 audit_filter_inodes(current, context);
1738 if (context->current_state == AUDIT_RECORD_CONTEXT)1749 if (context->current_state == AUDIT_STATE_RECORD)
1739 audit_log_exit();1750 audit_log_exit();
1740 }1751 }
1741 1752
1742 context->in_syscall = 0;1753 context->in_syscall = 0;
1743 context->prio = context->state == AUDIT_RECORD_CONTEXT ? ~0ULL : 0;1754 context->prio = context->state == AUDIT_STATE_RECORD ? ~0ULL : 0;
1744 1755
1745 audit_free_module(context);1756 audit_free_module(context);
1746 audit_free_names(context);1757 audit_free_names(context);
@@ -1753,7 +1764,7 @@ void __audit_syscall_exit(int success, long return_code) · 6 unmodified lines
1753 context->sockaddr_len = 0;1764 context->sockaddr_len = 0;
1754 context->type = 0;1765 context->type = 0;
1755 context->fds[0] = -1;1766 context->fds[0] = -1;
1756 if (context->state != AUDIT_RECORD_CONTEXT) {1767 if (context->state != AUDIT_STATE_RECORD) {
1757 kfree(context->filterkey);1768 kfree(context->filterkey);
1758 context->filterkey = NULL;1769 context->filterkey = NULL;
1759 }1770 }
@@ -1765,6 +1776,7 @@ static inline void handle_one(const struct inode *inode) · 5 unmodified lines
1765 struct audit_tree_refs *p;1776 struct audit_tree_refs *p;
1766 struct audit_chunk *chunk;1777 struct audit_chunk *chunk;
1767 int count;1778 int count;
1779
1768 if (likely(!inode->i_fsnotify_marks))1780 if (likely(!inode->i_fsnotify_marks))
1769 return;1781 return;
1770 context = audit_context();1782 context = audit_context();
@@ -1806,8 +1818,10 @@ retry: · 35 unmodified lines
1806 seq = read_seqbegin(&rename_lock);1818 seq = read_seqbegin(&rename_lock);
1807 for(;;) {1819 for(;;) {
1808 struct inode *inode = d_backing_inode(d);1820 struct inode *inode = d_backing_inode(d);
1821
1809 if (inode && unlikely(inode->i_fsnotify_marks)) {1822 if (inode && unlikely(inode->i_fsnotify_marks)) {
1810 struct audit_chunk *chunk;1823 struct audit_chunk *chunk;
1824
1811 chunk = audit_tree_lookup(inode);1825 chunk = audit_tree_lookup(inode);
1812 if (chunk) {1826 if (chunk) {
1813 if (unlikely(!put_tree_ref(context, chunk))) {1827 if (unlikely(!put_tree_ref(context, chunk))) {
@@ -2203,7 +2217,7 @@ int auditsc_get_stamp(struct audit_context *ctx, · 389 unmodified lines
2203 *serial = ctx->serial;2217 *serial = ctx->serial;
2204 if (!ctx->prio) {2218 if (!ctx->prio) {
2205 ctx->prio = 1;2219 ctx->prio = 1;
2206 ctx->current_state = AUDIT_RECORD_CONTEXT;2220 ctx->current_state = AUDIT_STATE_RECORD;
2207 }2221 }
2208 return 1;2222 return 1;
2209}2223}
@@ -2285,6 +2299,7 @@ void __audit_mq_notify(mqd_t mqdes, const struct sigevent *notification) · 75 unmodified lines
2285void __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)2299void __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
2286{2300{
2287 struct audit_context *context = audit_context();2301 struct audit_context *context = audit_context();
2302
2288 context->mq_getsetattr.mqdes = mqdes;2303 context->mq_getsetattr.mqdes = mqdes;
2289 context->mq_getsetattr.mqstat = *mqstat;2304 context->mq_getsetattr.mqstat = *mqstat;
2290 context->type = AUDIT_MQ_GETSETATTR;2305 context->type = AUDIT_MQ_GETSETATTR;
@@ -2298,6 +2313,7 @@ void __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat) · 7 unmodified lines
2298void __audit_ipc_obj(struct kern_ipc_perm *ipcp)2313void __audit_ipc_obj(struct kern_ipc_perm *ipcp)
2299{2314{
2300 struct audit_context *context = audit_context();2315 struct audit_context *context = audit_context();
2316
2301 context->ipc.uid = ipcp->uid;2317 context->ipc.uid = ipcp->uid;
2302 context->ipc.gid = ipcp->gid;2318 context->ipc.gid = ipcp->gid;
2303 context->ipc.mode = ipcp->mode;2319 context->ipc.mode = ipcp->mode;
@@ -2362,6 +2378,7 @@ int __audit_socketcall(int nargs, unsigned long *args) · 58 unmodified lines
2362void __audit_fd_pair(int fd1, int fd2)2378void __audit_fd_pair(int fd1, int fd2)
2363{2379{
2364 struct audit_context *context = audit_context();2380 struct audit_context *context = audit_context();
2381
2365 context->fds[0] = fd1;2382 context->fds[0] = fd1;
2366 context->fds[1] = fd2;2383 context->fds[1] = fd2;
2367}2384}
@@ -2379,6 +2396,7 @@ int __audit_sockaddr(int len, void *a) · 11 unmodified lines
2379 2396
2380 if (!context->sockaddr) {2397 if (!context->sockaddr) {
2381 void *p = kmalloc(sizeof(struct sockaddr_storage), GFP_KERNEL);2398 void *p = kmalloc(sizeof(struct sockaddr_storage), GFP_KERNEL);
2399
2382 if (!p)2400 if (!p)
2383 return -ENOMEM;2401 return -ENOMEM;
2384 context->sockaddr = p;2402 context->sockaddr = p;
@@ -2510,6 +2528,7 @@ int __audit_log_bprm_fcaps(struct linux_binprm *bprm, · 125 unmodified lines
2510void __audit_log_capset(const struct cred *new, const struct cred *old)2528void __audit_log_capset(const struct cred *new, const struct cred *old)
2511{2529{
2512 struct audit_context *context = audit_context();2530 struct audit_context *context = audit_context();
2531
2513 context->capset.pid = task_tgid_nr(current);2532 context->capset.pid = task_tgid_nr(current);
2514 context->capset.cap.effective = new->cap_effective;2533 context->capset.cap.effective = new->cap_effective;
2515 context->capset.cap.inheritable = new->cap_effective;2534 context->capset.cap.inheritable = new->cap_effective;
@@ -2521,6 +2540,7 @@ void __audit_log_capset(const struct cred *new, const struct cred *old) · 5 unmodified lines
2521void __audit_mmap_fd(int fd, int flags)2540void __audit_mmap_fd(int fd, int flags)
2522{2541{
2523 struct audit_context *context = audit_context();2542 struct audit_context *context = audit_context();
2543
2524 context->mmap.fd = fd;2544 context->mmap.fd = fd;
2525 context->mmap.flags = flags;2545 context->mmap.flags = flags;
2526 context->type = AUDIT_MMAP;2546 context->type = AUDIT_MMAP;
@@ -2686,6 +2706,7 @@ void audit_seccomp_actions_logged(const char *names, const char *old_names, · 159 unmodified lines
2686struct list_head *audit_killed_trees(void)2706struct list_head *audit_killed_trees(void)
2687{2707{
2688 struct audit_context *ctx = audit_context();2708 struct audit_context *ctx = audit_context();
2709
2689 if (likely(!ctx || !ctx->in_syscall))2710 if (likely(!ctx || !ctx->in_syscall))
2690 return NULL;2711 return NULL;
2691 return &ctx->killed_trees;2712 return &ctx->killed_trees;
security/lsm_audit.c+0−1
@@ -119,7 +119,6 @@ int ipv6_skb_to_auditdata(struct sk_buff *skb, · 118 unmodified lines
119 return -EINVAL;119 return -EINVAL;
120 ad->u.net->v6info.saddr = ip6->saddr;120 ad->u.net->v6info.saddr = ip6->saddr;
121 ad->u.net->v6info.daddr = ip6->daddr;121 ad->u.net->v6info.daddr = ip6->daddr;
122 ret = 0;
123 /* IPv6 can have several extension header before the Transport header122 /* IPv6 can have several extension header before the Transport header
124 * skip them */123 * skip them */
125 offset = skb_network_offset(skb);124 offset = skb_network_offset(skb);