Skip to content

Commit

Permalink
audit: remove the old depricated kernel interface
Browse files Browse the repository at this point in the history 
We used to have an inflexible mechanism to add audit rules to the
kernel.  It hasn't been used in a long time.  Get rid of that stuff.

Signed-off-by: Eric Paris <eparis@redhat.com>
  • Loading branch information
Eric Paris committed Apr 30, 2013
1 parent ab61d38 commit 1890090
Show file tree
Hide file tree
Showing 2 changed files with 8 additions and 180 deletions.
28 changes: 5 additions & 23 deletions kernel/audit.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -597,13 +597,14 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
return -EPERM;

switch (msg_type) {
case AUDIT_GET:
case AUDIT_LIST:
case AUDIT_LIST_RULES:
case AUDIT_SET:
case AUDIT_ADD:
case AUDIT_ADD_RULE:
case AUDIT_DEL:
return -EOPNOTSUPP;
case AUDIT_GET:
case AUDIT_SET:
case AUDIT_LIST_RULES:
case AUDIT_ADD_RULE:
case AUDIT_DEL_RULE:
case AUDIT_SIGNAL_INFO:
case AUDIT_TTY_GET:
Expand Down Expand Up @@ -766,25 +767,6 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
audit_log_end(ab);
}
break;
case AUDIT_ADD:
case AUDIT_DEL:
if (nlmsg_len(nlh) < sizeof(struct audit_rule))
return -EINVAL;
if (audit_enabled == AUDIT_LOCKED) {
audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE,
loginuid, sessionid, sid);

audit_log_format(ab, " audit_enabled=%d res=0",
audit_enabled);
audit_log_end(ab);
return -EPERM;
}
/* fallthrough */
case AUDIT_LIST:
err = audit_receive_filter(msg_type, NETLINK_CB(skb).portid,
seq, data, nlmsg_len(nlh),
loginuid, sessionid, sid);
break;
case AUDIT_ADD_RULE:
case AUDIT_DEL_RULE:
if (nlmsg_len(nlh) < sizeof(struct audit_rule_data))
Expand Down
160 changes: 3 additions & 157 deletions kernel/auditfilter.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -386,89 +386,6 @@ static int audit_field_valid(struct audit_entry *entry, struct audit_field *f)
return 0;
}

/* Translate struct audit_rule to kernel's rule respresentation.
* Exists for backward compatibility with userspace. */
static struct audit_entry *audit_rule_to_entry(struct audit_rule *rule)
{
struct audit_entry *entry;
int err = 0;
int i;

entry = audit_to_entry_common(rule);
if (IS_ERR(entry))
goto exit_nofree;

for (i = 0; i < rule->field_count; i++) {
struct audit_field *f = &entry->rule.fields[i];
u32 n;

n = rule->fields[i] & (AUDIT_NEGATE|AUDIT_OPERATORS);

/* Support for legacy operators where
* AUDIT_NEGATE bit signifies != and otherwise assumes == */
if (n & AUDIT_NEGATE)
f->op = Audit_not_equal;
else if (!n)
f->op = Audit_equal;
else
f->op = audit_to_op(n);

entry->rule.vers_ops = (n & AUDIT_OPERATORS) ? 2 : 1;

f->type = rule->fields[i] & ~(AUDIT_NEGATE|AUDIT_OPERATORS);
f->val = rule->values[i];
f->uid = INVALID_UID;
f->gid = INVALID_GID;

err = -EINVAL;
if (f->op == Audit_bad)
goto exit_free;

err = audit_field_valid(entry, f);
if (err)
goto exit_free;

err = -EINVAL;
switch (f->type) {
case AUDIT_UID:
case AUDIT_EUID:
case AUDIT_SUID:
case AUDIT_FSUID:
case AUDIT_LOGINUID:
f->uid = make_kuid(current_user_ns(), f->val);
if (!uid_valid(f->uid))
goto exit_free;
break;
case AUDIT_GID:
case AUDIT_EGID:
case AUDIT_SGID:
case AUDIT_FSGID:
f->gid = make_kgid(current_user_ns(), f->val);
if (!gid_valid(f->gid))
goto exit_free;
break;
case AUDIT_ARCH:
entry->rule.arch_f = f;
break;
case AUDIT_INODE:
err = audit_to_inode(&entry->rule, f);
if (err)
goto exit_free;
break;
}
}

if (entry->rule.inode_f && entry->rule.inode_f->op == Audit_not_equal)
entry->rule.inode_f = NULL;

exit_nofree:
return entry;

exit_free:
audit_free_rule(entry);
return ERR_PTR(err);
}

/* Translate struct audit_rule_data to kernel's rule respresentation. */
static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
size_t datasz)
Expand Down Expand Up @@ -622,36 +539,6 @@ static inline size_t audit_pack_string(void **bufp, const char *str)
return len;
}

/* Translate kernel rule respresentation to struct audit_rule.
* Exists for backward compatibility with userspace. */
static struct audit_rule *audit_krule_to_rule(struct audit_krule *krule)
{
struct audit_rule *rule;
int i;

rule = kzalloc(sizeof(*rule), GFP_KERNEL);
if (unlikely(!rule))
return NULL;

rule->flags = krule->flags | krule->listnr;
rule->action = krule->action;
rule->field_count = krule->field_count;
for (i = 0; i < rule->field_count; i++) {
rule->values[i] = krule->fields[i].val;
rule->fields[i] = krule->fields[i].type;

if (krule->vers_ops == 1) {
if (krule->fields[i].op == Audit_not_equal)
rule->fields[i] |= AUDIT_NEGATE;
} else {
rule->fields[i] |= audit_ops[krule->fields[i].op];
}
}
for (i = 0; i < AUDIT_BITMASK_SIZE; i++) rule->mask[i] = krule->mask[i];

return rule;
}

/* Translate kernel rule respresentation to struct audit_rule_data. */
static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule)
{
Expand Down Expand Up @@ -1064,35 +951,6 @@ static inline int audit_del_rule(struct audit_entry *entry)
return ret;
}

/* List rules using struct audit_rule. Exists for backward
* compatibility with userspace. */
static void audit_list(int pid, int seq, struct sk_buff_head *q)
{
struct sk_buff *skb;
struct audit_krule *r;
int i;

/* This is a blocking read, so use audit_filter_mutex instead of rcu
* iterator to sync with list writers. */
for (i=0; i<AUDIT_NR_FILTERS; i++) {
list_for_each_entry(r, &audit_rules_list[i], list) {
struct audit_rule *rule;

rule = audit_krule_to_rule(r);
if (unlikely(!rule))
break;
skb = audit_make_reply(pid, seq, AUDIT_LIST, 0, 1,
rule, sizeof(*rule));
if (skb)
skb_queue_tail(q, skb);
kfree(rule);
}
}
skb = audit_make_reply(pid, seq, AUDIT_LIST, 1, 1, NULL, 0);
if (skb)
skb_queue_tail(q, skb);
}

/* List rules using struct audit_rule_data. */
static void audit_list_rules(int pid, int seq, struct sk_buff_head *q)
{
Expand Down Expand Up @@ -1173,7 +1031,6 @@ int audit_receive_filter(int type, int pid, int seq, void *data,
struct audit_entry *entry;

switch (type) {
case AUDIT_LIST:
case AUDIT_LIST_RULES:
/* We can't just spew out the rules here because we might fill
* the available socket buffer space and deadlock waiting for
Expand All @@ -1188,10 +1045,7 @@ int audit_receive_filter(int type, int pid, int seq, void *data,
skb_queue_head_init(&dest->q);

mutex_lock(&audit_filter_mutex);
if (type == AUDIT_LIST)
audit_list(pid, seq, &dest->q);
else
audit_list_rules(pid, seq, &dest->q);
audit_list_rules(pid, seq, &dest->q);
mutex_unlock(&audit_filter_mutex);

tsk = kthread_run(audit_send_list, dest, "audit_send_list");
Expand All @@ -1201,12 +1055,8 @@ int audit_receive_filter(int type, int pid, int seq, void *data,
err = PTR_ERR(tsk);
}
break;
case AUDIT_ADD:
case AUDIT_ADD_RULE:
if (type == AUDIT_ADD)
entry = audit_rule_to_entry(data);
else
entry = audit_data_to_entry(data, datasz);
entry = audit_data_to_entry(data, datasz);
if (IS_ERR(entry))
return PTR_ERR(entry);

Expand All @@ -1217,12 +1067,8 @@ int audit_receive_filter(int type, int pid, int seq, void *data,
if (err)
audit_free_rule(entry);
break;
case AUDIT_DEL:
case AUDIT_DEL_RULE:
if (type == AUDIT_DEL)
entry = audit_rule_to_entry(data);
else
entry = audit_data_to_entry(data, datasz);
entry = audit_data_to_entry(data, datasz);
if (IS_ERR(entry))
return PTR_ERR(entry);

Expand Down

0 comments on commit 1890090

Please sign in to comment.