Skip to content

Commit

Permalink
Merge branch 'audit.b50' of git://git.kernel.org/pub/scm/linux/kernel…
Browse files Browse the repository at this point in the history 
…/git/viro/audit-current

* 'audit.b50' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current:
  [PATCH] new predicate - AUDIT_FILETYPE
  [patch 2/2] Use find_task_by_vpid in audit code
  [patch 1/2] audit: let userspace fully control TTY input auditing
  [PATCH 2/2] audit: fix sparse shadowed variable warnings
  [PATCH 1/2] audit: move extern declarations to audit.h
  Audit: MAINTAINERS update
  Audit: increase the maximum length of the key field
  Audit: standardize string audit interfaces
  Audit: stop deadlock from signals under load
  Audit: save audit_backlog_limit audit messages in case auditd comes back
  Audit: collect sessionid in netlink messages
  Audit: end printk with newline
  • Loading branch information
Linus Torvalds committed Apr 29, 2008
2 parents 97094dc + 8b67dca commit 9781db7
Show file tree
Hide file tree
Showing 22 changed files with 346 additions and 233 deletions.
8 changes: 5 additions & 3 deletions MAINTAINERS
View file
Original file line number Diff line number Diff line change
Expand Up @@ -752,11 +752,13 @@ W: http://atmelwlandriver.sourceforge.net/
S: Maintained

AUDIT SUBSYSTEM
P: David Woodhouse
M: dwmw2@infradead.org
P: Al Viro
M: viro@zeniv.linux.org.uk
P: Eric Paris
M: eparis@redhat.com
L: linux-audit@redhat.com (subscribers-only)
W: http://people.redhat.com/sgrubb/audit/
T: git kernel.org:/pub/scm/linux/kernel/git/dwmw2/audit-2.6.git
T: git git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current.git
S: Maintained

AUXILIARY DISPLAY DRIVERS
Expand Down
63 changes: 6 additions & 57 deletions drivers/char/tty_audit.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@ static void tty_audit_buf_push(struct task_struct *tsk, uid_t loginuid,
get_task_comm(name, tsk);
audit_log_untrustedstring(ab, name);
audit_log_format(ab, " data=");
audit_log_n_untrustedstring(ab, buf->valid, buf->data);
audit_log_n_untrustedstring(ab, buf->data, buf->valid);
audit_log_end(ab);
}
buf->valid = 0;
Expand Down Expand Up @@ -151,14 +151,9 @@ void tty_audit_fork(struct signal_struct *sig)
/**
* tty_audit_push_task - Flush task's pending audit data
*/
void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid)
void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid, u32 sessionid)
{
struct tty_audit_buf *buf;
/* FIXME I think this is correct. Check against netlink once that is
* I really need to read this code more closely. But that's for
* another patch.
*/
unsigned int sessionid = audit_get_sessionid(tsk);

spin_lock_irq(&tsk->sighand->siglock);
buf = tsk->signal->tty_audit_buf;
Expand Down Expand Up @@ -238,6 +233,10 @@ void tty_audit_add_data(struct tty_struct *tty, unsigned char *data,
if (unlikely(size == 0))
return;

if (tty->driver->type == TTY_DRIVER_TYPE_PTY
&& tty->driver->subtype == PTY_TYPE_MASTER)
return;

buf = tty_audit_buf_get(tty);
if (!buf)
return;
Expand Down Expand Up @@ -300,53 +299,3 @@ void tty_audit_push(struct tty_struct *tty)
tty_audit_buf_put(buf);
}
}

/**
* tty_audit_opening - A TTY is being opened.
*
* As a special hack, tasks that close all their TTYs and open new ones
* are assumed to be system daemons (e.g. getty) and auditing is
* automatically disabled for them.
*/
void tty_audit_opening(void)
{
int disable;

disable = 1;
spin_lock_irq(&current->sighand->siglock);
if (current->signal->audit_tty == 0)
disable = 0;
spin_unlock_irq(&current->sighand->siglock);
if (!disable)
return;

task_lock(current);
if (current->files) {
struct fdtable *fdt;
unsigned i;

/*
* We don't take a ref to the file, so we must hold ->file_lock
* instead.
*/
spin_lock(&current->files->file_lock);
fdt = files_fdtable(current->files);
for (i = 0; i < fdt->max_fds; i++) {
struct file *filp;

filp = fcheck_files(current->files, i);
if (filp && is_tty(filp)) {
disable = 0;
break;
}
}
spin_unlock(&current->files->file_lock);
}
task_unlock(current);
if (!disable)
return;

spin_lock_irq(&current->sighand->siglock);
current->signal->audit_tty = 0;
spin_unlock_irq(&current->sighand->siglock);
}
5 changes: 1 addition & 4 deletions drivers/char/tty_io.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2755,7 +2755,6 @@ static int tty_open(struct inode *inode, struct file *filp)
__proc_set_tty(current, tty);
spin_unlock_irq(&current->sighand->siglock);
mutex_unlock(&tty_mutex);
tty_audit_opening();
return 0;
}

Expand Down Expand Up @@ -2818,10 +2817,8 @@ static int ptmx_open(struct inode *inode, struct file *filp)

check_tty_count(tty, "tty_open");
retval = ptm_driver->open(tty, filp);
if (!retval) {
tty_audit_opening();
if (!retval)
return 0;
}
out1:
release_dev(filp);
return retval;
Expand Down
28 changes: 18 additions & 10 deletions include/linux/audit.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -146,7 +146,7 @@
/* Rule structure sizes -- if these change, different AUDIT_ADD and
* AUDIT_LIST commands must be implemented. */
#define AUDIT_MAX_FIELDS 64
#define AUDIT_MAX_KEY_LEN 32
#define AUDIT_MAX_KEY_LEN 256
#define AUDIT_BITMASK_SIZE 64
#define AUDIT_WORD(nr) ((__u32)((nr)/32))
#define AUDIT_BIT(nr) (1 << ((nr) - AUDIT_WORD(nr)*32))
Expand Down Expand Up @@ -209,6 +209,7 @@
#define AUDIT_WATCH 105
#define AUDIT_PERM 106
#define AUDIT_DIR 107
#define AUDIT_FILETYPE 108

#define AUDIT_ARG0 200
#define AUDIT_ARG1 (AUDIT_ARG0+1)
Expand Down Expand Up @@ -549,16 +550,20 @@ extern void audit_log_format(struct audit_buffer *ab,
const char *fmt, ...)
__attribute__((format(printf,2,3)));
extern void audit_log_end(struct audit_buffer *ab);
extern void audit_log_hex(struct audit_buffer *ab,
const unsigned char *buf,
size_t len);
extern int audit_string_contains_control(const char *string,
size_t len);
extern void audit_log_n_hex(struct audit_buffer *ab,
const unsigned char *buf,
size_t len);
extern void audit_log_n_string(struct audit_buffer *ab,
const char *buf,
size_t n);
#define audit_log_string(a,b) audit_log_n_string(a, b, strlen(b));
extern void audit_log_n_untrustedstring(struct audit_buffer *ab,
const char *string,
size_t n);
extern void audit_log_untrustedstring(struct audit_buffer *ab,
const char *string);
extern void audit_log_n_untrustedstring(struct audit_buffer *ab,
size_t n,
const char *string);
extern void audit_log_d_path(struct audit_buffer *ab,
const char *prefix,
struct path *path);
Expand All @@ -569,17 +574,20 @@ extern int audit_update_lsm_rules(void);
extern int audit_filter_user(struct netlink_skb_parms *cb, int type);
extern int audit_filter_type(int type);
extern int audit_receive_filter(int type, int pid, int uid, int seq,
void *data, size_t datasz, uid_t loginuid, u32 sid);
void *data, size_t datasz, uid_t loginuid,
u32 sessionid, u32 sid);
extern int audit_enabled;
#else
#define audit_log(c,g,t,f,...) do { ; } while (0)
#define audit_log_start(c,g,t) ({ NULL; })
#define audit_log_vformat(b,f,a) do { ; } while (0)
#define audit_log_format(b,f,...) do { ; } while (0)
#define audit_log_end(b) do { ; } while (0)
#define audit_log_hex(a,b,l) do { ; } while (0)
#define audit_log_untrustedstring(a,s) do { ; } while (0)
#define audit_log_n_hex(a,b,l) do { ; } while (0)
#define audit_log_n_string(a,c,l) do { ; } while (0)
#define audit_log_string(a,c) do { ; } while (0)
#define audit_log_n_untrustedstring(a,n,s) do { ; } while (0)
#define audit_log_untrustedstring(a,s) do { ; } while (0)
#define audit_log_d_path(b, p, d) do { ; } while (0)
#define audit_enabled 0
#endif
Expand Down
1 change: 1 addition & 0 deletions include/linux/netlink.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -166,6 +166,7 @@ struct netlink_skb_parms
__u32 dst_group;
kernel_cap_t eff_cap;
__u32 loginuid; /* Login (audit) uid */
__u32 sessionid; /* Session id (audit) */
__u32 sid; /* SELinux security id */
};

Expand Down
9 changes: 2 additions & 7 deletions include/linux/tty.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -300,7 +300,6 @@ extern void tty_hangup(struct tty_struct * tty);
extern void tty_vhangup(struct tty_struct * tty);
extern void tty_unhangup(struct file *filp);
extern int tty_hung_up_p(struct file * filp);
extern int is_tty(struct file *filp);
extern void do_SAK(struct tty_struct *tty);
extern void __do_SAK(struct tty_struct *tty);
extern void disassociate_ctty(int priv);
Expand Down Expand Up @@ -351,8 +350,7 @@ extern void tty_audit_add_data(struct tty_struct *tty, unsigned char *data,
extern void tty_audit_exit(void);
extern void tty_audit_fork(struct signal_struct *sig);
extern void tty_audit_push(struct tty_struct *tty);
extern void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid);
extern void tty_audit_opening(void);
extern void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid, u32 sessionid);
#else
static inline void tty_audit_add_data(struct tty_struct *tty,
unsigned char *data, size_t size)
Expand All @@ -367,10 +365,7 @@ static inline void tty_audit_fork(struct signal_struct *sig)
static inline void tty_audit_push(struct tty_struct *tty)
{
}
static inline void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid)
{
}
static inline void tty_audit_opening(void)
static inline void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid, u32 sessionid)
{
}
#endif
Expand Down
1 change: 1 addition & 0 deletions include/net/netlabel.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,7 @@ struct cipso_v4_doi;
struct netlbl_audit {
u32 secid;
uid_t loginuid;
u32 sessionid;
};

/*
Expand Down
23 changes: 12 additions & 11 deletions include/net/xfrm.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -597,8 +597,9 @@ struct xfrm_spi_skb_cb {
/* Audit Information */
struct xfrm_audit
{
u32 loginuid;
u32 secid;
uid_t loginuid;
u32 sessionid;
};

#ifdef CONFIG_AUDITSYSCALL
Expand All @@ -616,13 +617,13 @@ static inline struct audit_buffer *xfrm_audit_start(const char *op)
return audit_buf;
}

static inline void xfrm_audit_helper_usrinfo(u32 auid, u32 secid,
static inline void xfrm_audit_helper_usrinfo(uid_t auid, u32 ses, u32 secid,
struct audit_buffer *audit_buf)
{
char *secctx;
u32 secctx_len;

audit_log_format(audit_buf, " auid=%u", auid);
audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses);
if (secid != 0 &&
security_secid_to_secctx(secid, &secctx, &secctx_len) == 0) {
audit_log_format(audit_buf, " subj=%s", secctx);
Expand All @@ -632,13 +633,13 @@ static inline void xfrm_audit_helper_usrinfo(u32 auid, u32 secid,
}

extern void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
u32 auid, u32 secid);
u32 auid, u32 ses, u32 secid);
extern void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
u32 auid, u32 secid);
u32 auid, u32 ses, u32 secid);
extern void xfrm_audit_state_add(struct xfrm_state *x, int result,
u32 auid, u32 secid);
u32 auid, u32 ses, u32 secid);
extern void xfrm_audit_state_delete(struct xfrm_state *x, int result,
u32 auid, u32 secid);
u32 auid, u32 ses, u32 secid);
extern void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
struct sk_buff *skb);
extern void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family);
Expand All @@ -647,10 +648,10 @@ extern void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
extern void xfrm_audit_state_icvfail(struct xfrm_state *x,
struct sk_buff *skb, u8 proto);
#else
#define xfrm_audit_policy_add(x, r, a, s) do { ; } while (0)
#define xfrm_audit_policy_delete(x, r, a, s) do { ; } while (0)
#define xfrm_audit_state_add(x, r, a, s) do { ; } while (0)
#define xfrm_audit_state_delete(x, r, a, s) do { ; } while (0)
#define xfrm_audit_policy_add(x, r, a, se, s) do { ; } while (0)
#define xfrm_audit_policy_delete(x, r, a, se, s) do { ; } while (0)
#define xfrm_audit_state_add(x, r, a, se, s) do { ; } while (0)
#define xfrm_audit_state_delete(x, r, a, se, s) do { ; } while (0)
#define xfrm_audit_state_replay_overflow(x, s) do { ; } while (0)
#define xfrm_audit_state_notfound_simple(s, f) do { ; } while (0)
#define xfrm_audit_state_notfound(s, f, sp, sq) do { ; } while (0)
Expand Down
Loading

0 comments on commit 9781db7

Please sign in to comment.