Skip to content

Commit

Permalink
[PATCH] audit: rename AUDIT_SE_* constants
Browse files Browse the repository at this point in the history 
This patch renames some audit constant definitions and adds
additional definitions used by the following patch.  The renaming
avoids ambiguity with respect to the new definitions.

Signed-off-by: Darrel Goeddel <dgoeddel@trustedcs.com>

 include/linux/audit.h          |   15 ++++++++----
 kernel/auditfilter.c           |   50 ++++++++++++++++++++---------------------
 kernel/auditsc.c               |   10 ++++----
 security/selinux/ss/services.c |   32 +++++++++++++-------------
 4 files changed, 56 insertions(+), 51 deletions(-)
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
  • Loading branch information
Darrel Goeddel authored and Al Viro committed Jul 1, 2006
1 parent 5adc8a6 commit 3a6b9f8
Show file tree
Hide file tree
Showing 4 changed files with 56 additions and 51 deletions.
15 changes: 10 additions & 5 deletions include/linux/audit.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -151,12 +151,17 @@
#define AUDIT_PERS 10
#define AUDIT_ARCH 11
#define AUDIT_MSGTYPE 12
#define AUDIT_SE_USER 13 /* security label user */
#define AUDIT_SE_ROLE 14 /* security label role */
#define AUDIT_SE_TYPE 15 /* security label type */
#define AUDIT_SE_SEN 16 /* security label sensitivity label */
#define AUDIT_SE_CLR 17 /* security label clearance label */
#define AUDIT_SUBJ_USER 13 /* security label user */
#define AUDIT_SUBJ_ROLE 14 /* security label role */
#define AUDIT_SUBJ_TYPE 15 /* security label type */
#define AUDIT_SUBJ_SEN 16 /* security label sensitivity label */
#define AUDIT_SUBJ_CLR 17 /* security label clearance label */
#define AUDIT_PPID 18
#define AUDIT_OBJ_USER 19
#define AUDIT_OBJ_ROLE 20
#define AUDIT_OBJ_TYPE 21
#define AUDIT_OBJ_LEV_LOW 22
#define AUDIT_OBJ_LEV_HIGH 23

/* These are ONLY useful when checking
* at syscall exit time (AUDIT_AT_EXIT). */
Expand Down
50 changes: 25 additions & 25 deletions kernel/auditfilter.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -470,11 +470,11 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
case AUDIT_ARG2:
case AUDIT_ARG3:
break;
case AUDIT_SE_USER:
case AUDIT_SE_ROLE:
case AUDIT_SE_TYPE:
case AUDIT_SE_SEN:
case AUDIT_SE_CLR:
case AUDIT_SUBJ_USER:
case AUDIT_SUBJ_ROLE:
case AUDIT_SUBJ_TYPE:
case AUDIT_SUBJ_SEN:
case AUDIT_SUBJ_CLR:
str = audit_unpack_string(&bufp, &remain, f->val);
if (IS_ERR(str))
goto exit_free;
Expand Down Expand Up @@ -611,11 +611,11 @@ static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule)
data->fields[i] = f->type;
data->fieldflags[i] = f->op;
switch(f->type) {
case AUDIT_SE_USER:
case AUDIT_SE_ROLE:
case AUDIT_SE_TYPE:
case AUDIT_SE_SEN:
case AUDIT_SE_CLR:
case AUDIT_SUBJ_USER:
case AUDIT_SUBJ_ROLE:
case AUDIT_SUBJ_TYPE:
case AUDIT_SUBJ_SEN:
case AUDIT_SUBJ_CLR:
data->buflen += data->values[i] =
audit_pack_string(&bufp, f->se_str);
break;
Expand Down Expand Up @@ -654,11 +654,11 @@ static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b)
return 1;

switch(a->fields[i].type) {
case AUDIT_SE_USER:
case AUDIT_SE_ROLE:
case AUDIT_SE_TYPE:
case AUDIT_SE_SEN:
case AUDIT_SE_CLR:
case AUDIT_SUBJ_USER:
case AUDIT_SUBJ_ROLE:
case AUDIT_SUBJ_TYPE:
case AUDIT_SUBJ_SEN:
case AUDIT_SUBJ_CLR:
if (strcmp(a->fields[i].se_str, b->fields[i].se_str))
return 1;
break;
Expand Down Expand Up @@ -774,11 +774,11 @@ static struct audit_entry *audit_dupe_rule(struct audit_krule *old,
* the originals will all be freed when the old rule is freed. */
for (i = 0; i < fcount; i++) {
switch (new->fields[i].type) {
case AUDIT_SE_USER:
case AUDIT_SE_ROLE:
case AUDIT_SE_TYPE:
case AUDIT_SE_SEN:
case AUDIT_SE_CLR:
case AUDIT_SUBJ_USER:
case AUDIT_SUBJ_ROLE:
case AUDIT_SUBJ_TYPE:
case AUDIT_SUBJ_SEN:
case AUDIT_SUBJ_CLR:
err = audit_dupe_selinux_field(&new->fields[i],
&old->fields[i]);
break;
Expand Down Expand Up @@ -1537,11 +1537,11 @@ static inline int audit_rule_has_selinux(struct audit_krule *rule)
for (i = 0; i < rule->field_count; i++) {
struct audit_field *f = &rule->fields[i];
switch (f->type) {
case AUDIT_SE_USER:
case AUDIT_SE_ROLE:
case AUDIT_SE_TYPE:
case AUDIT_SE_SEN:
case AUDIT_SE_CLR:
case AUDIT_SUBJ_USER:
case AUDIT_SUBJ_ROLE:
case AUDIT_SUBJ_TYPE:
case AUDIT_SUBJ_SEN:
case AUDIT_SUBJ_CLR:
return 1;
}
}
Expand Down
10 changes: 5 additions & 5 deletions kernel/auditsc.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -321,11 +321,11 @@ static int audit_filter_rules(struct task_struct *tsk,
if (ctx)
result = audit_comparator(ctx->loginuid, f->op, f->val);
break;
case AUDIT_SE_USER:
case AUDIT_SE_ROLE:
case AUDIT_SE_TYPE:
case AUDIT_SE_SEN:
case AUDIT_SE_CLR:
case AUDIT_SUBJ_USER:
case AUDIT_SUBJ_ROLE:
case AUDIT_SUBJ_TYPE:
case AUDIT_SUBJ_SEN:
case AUDIT_SUBJ_CLR:
/* NOTE: this may return negative values indicating
a temporary error. We simply treat this as a
match for now to avoid losing information that
Expand Down
32 changes: 16 additions & 16 deletions security/selinux/ss/services.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1845,15 +1845,15 @@ int selinux_audit_rule_init(u32 field, u32 op, char *rulestr,
return -ENOTSUPP;

switch (field) {
case AUDIT_SE_USER:
case AUDIT_SE_ROLE:
case AUDIT_SE_TYPE:
case AUDIT_SUBJ_USER:
case AUDIT_SUBJ_ROLE:
case AUDIT_SUBJ_TYPE:
/* only 'equals' and 'not equals' fit user, role, and type */
if (op != AUDIT_EQUAL && op != AUDIT_NOT_EQUAL)
return -EINVAL;
break;
case AUDIT_SE_SEN:
case AUDIT_SE_CLR:
case AUDIT_SUBJ_SEN:
case AUDIT_SUBJ_CLR:
/* we do not allow a range, indicated by the presense of '-' */
if (strchr(rulestr, '-'))
return -EINVAL;
Expand All @@ -1874,29 +1874,29 @@ int selinux_audit_rule_init(u32 field, u32 op, char *rulestr,
tmprule->au_seqno = latest_granting;

switch (field) {
case AUDIT_SE_USER:
case AUDIT_SUBJ_USER:
userdatum = hashtab_search(policydb.p_users.table, rulestr);
if (!userdatum)
rc = -EINVAL;
else
tmprule->au_ctxt.user = userdatum->value;
break;
case AUDIT_SE_ROLE:
case AUDIT_SUBJ_ROLE:
roledatum = hashtab_search(policydb.p_roles.table, rulestr);
if (!roledatum)
rc = -EINVAL;
else
tmprule->au_ctxt.role = roledatum->value;
break;
case AUDIT_SE_TYPE:
case AUDIT_SUBJ_TYPE:
typedatum = hashtab_search(policydb.p_types.table, rulestr);
if (!typedatum)
rc = -EINVAL;
else
tmprule->au_ctxt.type = typedatum->value;
break;
case AUDIT_SE_SEN:
case AUDIT_SE_CLR:
case AUDIT_SUBJ_SEN:
case AUDIT_SUBJ_CLR:
rc = mls_from_string(rulestr, &tmprule->au_ctxt, GFP_ATOMIC);
break;
}
Expand Down Expand Up @@ -1948,7 +1948,7 @@ int selinux_audit_rule_match(u32 ctxid, u32 field, u32 op,
/* a field/op pair that is not caught here will simply fall through
without a match */
switch (field) {
case AUDIT_SE_USER:
case AUDIT_SUBJ_USER:
switch (op) {
case AUDIT_EQUAL:
match = (ctxt->user == rule->au_ctxt.user);
Expand All @@ -1958,7 +1958,7 @@ int selinux_audit_rule_match(u32 ctxid, u32 field, u32 op,
break;
}
break;
case AUDIT_SE_ROLE:
case AUDIT_SUBJ_ROLE:
switch (op) {
case AUDIT_EQUAL:
match = (ctxt->role == rule->au_ctxt.role);
Expand All @@ -1968,7 +1968,7 @@ int selinux_audit_rule_match(u32 ctxid, u32 field, u32 op,
break;
}
break;
case AUDIT_SE_TYPE:
case AUDIT_SUBJ_TYPE:
switch (op) {
case AUDIT_EQUAL:
match = (ctxt->type == rule->au_ctxt.type);
Expand All @@ -1978,9 +1978,9 @@ int selinux_audit_rule_match(u32 ctxid, u32 field, u32 op,
break;
}
break;
case AUDIT_SE_SEN:
case AUDIT_SE_CLR:
level = (field == AUDIT_SE_SEN ?
case AUDIT_SUBJ_SEN:
case AUDIT_SUBJ_CLR:
level = (field == AUDIT_SUBJ_SEN ?
&ctxt->range.level[0] : &ctxt->range.level[1]);
switch (op) {
case AUDIT_EQUAL:
Expand Down

0 comments on commit 3a6b9f8

Please sign in to comment.