Skip to content

Commit

Permalink
---
Browse files Browse the repository at this point in the history 
yaml
---
r: 66376
b: refs/heads/master
c: ab5f5e8
h: refs/heads/master
v: v3
  • Loading branch information
Joy Latten authored and David S. Miller committed Oct 10, 2007
1 parent 0217f8e commit 38d1a22
Show file tree
Hide file tree
Showing 7 changed files with 219 additions and 178 deletions.
2 changes: 1 addition & 1 deletion [refs]
View file
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
---
refs/heads/master: d2e9117c7aa9544d910634e17e3519fd67155229
refs/heads/master: ab5f5e8b144e4c804ef3aa1ce08a9ca9f01187ce
9 changes: 5 additions & 4 deletions trunk/include/linux/audit.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -108,10 +108,11 @@
#define AUDIT_MAC_CIPSOV4_DEL 1408 /* NetLabel: del CIPSOv4 DOI entry */
#define AUDIT_MAC_MAP_ADD 1409 /* NetLabel: add LSM domain mapping */
#define AUDIT_MAC_MAP_DEL 1410 /* NetLabel: del LSM domain mapping */
#define AUDIT_MAC_IPSEC_ADDSA 1411 /* Add a XFRM state */
#define AUDIT_MAC_IPSEC_DELSA 1412 /* Delete a XFRM state */
#define AUDIT_MAC_IPSEC_ADDSPD 1413 /* Add a XFRM policy */
#define AUDIT_MAC_IPSEC_DELSPD 1414 /* Delete a XFRM policy */
#define AUDIT_MAC_IPSEC_ADDSA 1411 /* Not used */
#define AUDIT_MAC_IPSEC_DELSA 1412 /* Not used */
#define AUDIT_MAC_IPSEC_ADDSPD 1413 /* Not used */
#define AUDIT_MAC_IPSEC_DELSPD 1414 /* Not used */
#define AUDIT_MAC_IPSEC_EVENT 1415 /* Audit an IPSec event */

#define AUDIT_FIRST_KERN_ANOM_MSG 1700
#define AUDIT_LAST_KERN_ANOM_MSG 1799
Expand Down
40 changes: 36 additions & 4 deletions trunk/include/net/xfrm.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@
#include <linux/ipsec.h>
#include <linux/in6.h>
#include <linux/mutex.h>
#include <linux/audit.h>

#include <net/sock.h>
#include <net/dst.h>
Expand Down Expand Up @@ -421,15 +422,46 @@ extern unsigned int xfrm_policy_count[XFRM_POLICY_MAX*2];
/* Audit Information */
struct xfrm_audit
{
uid_t loginuid;
u32 loginuid;
u32 secid;
};

#ifdef CONFIG_AUDITSYSCALL
extern void xfrm_audit_log(uid_t auid, u32 secid, int type, int result,
struct xfrm_policy *xp, struct xfrm_state *x);
static inline struct audit_buffer *xfrm_audit_start(u32 auid, u32 sid)
{
struct audit_buffer *audit_buf = NULL;
char *secctx;
u32 secctx_len;

audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC,
AUDIT_MAC_IPSEC_EVENT);
if (audit_buf == NULL)
return NULL;

audit_log_format(audit_buf, "auid=%u", auid);

if (sid != 0 &&
security_secid_to_secctx(sid, &secctx, &secctx_len) == 0) {
audit_log_format(audit_buf, " subj=%s", secctx);
security_release_secctx(secctx, secctx_len);
} else
audit_log_task_context(audit_buf);
return audit_buf;
}

extern void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
u32 auid, u32 sid);
extern void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
u32 auid, u32 sid);
extern void xfrm_audit_state_add(struct xfrm_state *x, int result,
u32 auid, u32 sid);
extern void xfrm_audit_state_delete(struct xfrm_state *x, int result,
u32 auid, u32 sid);
#else
#define xfrm_audit_log(a,s,t,r,p,x) do { ; } while (0)
#define xfrm_audit_policy_add(x, r, a, s) do { ; } while (0)
#define xfrm_audit_policy_delete(x, r, a, s) do { ; } while (0)
#define xfrm_audit_state_add(x, r, a, s) do { ; } while (0)
#define xfrm_audit_state_delete(x, r, a, s) do { ; } while (0)
#endif /* CONFIG_AUDITSYSCALL */

static inline void xfrm_pol_hold(struct xfrm_policy *policy)
Expand Down
21 changes: 10 additions & 11 deletions trunk/net/key/af_key.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,6 @@
#include <linux/proc_fs.h>
#include <linux/init.h>
#include <net/xfrm.h>
#include <linux/audit.h>

#include <net/sock.h>

Expand Down Expand Up @@ -1454,8 +1453,8 @@ static int pfkey_add(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr,
else
err = xfrm_state_update(x);

xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
AUDIT_MAC_IPSEC_ADDSA, err ? 0 : 1, NULL, x);
xfrm_audit_state_add(x, err ? 0 : 1,
audit_get_loginuid(current->audit_context), 0);

if (err < 0) {
x->km.state = XFRM_STATE_DEAD;
Expand Down Expand Up @@ -1508,8 +1507,8 @@ static int pfkey_delete(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
c.event = XFRM_MSG_DELSA;
km_state_notify(x, &c);
out:
xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x);
xfrm_audit_state_delete(x, err ? 0 : 1,
audit_get_loginuid(current->audit_context), 0);
xfrm_state_put(x);

return err;
Expand Down Expand Up @@ -2261,8 +2260,8 @@ static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
err = xfrm_policy_insert(pol->sadb_x_policy_dir-1, xp,
hdr->sadb_msg_type != SADB_X_SPDUPDATE);

xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
AUDIT_MAC_IPSEC_ADDSPD, err ? 0 : 1, xp, NULL);
xfrm_audit_policy_add(xp, err ? 0 : 1,
audit_get_loginuid(current->audit_context), 0);

if (err)
goto out;
Expand Down Expand Up @@ -2345,8 +2344,8 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, struct sadb_msg
if (xp == NULL)
return -ENOENT;

xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
xfrm_audit_policy_delete(xp, err ? 0 : 1,
audit_get_loginuid(current->audit_context), 0);

if (err)
goto out;
Expand Down Expand Up @@ -2606,8 +2605,8 @@ static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
return -ENOENT;

if (delete) {
xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
xfrm_audit_policy_delete(xp, err ? 0 : 1,
audit_get_loginuid(current->audit_context), 0);

if (err)
goto out;
Expand Down
Loading

0 comments on commit 38d1a22

Please sign in to comment.