History

Merge branch 'audit.b38' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current

* 'audit.b38' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current: [PATCH] Abnormal End of Processes [PATCH] match audit name data [PATCH] complete message queue auditing [PATCH] audit inode for all xattr syscalls [PATCH] initialize name osid [PATCH] audit signal recipients [PATCH] add SIGNAL syscall class (v3) [PATCH] auditing ptrace

Linus Torvalds committed 19 years ago

Commit 853da002 parents 5884c40 0a4ff8c22 files · +439 −101Browse files

Showing the changes to kernel (5 of 22 files). Show all

Unified · Split

5 files
  1. kernel/audit.h +8 −5
  2. kernel/auditfilter.c +47 −1
  3. kernel/auditsc.c +226 −85
  4. kernel/ptrace.c +3 −0
  5. kernel/signal.c +6 −4
kernel/audit.h+8−5
@@ -83,6 +83,7 @@ struct audit_krule { · 82 unmodified lines
8383 u32 field_count;
8484 char *filterkey; /* ties events to rules */
8585 struct audit_field *fields;
86+ struct audit_field *arch_f; /* quick access to arch field */
8687 struct audit_field *inode_f; /* quick access to an inode field */
8788 struct audit_watch *watch; /* associated watch */
8889 struct list_head rlist; /* entry in audit_watch.rules list */
@@ -131,17 +132,19 @@ extern void audit_handle_ievent(struct inotify_watch *, u32, u32, u32, · 42 unmodified lines
131132 extern int selinux_audit_rule_update(void);
132133
133134 #ifdef CONFIG_AUDITSYSCALL
134−extern void __audit_signal_info(int sig, struct task_struct *t);
135−static inline void audit_signal_info(int sig, struct task_struct *t)
135+extern int __audit_signal_info(int sig, struct task_struct *t);
136+static inline int audit_signal_info(int sig, struct task_struct *t)
136137 {
137− if (unlikely(audit_pid && t->tgid == audit_pid))
138− __audit_signal_info(sig, t);
138+ if (unlikely((audit_pid && t->tgid == audit_pid) ||
139+ (audit_signals && !audit_dummy_context())))
140+ return __audit_signal_info(sig, t);
141+ return 0;
139142 }
140143 extern enum audit_state audit_filter_inodes(struct task_struct *,
141144 struct audit_context *);
142145 extern void audit_set_auditable(struct audit_context *);
143146 #else
144−#define audit_signal_info(s,t)
147+#define audit_signal_info(s,t) AUDIT_DISABLED
145148 #define audit_filter_inodes(t,c) AUDIT_DISABLED
146149 #define audit_set_auditable(c)
147150 #endif
kernel/auditfilter.c+47−1
@@ -311,6 +311,43 @@ int audit_match_class(int class, unsigned syscall) · 310 unmodified lines
311311 return classes[class][AUDIT_WORD(syscall)] & AUDIT_BIT(syscall);
312312 }
313313
314+static inline int audit_match_class_bits(int class, u32 *mask)
315+{
316+ int i;
317+
318+ if (classes[class]) {
319+ for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
320+ if (mask[i] & classes[class][i])
321+ return 0;
322+ }
323+ return 1;
324+}
325+
326+static int audit_match_signal(struct audit_entry *entry)
327+{
328+ struct audit_field *arch = entry->rule.arch_f;
329+
330+ if (!arch) {
331+ /* When arch is unspecified, we must check both masks on biarch
332+ * as syscall number alone is ambiguous. */
333+ return (audit_match_class_bits(AUDIT_CLASS_SIGNAL,
334+ entry->rule.mask) &&
335+ audit_match_class_bits(AUDIT_CLASS_SIGNAL_32,
336+ entry->rule.mask));
337+ }
338+
339+ switch(audit_classify_arch(arch->val)) {
340+ case 0: /* native */
341+ return (audit_match_class_bits(AUDIT_CLASS_SIGNAL,
342+ entry->rule.mask));
343+ case 1: /* 32bit on biarch */
344+ return (audit_match_class_bits(AUDIT_CLASS_SIGNAL_32,
345+ entry->rule.mask));
346+ default:
347+ return 1;
348+ }
349+}
350+
314351 /* Common user-space to kernel rule translation. */
315352 static inline struct audit_entry *audit_to_entry_common(struct audit_rule *rule)
316353 {
@@ -429,6 +466,7 @@ static struct audit_entry *audit_rule_to_entry(struct audit_rule *rule) · 112 unmodified lines
429466 err = -EINVAL;
430467 goto exit_free;
431468 }
469+ entry->rule.arch_f = f;
432470 break;
433471 case AUDIT_PERM:
434472 if (f->val & ~15)
@@ -519,7 +557,6 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data, · 84 unmodified lines
519557 case AUDIT_FSGID:
520558 case AUDIT_LOGINUID:
521559 case AUDIT_PERS:
522− case AUDIT_ARCH:
523560 case AUDIT_MSGTYPE:
524561 case AUDIT_PPID:
525562 case AUDIT_DEVMAJOR:
@@ -531,6 +568,9 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data, · 5 unmodified lines
531568 case AUDIT_ARG2:
532569 case AUDIT_ARG3:
533570 break;
571+ case AUDIT_ARCH:
572+ entry->rule.arch_f = f;
573+ break;
534574 case AUDIT_SUBJ_USER:
535575 case AUDIT_SUBJ_ROLE:
536576 case AUDIT_SUBJ_TYPE:
@@ -1221,6 +1261,9 @@ static inline int audit_add_rule(struct audit_entry *entry, · 684 unmodified lines
12211261 #ifdef CONFIG_AUDITSYSCALL
12221262 if (!dont_count)
12231263 audit_n_rules++;
1264+
1265+ if (!audit_match_signal(entry))
1266+ audit_signals++;
12241267 #endif
12251268 mutex_unlock(&audit_filter_mutex);
12261269
@@ -1294,6 +1337,9 @@ static inline int audit_del_rule(struct audit_entry *entry, · 67 unmodified lines
12941337 #ifdef CONFIG_AUDITSYSCALL
12951338 if (!dont_count)
12961339 audit_n_rules--;
1340+
1341+ if (!audit_match_signal(entry))
1342+ audit_signals--;
12971343 #endif
12981344 mutex_unlock(&audit_filter_mutex);
12991345
kernel/auditsc.c+226−85
@@ -78,17 +78,15 @@ extern int audit_enabled; · 77 unmodified lines
7878 * for saving names from getname(). */
7979 #define AUDIT_NAMES 20
8080
81−/* AUDIT_NAMES_RESERVED is the number of slots we reserve in the
82− * audit_context from being used for nameless inodes from
83− * path_lookup. */
84−#define AUDIT_NAMES_RESERVED 7
85−
8681 /* Indicates that audit should log the full pathname. */
8782 #define AUDIT_NAME_FULL -1
8883
8984 /* number of audit rules */
9085 int audit_n_rules;
9186
87+/* determines whether we collect data for signals sent */
88+int audit_signals;
89+
9290 /* When fs/namei.c:getname() is called, we store the pointer in name and
9391 * we don't let putname() free it (instead we free all of the saved
9492 * pointers at syscall exit time).
@@ -114,6 +112,9 @@ struct audit_aux_data { · 19 unmodified lines
114112
115113 #define AUDIT_AUX_IPCPERM 0
116114
115+/* Number of target pids per aux struct. */
116+#define AUDIT_AUX_PIDS 16
117+
117118 struct audit_aux_data_mq_open {
118119 struct audit_aux_data d;
119120 int oflag;
@@ -181,6 +182,13 @@ struct audit_aux_data_path { · 61 unmodified lines
181182 struct vfsmount *mnt;
182183 };
183184
185+struct audit_aux_data_pids {
186+ struct audit_aux_data d;
187+ pid_t target_pid[AUDIT_AUX_PIDS];
188+ u32 target_sid[AUDIT_AUX_PIDS];
189+ int pid_count;
190+};
191+
184192 /* The per-task audit context. */
185193 struct audit_context {
186194 int dummy; /* must be the first element */
@@ -201,6 +209,7 @@ struct audit_context { · 14 unmodified lines
201209 struct vfsmount * pwdmnt;
202210 struct audit_context *previous; /* For nested syscalls */
203211 struct audit_aux_data *aux;
212+ struct audit_aux_data *aux_pids;
204213
205214 /* Save things to print about task_struct */
206215 pid_t pid, ppid;
@@ -209,6 +218,9 @@ struct audit_context { · 2 unmodified lines
209218 unsigned long personality;
210219 int arch;
211220
221+ pid_t target_pid;
222+ u32 target_sid;
223+
212224 #if AUDIT_DEBUG
213225 int put_count;
214226 int ino_count;
@@ -654,6 +666,10 @@ static inline void audit_free_aux(struct audit_context *context) · 439 unmodified lines
654666 context->aux = aux->next;
655667 kfree(aux);
656668 }
669+ while ((aux = context->aux_pids)) {
670+ context->aux_pids = aux->next;
671+ kfree(aux);
672+ }
657673 }
658674
659675 static inline void audit_zero_context(struct audit_context *context,
@@ -795,6 +811,29 @@ static void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk · 135 unmodified lines
795811 audit_log_task_context(ab);
796812 }
797813
814+static int audit_log_pid_context(struct audit_context *context, pid_t pid,
815+ u32 sid)
816+{
817+ struct audit_buffer *ab;
818+ char *s = NULL;
819+ u32 len;
820+ int rc = 0;
821+
822+ ab = audit_log_start(context, GFP_KERNEL, AUDIT_OBJ_PID);
823+ if (!ab)
824+ return 1;
825+
826+ if (selinux_sid_to_string(sid, &s, &len)) {
827+ audit_log_format(ab, "opid=%d obj=(none)", pid);
828+ rc = 1;
829+ } else
830+ audit_log_format(ab, "opid=%d obj=%s", pid, s);
831+ audit_log_end(ab);
832+ kfree(s);
833+
834+ return rc;
835+}
836+
798837 static void audit_log_exit(struct audit_context *context, struct task_struct *tsk)
799838 {
800839 int i, call_panic = 0;
@@ -973,6 +1012,21 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts · 172 unmodified lines
9731012 audit_log_end(ab);
9741013 }
9751014
1015+ for (aux = context->aux_pids; aux; aux = aux->next) {
1016+ struct audit_aux_data_pids *axs = (void *)aux;
1017+ int i;
1018+
1019+ for (i = 0; i < axs->pid_count; i++)
1020+ if (audit_log_pid_context(context, axs->target_pid[i],
1021+ axs->target_sid[i]))
1022+ call_panic = 1;
1023+ }
1024+
1025+ if (context->target_pid &&
1026+ audit_log_pid_context(context, context->target_pid,
1027+ context->target_sid))
1028+ call_panic = 1;
1029+
9761030 if (context->pwd && context->pwdmnt) {
9771031 ab = audit_log_start(context, GFP_KERNEL, AUDIT_CWD);
9781032 if (ab) {
@@ -1193,6 +1247,10 @@ void audit_syscall_exit(int valid, long return_code) · 214 unmodified lines
11931247 } else {
11941248 audit_free_names(context);
11951249 audit_free_aux(context);
1250+ context->aux = NULL;
1251+ context->aux_pids = NULL;
1252+ context->target_pid = 0;
1253+ context->target_sid = 0;
11961254 kfree(context->filterkey);
11971255 context->filterkey = NULL;
11981256 tsk->audit_context = context;
@@ -1226,6 +1284,7 @@ void __audit_getname(const char *name) · 27 unmodified lines
12261284 context->names[context->name_count].name_len = AUDIT_NAME_FULL;
12271285 context->names[context->name_count].name_put = 1;
12281286 context->names[context->name_count].ino = (unsigned long)-1;
1287+ context->names[context->name_count].osid = 0;
12291288 ++context->name_count;
12301289 if (!context->pwd) {
12311290 read_lock(&current->fs->lock);
@@ -1279,6 +1338,28 @@ void audit_putname(const char *name) · 47 unmodified lines
12791338 #endif
12801339 }
12811340
1341+static int audit_inc_name_count(struct audit_context *context,
1342+ const struct inode *inode)
1343+{
1344+ if (context->name_count >= AUDIT_NAMES) {
1345+ if (inode)
1346+ printk(KERN_DEBUG "name_count maxed, losing inode data: "
1347+ "dev=%02x:%02x, inode=%lu",
1348+ MAJOR(inode->i_sb->s_dev),
1349+ MINOR(inode->i_sb->s_dev),
1350+ inode->i_ino);
1351+
1352+ else
1353+ printk(KERN_DEBUG "name_count maxed, losing inode data");
1354+ return 1;
1355+ }
1356+ context->name_count++;
1357+#if AUDIT_DEBUG
1358+ context->ino_count++;
1359+#endif
1360+ return 0;
1361+}
1362+
12821363 /* Copy inode data into an audit_names. */
12831364 static void audit_copy_inode(struct audit_names *name, const struct inode *inode)
12841365 {
@@ -1316,13 +1397,10 @@ void __audit_inode(const char *name, const struct inode *inode) · 31 unmodified lines
13161397 else {
13171398 /* FIXME: how much do we care about inodes that have no
13181399 * associated name? */
1319− if (context->name_count >= AUDIT_NAMES - AUDIT_NAMES_RESERVED)
1400+ if (audit_inc_name_count(context, inode))
13201401 return;
1321− idx = context->name_count++;
1402+ idx = context->name_count - 1;
13221403 context->names[idx].name = NULL;
1323−#if AUDIT_DEBUG
1324− ++context->ino_count;
1325−#endif
13261404 }
13271405 audit_copy_inode(&context->names[idx], inode);
13281406 }
@@ -1346,7 +1424,7 @@ void __audit_inode_child(const char *dname, const struct inode *inode, · 17 unmodified lines
13461424 {
13471425 int idx;
13481426 struct audit_context *context = current->audit_context;
1349− const char *found_name = NULL;
1427+ const char *found_parent = NULL, *found_child = NULL;
13501428 int dirlen = 0;
13511429
13521430 if (!context->in_syscall)
@@ -1354,88 +1432,73 @@ void __audit_inode_child(const char *dname, const struct inode *inode, · 1 unmodified line
13541432
13551433 /* determine matching parent */
13561434 if (!dname)
1357− goto update_context;
1358− for (idx = 0; idx < context->name_count; idx++)
1359− if (context->names[idx].ino == parent->i_ino) {
1360− const char *name = context->names[idx].name;
1435+ goto add_names;
13611436
1362− if (!name)
1363− continue;
1437+ /* parent is more likely, look for it first */
1438+ for (idx = 0; idx < context->name_count; idx++) {
1439+ struct audit_names *n = &context->names[idx];
13641440
1365− if (audit_compare_dname_path(dname, name, &dirlen) == 0) {
1366− context->names[idx].name_len = dirlen;
1367− found_name = name;
1368− break;
1369− }
1441+ if (!n->name)
1442+ continue;
1443+
1444+ if (n->ino == parent->i_ino &&
1445+ !audit_compare_dname_path(dname, n->name, &dirlen)) {
1446+ n->name_len = dirlen; /* update parent data in place */
1447+ found_parent = n->name;
1448+ goto add_names;
13701449 }
1450+ }
13711451
1372−update_context:
1373− idx = context->name_count;
1374− if (context->name_count == AUDIT_NAMES) {
1375− printk(KERN_DEBUG "name_count maxed and losing %s\n",
1376− found_name ?: "(null)");
1377− return;
1452+ /* no matching parent, look for matching child */
1453+ for (idx = 0; idx < context->name_count; idx++) {
1454+ struct audit_names *n = &context->names[idx];
1455+
1456+ if (!n->name)
1457+ continue;
1458+
1459+ /* strcmp() is the more likely scenario */
1460+ if (!strcmp(dname, n->name) ||
1461+ !audit_compare_dname_path(dname, n->name, &dirlen)) {
1462+ if (inode)
1463+ audit_copy_inode(n, inode);
1464+ else
1465+ n->ino = (unsigned long)-1;
1466+ found_child = n->name;
1467+ goto add_names;
1468+ }
13781469 }
1379− context->name_count++;
1380−#if AUDIT_DEBUG
1381− context->ino_count++;
1382−#endif
1383− /* Re-use the name belonging to the slot for a matching parent directory.
1384− * All names for this context are relinquished in audit_free_names() */
1385− context->names[idx].name = found_name;
1386− context->names[idx].name_len = AUDIT_NAME_FULL;
1387− context->names[idx].name_put = 0; /* don't call __putname() */
1388−
1389− if (!inode)
1390− context->names[idx].ino = (unsigned long)-1;
1391− else
1392− audit_copy_inode(&context->names[idx], inode);
1393−
1394− /* A parent was not found in audit_names, so copy the inode data for the
1395− * provided parent. */
1396− if (!found_name) {
1397− idx = context->name_count;
1398− if (context->name_count == AUDIT_NAMES) {
1399− printk(KERN_DEBUG
1400− "name_count maxed and losing parent inode data: dev=%02x:%02x, inode=%lu",
1401− MAJOR(parent->i_sb->s_dev),
1402− MINOR(parent->i_sb->s_dev),
1403− parent->i_ino);
1470+
1471+add_names:
1472+ if (!found_parent) {
1473+ if (audit_inc_name_count(context, parent))
14041474 return;
1405− }
1406− context->name_count++;
1407−#if AUDIT_DEBUG
1408− context->ino_count++;
1409−#endif
1475+ idx = context->name_count - 1;
1476+ context->names[idx].name = NULL;
14101477 audit_copy_inode(&context->names[idx], parent);
14111478 }
1412−}
14131479
1414−/**
1415− * audit_inode_update - update inode info for last collected name
1416− * @inode: inode being audited
1417− *
1418− * When open() is called on an existing object with the O_CREAT flag, the inode
1419− * data audit initially collects is incorrect. This additional hook ensures
1420− * audit has the inode data for the actual object to be opened.
1421− */
1422−void __audit_inode_update(const struct inode *inode)
1423−{
1424− struct audit_context *context = current->audit_context;
1425− int idx;
1480+ if (!found_child) {
1481+ if (audit_inc_name_count(context, inode))
1482+ return;
1483+ idx = context->name_count - 1;
14261484
1427− if (!context->in_syscall || !inode)
1428− return;
1485+ /* Re-use the name belonging to the slot for a matching parent
1486+ * directory. All names for this context are relinquished in
1487+ * audit_free_names() */
1488+ if (found_parent) {
1489+ context->names[idx].name = found_parent;
1490+ context->names[idx].name_len = AUDIT_NAME_FULL;
1491+ /* don't call __putname() */
1492+ context->names[idx].name_put = 0;
1493+ } else {
1494+ context->names[idx].name = NULL;
1495+ }
14291496
1430− if (context->name_count == 0) {
1431− context->name_count++;
1432−#if AUDIT_DEBUG
1433− context->ino_count++;
1434−#endif
1497+ if (inode)
1498+ audit_copy_inode(&context->names[idx], inode);
1499+ else
1500+ context->names[idx].ino = (unsigned long)-1;
14351501 }
1436− idx = context->name_count - 1;
1437−
1438− audit_copy_inode(&context->names[idx], inode);
14391502 }
14401503
14411504 /**
@@ -1880,6 +1943,14 @@ int audit_sockaddr(int len, void *a) · 438 unmodified lines
18801943 return 0;
18811944 }
18821945
1946+void __audit_ptrace(struct task_struct *t)
1947+{
1948+ struct audit_context *context = current->audit_context;
1949+
1950+ context->target_pid = t->pid;
1951+ selinux_get_task_sid(t, &context->target_sid);
1952+}
1953+
18831954 /**
18841955 * audit_avc_path - record the granting or denial of permissions
18851956 * @dentry: dentry to record
@@ -1918,15 +1989,17 @@ int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt) · 32 unmodified lines
19181989 * If the audit subsystem is being terminated, record the task (pid)
19191990 * and uid that is doing that.
19201991 */
1921−void __audit_signal_info(int sig, struct task_struct *t)
1992+int __audit_signal_info(int sig, struct task_struct *t)
19221993 {
1994+ struct audit_aux_data_pids *axp;
1995+ struct task_struct *tsk = current;
1996+ struct audit_context *ctx = tsk->audit_context;
19231997 extern pid_t audit_sig_pid;
19241998 extern uid_t audit_sig_uid;
19251999 extern u32 audit_sig_sid;
19262000
1927− if (sig == SIGTERM || sig == SIGHUP || sig == SIGUSR1) {
1928− struct task_struct *tsk = current;
1929− struct audit_context *ctx = tsk->audit_context;
2001+ if (audit_pid && t->tgid == audit_pid &&
2002+ (sig == SIGTERM || sig == SIGHUP || sig == SIGUSR1)) {
19302003 audit_sig_pid = tsk->pid;
19312004 if (ctx)
19322005 audit_sig_uid = ctx->loginuid;
@@ -1934,4 +2007,72 @@ void __audit_signal_info(int sig, struct task_struct *t) · 1 unmodified line
19342007 audit_sig_uid = tsk->uid;
19352008 selinux_get_task_sid(tsk, &audit_sig_sid);
19362009 }
2010+
2011+ if (!audit_signals) /* audit_context checked in wrapper */
2012+ return 0;
2013+
2014+ /* optimize the common case by putting first signal recipient directly
2015+ * in audit_context */
2016+ if (!ctx->target_pid) {
2017+ ctx->target_pid = t->tgid;
2018+ selinux_get_task_sid(t, &ctx->target_sid);
2019+ return 0;
2020+ }
2021+
2022+ axp = (void *)ctx->aux_pids;
2023+ if (!axp || axp->pid_count == AUDIT_AUX_PIDS) {
2024+ axp = kzalloc(sizeof(*axp), GFP_ATOMIC);
2025+ if (!axp)
2026+ return -ENOMEM;
2027+
2028+ axp->d.type = AUDIT_OBJ_PID;
2029+ axp->d.next = ctx->aux_pids;
2030+ ctx->aux_pids = (void *)axp;
2031+ }
2032+ BUG_ON(axp->pid_count > AUDIT_AUX_PIDS);
2033+
2034+ axp->target_pid[axp->pid_count] = t->tgid;
2035+ selinux_get_task_sid(t, &axp->target_sid[axp->pid_count]);
2036+ axp->pid_count++;
2037+
2038+ return 0;
2039+}
2040+
2041+/**
2042+ * audit_core_dumps - record information about processes that end abnormally
2043+ * @sig: signal value
2044+ *
2045+ * If a process ends with a core dump, something fishy is going on and we
2046+ * should record the event for investigation.
2047+ */
2048+void audit_core_dumps(long signr)
2049+{
2050+ struct audit_buffer *ab;
2051+ u32 sid;
2052+
2053+ if (!audit_enabled)
2054+ return;
2055+
2056+ if (signr == SIGQUIT) /* don't care for those */
2057+ return;
2058+
2059+ ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_ANOM_ABEND);
2060+ audit_log_format(ab, "auid=%u uid=%u gid=%u",
2061+ audit_get_loginuid(current->audit_context),
2062+ current->uid, current->gid);
2063+ selinux_get_task_sid(current, &sid);
2064+ if (sid) {
2065+ char *ctx = NULL;
2066+ u32 len;
2067+
2068+ if (selinux_sid_to_string(sid, &ctx, &len))
2069+ audit_log_format(ab, " ssid=%u", sid);
2070+ else
2071+ audit_log_format(ab, " subj=%s", ctx);
2072+ kfree(ctx);
2073+ }
2074+ audit_log_format(ab, " pid=%d comm=", current->pid);
2075+ audit_log_untrustedstring(ab, current->comm);
2076+ audit_log_format(ab, " sig=%ld", signr);
2077+ audit_log_end(ab);
19372078 }
kernel/ptrace.c+3−0
@@ -18,6 +18,7 @@ · 17 unmodified lines
1818 #include <linux/ptrace.h>
1919 #include <linux/security.h>
2020 #include <linux/signal.h>
21+#include <linux/audit.h>
2122
2223 #include <asm/pgtable.h>
2324 #include <asm/uaccess.h>
@@ -161,6 +162,8 @@ int ptrace_attach(struct task_struct *task) · 137 unmodified lines
161162 {
162163 int retval;
163164
165+ audit_ptrace(task);
166+
164167 retval = -EPERM;
165168 if (task->pid <= 1)
166169 goto out;
kernel/signal.c+6−4
@@ -497,6 +497,11 @@ static int check_kill_permission(int sig, struct siginfo *info, · 496 unmodified lines
497497 int error = -EINVAL;
498498 if (!valid_signal(sig))
499499 return error;
500+
501+ error = audit_signal_info(sig, t); /* Let audit system see the signal */
502+ if (error)
503+ return error;
504+
500505 error = -EPERM;
501506 if ((info == SEND_SIG_NOINFO || (!is_si_special(info) && SI_FROMUSER(info)))
502507 && ((sig != SIGCONT) ||
@@ -506,10 +511,7 @@ static int check_kill_permission(int sig, struct siginfo *info, · 3 unmodified lines
506511 && !capable(CAP_KILL))
507512 return error;
508513
509− error = security_task_kill(t, info, sig, 0);
510− if (!error)
511− audit_signal_info(sig, t); /* Let audit system see the signal */
512− return error;
514+ return security_task_kill(t, info, sig, 0);
513515 }
514516
515517 /* forward decl */