Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c2a7780e authored by Eric Paris's avatar Eric Paris Committed by Al Viro
Browse files

[AUDIT] collect uid, loginuid, and comm in OBJ_PID records 



Add uid, loginuid, and comm collection to OBJ_PID records.  This just
gives users a little more information about the task that received a
signal.  pid is rather meaningless after the fact, and even though comm
isn't great we can't collect exe reasonably on this code path for
performance reasons.

Signed-off-by: default avatarEric Paris <eparis@redhat.com>
parent f701b75e

kernel/auditsc.c

+27 −5
Original line number Original line Diff line number Diff line
@@ -176,7 +176,10 @@ struct audit_aux_data_fd_pair { 
struct audit_aux_data_pids {

struct audit_aux_data_pids {

	struct audit_aux_data	d;

	struct audit_aux_data	d;

	pid_t			target_pid[AUDIT_AUX_PIDS];

	pid_t			target_pid[AUDIT_AUX_PIDS];

	uid_t			target_auid[AUDIT_AUX_PIDS];

	uid_t			target_uid[AUDIT_AUX_PIDS];

	u32			target_sid[AUDIT_AUX_PIDS];

	u32			target_sid[AUDIT_AUX_PIDS];

	char 			target_comm[AUDIT_AUX_PIDS][TASK_COMM_LEN];

	int			pid_count;

	int			pid_count;

};

};
@@ -214,7 +217,10 @@ struct audit_context { 
	int		    arch;

	int		    arch;





	pid_t		    target_pid;

	pid_t		    target_pid;

	uid_t		    target_auid;

	uid_t		    target_uid;

	u32		    target_sid;

	u32		    target_sid;

	char		    target_comm[TASK_COMM_LEN];





	struct audit_tree_refs *trees, *first_trees;

	struct audit_tree_refs *trees, *first_trees;

	int tree_count;

	int tree_count;
@@ -930,7 +936,7 @@ static void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk 
}

}





static int audit_log_pid_context(struct audit_context *context, pid_t pid,

static int audit_log_pid_context(struct audit_context *context, pid_t pid,

				 u32 sid)

				 uid_t auid, uid_t uid, u32 sid, char *comm)

{

{

	struct audit_buffer *ab;

	struct audit_buffer *ab;

	char *s = NULL;

	char *s = NULL;
@@ -941,11 +947,14 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid, 
	if (!ab)

	if (!ab)

		return 1;

		return 1;





	audit_log_format(ab, "opid=%d oauid=%d ouid=%d", pid, auid, uid);

	if (selinux_sid_to_string(sid, &s, &len)) {

	if (selinux_sid_to_string(sid, &s, &len)) {

		audit_log_format(ab, "opid=%d obj=(none)", pid);

		audit_log_format(ab, " obj=(none)");

		rc = 1;

		rc = 1;

	} else

	} else

		audit_log_format(ab, "opid=%d  obj=%s", pid, s);

		audit_log_format(ab, " obj=%s", s);

	audit_log_format(ab, " ocomm=");

	audit_log_untrustedstring(ab, comm);

	audit_log_end(ab);

	audit_log_end(ab);

	kfree(s);

	kfree(s);
@@ -1176,13 +1185,17 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts 




		for (i = 0; i < axs->pid_count; i++)

		for (i = 0; i < axs->pid_count; i++)

			if (audit_log_pid_context(context, axs->target_pid[i],

			if (audit_log_pid_context(context, axs->target_pid[i],

						  axs->target_sid[i]))

						  axs->target_auid[i],

						  axs->target_uid[i],

						  axs->target_sid[i],

						  axs->target_comm[i]))

				call_panic = 1;

				call_panic = 1;

	}

	}





	if (context->target_pid &&

	if (context->target_pid &&

	    audit_log_pid_context(context, context->target_pid,

	    audit_log_pid_context(context, context->target_pid,

				  context->target_sid))

				  context->target_auid, context->target_uid,

				  context->target_sid, context->target_comm))

			call_panic = 1;

			call_panic = 1;





	if (context->pwd && context->pwdmnt) {

	if (context->pwd && context->pwdmnt) {
@@ -2185,7 +2198,10 @@ void __audit_ptrace(struct task_struct *t) 
	struct audit_context *context = current->audit_context;

	struct audit_context *context = current->audit_context;





	context->target_pid = t->pid;

	context->target_pid = t->pid;

	context->target_auid = audit_get_loginuid(t);

	context->target_uid = t->uid;

	selinux_get_task_sid(t, &context->target_sid);

	selinux_get_task_sid(t, &context->target_sid);

	memcpy(context->target_comm, t->comm, TASK_COMM_LEN);

}

}





/**

/**
@@ -2222,7 +2238,10 @@ int __audit_signal_info(int sig, struct task_struct *t) 
	 * in audit_context */

	 * in audit_context */

	if (!ctx->target_pid) {

	if (!ctx->target_pid) {

		ctx->target_pid = t->tgid;

		ctx->target_pid = t->tgid;

		ctx->target_auid = audit_get_loginuid(t);

		ctx->target_uid = t->uid;

		selinux_get_task_sid(t, &ctx->target_sid);

		selinux_get_task_sid(t, &ctx->target_sid);

		memcpy(ctx->target_comm, t->comm, TASK_COMM_LEN);

		return 0;

		return 0;

	}

	}
@@ -2239,7 +2258,10 @@ int __audit_signal_info(int sig, struct task_struct *t) 
	BUG_ON(axp->pid_count >= AUDIT_AUX_PIDS);

	BUG_ON(axp->pid_count >= AUDIT_AUX_PIDS);





	axp->target_pid[axp->pid_count] = t->tgid;

	axp->target_pid[axp->pid_count] = t->tgid;

	axp->target_auid[axp->pid_count] = audit_get_loginuid(t);

	axp->target_uid[axp->pid_count] = t->uid;

	selinux_get_task_sid(t, &axp->target_sid[axp->pid_count]);

	selinux_get_task_sid(t, &axp->target_sid[axp->pid_count]);

	memcpy(axp->target_comm[axp->pid_count], t->comm, TASK_COMM_LEN);

	axp->pid_count++;

	axp->pid_count++;





	return 0;

	return 0;