Merge branch 'audit.b39' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current (dd6ccfe6) · Commits · e / devices / android_kernel_fairphone_FP4

include/linux/audit.h

+17 −15

Original line number	Original line	Diff line number	Diff line
	@@ -161,7 +161,7 @@
	* are currently used in an audit field constant understood by the kernel.		* are currently used in an audit field constant understood by the kernel.
	* If you are adding a new #define AUDIT_<whatever>, please ensure that		* If you are adding a new #define AUDIT_<whatever>, please ensure that
	* AUDIT_UNUSED_BITS is updated if need be. */		* AUDIT_UNUSED_BITS is updated if need be. */
	#define AUDIT_UNUSED_BITS 0x0FFFFC00		#define AUDIT_UNUSED_BITS 0x07FFFC00


	/* Rule fields */		/* Rule fields */
	@@ -213,25 +213,29 @@
	#define AUDIT_NEGATE 0x80000000		#define AUDIT_NEGATE 0x80000000

	/* These are the supported operators.		/* These are the supported operators.
	* 4 2 1		* 4 2 1 8
	* = > <		* = > < ?
	* -------		* ----------
	* 0 0 0 0 nonsense		* 0 0 0 0 00 nonsense
	* 0 0 1 1 <		* 0 0 0 1 08 & bit mask
	* 0 1 0 2 >		* 0 0 1 0 10 <
	* 0 1 1 3 !=		* 0 1 0 0 20 >
	* 1 0 0 4 =		* 0 1 1 0 30 !=
	* 1 0 1 5 <=		* 1 0 0 0 40 =
	* 1 1 0 6 >=		* 1 0 0 1 48 &= bit test
	* 1 1 1 7 all operators		* 1 0 1 0 50 <=
			* 1 1 0 0 60 >=
			* 1 1 1 1 78 all operators
	*/		*/
			#define AUDIT_BIT_MASK 0x08000000
	#define AUDIT_LESS_THAN 0x10000000		#define AUDIT_LESS_THAN 0x10000000
	#define AUDIT_GREATER_THAN 0x20000000		#define AUDIT_GREATER_THAN 0x20000000
	#define AUDIT_NOT_EQUAL 0x30000000		#define AUDIT_NOT_EQUAL 0x30000000
	#define AUDIT_EQUAL 0x40000000		#define AUDIT_EQUAL 0x40000000
			#define AUDIT_BIT_TEST (AUDIT_BIT_MASK\|AUDIT_EQUAL)
	#define AUDIT_LESS_THAN_OR_EQUAL (AUDIT_LESS_THAN\|AUDIT_EQUAL)		#define AUDIT_LESS_THAN_OR_EQUAL (AUDIT_LESS_THAN\|AUDIT_EQUAL)
	#define AUDIT_GREATER_THAN_OR_EQUAL (AUDIT_GREATER_THAN\|AUDIT_EQUAL)		#define AUDIT_GREATER_THAN_OR_EQUAL (AUDIT_GREATER_THAN\|AUDIT_EQUAL)
	#define AUDIT_OPERATORS (AUDIT_EQUAL\|AUDIT_NOT_EQUAL)		#define AUDIT_OPERATORS (AUDIT_EQUAL\|AUDIT_NOT_EQUAL\|AUDIT_BIT_MASK)

	/* Status symbols */		/* Status symbols */
	/* Mask values */		/* Mask values */
	@@ -407,7 +411,6 @@ extern int audit_bprm(struct linux_binprm *bprm);
	extern int audit_socketcall(int nargs, unsigned long *args);		extern int audit_socketcall(int nargs, unsigned long *args);
	extern int audit_sockaddr(int len, void *addr);		extern int audit_sockaddr(int len, void *addr);
	extern int __audit_fd_pair(int fd1, int fd2);		extern int __audit_fd_pair(int fd1, int fd2);
	extern int audit_avc_path(struct dentry dentry, struct vfsmount mnt);
	extern int audit_set_macxattr(const char *name);		extern int audit_set_macxattr(const char *name);
	extern int __audit_mq_open(int oflag, mode_t mode, struct mq_attr __user *u_attr);		extern int __audit_mq_open(int oflag, mode_t mode, struct mq_attr __user *u_attr);
	extern int __audit_mq_timedsend(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec __user *u_abs_timeout);		extern int __audit_mq_timedsend(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec __user *u_abs_timeout);
	@@ -487,7 +490,6 @@ extern int audit_signals;
	#define audit_socketcall(n,a) ({ 0; })		#define audit_socketcall(n,a) ({ 0; })
	#define audit_fd_pair(n,a) ({ 0; })		#define audit_fd_pair(n,a) ({ 0; })
	#define audit_sockaddr(len, addr) ({ 0; })		#define audit_sockaddr(len, addr) ({ 0; })
	#define audit_avc_path(dentry, mnt) ({ 0; })
	#define audit_set_macxattr(n) do { ; } while (0)		#define audit_set_macxattr(n) do { ; } while (0)
	#define audit_mq_open(o,m,a) ({ 0; })		#define audit_mq_open(o,m,a) ({ 0; })
	#define audit_mq_timedsend(d,l,p,t) ({ 0; })		#define audit_mq_timedsend(d,l,p,t) ({ 0; })

kernel/auditfilter.c

+12 −1

Original line number	Original line	Diff line number	Diff line
	@@ -304,7 +304,7 @@ int __init audit_register_class(int class, unsigned *list)

	int audit_match_class(int class, unsigned syscall)		int audit_match_class(int class, unsigned syscall)
	{		{
	if (unlikely(syscall >= AUDIT_BITMASK_SIZE * sizeof(__u32)))		if (unlikely(syscall >= AUDIT_BITMASK_SIZE * 32))
	return 0;		return 0;
	if (unlikely(class >= AUDIT_SYSCALL_CLASSES \|\| !classes[class]))		if (unlikely(class >= AUDIT_SYSCALL_CLASSES \|\| !classes[class]))
	return 0;		return 0;
	@@ -456,6 +456,13 @@ static struct audit_entry audit_rule_to_entry(struct audit_rule rule)
	case AUDIT_DEVMINOR:		case AUDIT_DEVMINOR:
	case AUDIT_EXIT:		case AUDIT_EXIT:
	case AUDIT_SUCCESS:		case AUDIT_SUCCESS:
			/* bit ops are only useful on syscall args */
			if (f->op == AUDIT_BIT_MASK \|\|
			f->op == AUDIT_BIT_TEST) {
			err = -EINVAL;
			goto exit_free;
			}
			break;
	case AUDIT_ARG0:		case AUDIT_ARG0:
	case AUDIT_ARG1:		case AUDIT_ARG1:
	case AUDIT_ARG2:		case AUDIT_ARG2:
	@@ -1566,6 +1573,10 @@ int audit_comparator(const u32 left, const u32 op, const u32 right)
	return (left > right);		return (left > right);
	case AUDIT_GREATER_THAN_OR_EQUAL:		case AUDIT_GREATER_THAN_OR_EQUAL:
	return (left >= right);		return (left >= right);
			case AUDIT_BIT_MASK:
			return (left & right);
			case AUDIT_BIT_TEST:
			return ((left & right) == right);
	}		}
	BUG();		BUG();
	return 0;		return 0;

kernel/auditsc.c

+2 −49

Original line number	Original line	Diff line number	Diff line
	@@ -173,12 +173,6 @@ struct audit_aux_data_fd_pair {
	int fd[2];		int fd[2];
	};		};

	struct audit_aux_data_path {
	struct audit_aux_data d;
	struct dentry *dentry;
	struct vfsmount *mnt;
	};

	struct audit_aux_data_pids {		struct audit_aux_data_pids {
	struct audit_aux_data d;		struct audit_aux_data d;
	pid_t target_pid[AUDIT_AUX_PIDS];		pid_t target_pid[AUDIT_AUX_PIDS];
	@@ -654,12 +648,6 @@ static inline void audit_free_aux(struct audit_context *context)
	struct audit_aux_data *aux;		struct audit_aux_data *aux;

	while ((aux = context->aux)) {		while ((aux = context->aux)) {
	if (aux->type == AUDIT_AVC_PATH) {
	struct audit_aux_data_path axi = (void )aux;
	dput(axi->dentry);
	mntput(axi->mnt);
	}

	context->aux = aux->next;		context->aux = aux->next;
	kfree(aux);		kfree(aux);
	}		}
	@@ -995,7 +983,7 @@ static void audit_log_exit(struct audit_context context, struct task_struct ts
	case AUDIT_IPC: {		case AUDIT_IPC: {
	struct audit_aux_data_ipcctl axi = (void )aux;		struct audit_aux_data_ipcctl axi = (void )aux;
	audit_log_format(ab,		audit_log_format(ab,
	"ouid=%u ogid=%u mode=%x",		"ouid=%u ogid=%u mode=%#o",
	axi->uid, axi->gid, axi->mode);		axi->uid, axi->gid, axi->mode);
	if (axi->osid != 0) {		if (axi->osid != 0) {
	char *ctx = NULL;		char *ctx = NULL;
	@@ -1014,7 +1002,7 @@ static void audit_log_exit(struct audit_context context, struct task_struct ts
	case AUDIT_IPC_SET_PERM: {		case AUDIT_IPC_SET_PERM: {
	struct audit_aux_data_ipcctl axi = (void )aux;		struct audit_aux_data_ipcctl axi = (void )aux;
	audit_log_format(ab,		audit_log_format(ab,
	"qbytes=%lx ouid=%u ogid=%u mode=%x",		"qbytes=%lx ouid=%u ogid=%u mode=%#o",
	axi->qbytes, axi->uid, axi->gid, axi->mode);		axi->qbytes, axi->uid, axi->gid, axi->mode);
	break; }		break; }

	@@ -1038,11 +1026,6 @@ static void audit_log_exit(struct audit_context context, struct task_struct ts
	audit_log_hex(ab, axs->a, axs->len);		audit_log_hex(ab, axs->a, axs->len);
	break; }		break; }

	case AUDIT_AVC_PATH: {
	struct audit_aux_data_path axi = (void )aux;
	audit_log_d_path(ab, "path=", axi->dentry, axi->mnt);
	break; }

	case AUDIT_FD_PAIR: {		case AUDIT_FD_PAIR: {
	struct audit_aux_data_fd_pair axs = (void )aux;		struct audit_aux_data_fd_pair axs = (void )aux;
	audit_log_format(ab, "fd0=%d fd1=%d", axs->fd[0], axs->fd[1]);		audit_log_format(ab, "fd0=%d fd1=%d", axs->fd[0], axs->fd[1]);
	@@ -1990,36 +1973,6 @@ void __audit_ptrace(struct task_struct *t)
	selinux_get_task_sid(t, &context->target_sid);		selinux_get_task_sid(t, &context->target_sid);
	}		}

	/**
	* audit_avc_path - record the granting or denial of permissions
	* @dentry: dentry to record
	* @mnt: mnt to record
	*
	* Returns 0 for success or NULL context or < 0 on error.
	*
	* Called from security/selinux/avc.c::avc_audit()
	*/
	int audit_avc_path(struct dentry dentry, struct vfsmount mnt)
	{
	struct audit_aux_data_path *ax;
	struct audit_context *context = current->audit_context;

	if (likely(!context))
	return 0;

	ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
	if (!ax)
	return -ENOMEM;

	ax->dentry = dget(dentry);
	ax->mnt = mntget(mnt);

	ax->d.type = AUDIT_AVC_PATH;
	ax->d.next = context->aux;
	context->aux = (void *)ax;
	return 0;
	}

	/**		/**
	* audit_signal_info - record signal info for shutting down audit subsystem		* audit_signal_info - record signal info for shutting down audit subsystem
	* @sig: signal value		* @sig: signal value

security/selinux/avc.c

+8 −7

Original line number	Original line	Diff line number	Diff line
	@@ -570,10 +570,12 @@ void avc_audit(u32 ssid, u32 tsid,
	case AVC_AUDIT_DATA_FS:		case AVC_AUDIT_DATA_FS:
	if (a->u.fs.dentry) {		if (a->u.fs.dentry) {
	struct dentry *dentry = a->u.fs.dentry;		struct dentry *dentry = a->u.fs.dentry;
	if (a->u.fs.mnt)		if (a->u.fs.mnt) {
	audit_avc_path(dentry, a->u.fs.mnt);		audit_log_d_path(ab, "path=", dentry, a->u.fs.mnt);
			} else {
	audit_log_format(ab, " name=");		audit_log_format(ab, " name=");
	audit_log_untrustedstring(ab, dentry->d_name.name);		audit_log_untrustedstring(ab, dentry->d_name.name);
			}
	inode = dentry->d_inode;		inode = dentry->d_inode;
	} else if (a->u.fs.inode) {		} else if (a->u.fs.inode) {
	struct dentry *dentry;		struct dentry *dentry;
	@@ -624,9 +626,8 @@ void avc_audit(u32 ssid, u32 tsid,
	case AF_UNIX:		case AF_UNIX:
	u = unix_sk(sk);		u = unix_sk(sk);
	if (u->dentry) {		if (u->dentry) {
	audit_avc_path(u->dentry, u->mnt);		audit_log_d_path(ab, "path=",
	audit_log_format(ab, " name=");		u->dentry, u->mnt);
	audit_log_untrustedstring(ab, u->dentry->d_name.name);
	break;		break;
	}		}
	if (!u->addr)		if (!u->addr)