Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 047ce6d3 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'audit-pr-20181224' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit 

Pull audit updates from Paul Moore:
 "In the finest of holiday of traditions, I have a number of gifts to
  share today. While most of them are re-gifts from others, unlike the
  typical re-gift, these are things you will want in and around your
  tree; I promise.

  This pull request is perhaps a bit larger than our typical PR, but
  most of it comes from Jan's rework of audit's fanotify code; a very
  welcome improvement. We ran this through our normal regression tests,
  as well as some newly created stress tests and everything looks good.

  Richard added a few patches, mostly cleaning up a few things and and
  shortening some of the audit records that we send to userspace; a
  change the userspace folks are quite happy about.

  Finally YueHaibing and I kick in a few patches to simplify things a
  bit and make the code less prone to errors.

  Lastly, I want to say thanks one more time to everyone who has
  contributed patches, testing, and code reviews for the audit subsystem
  over the past year. The project is what it is due to your help and
  contributions - thank you"

* tag 'audit-pr-20181224' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: (22 commits)
  audit: remove duplicated include from audit.c
  audit: shorten PATH cap values when zero
  audit: use current whenever possible
  audit: minimize our use of audit_log_format()
  audit: remove WATCH and TREE config options
  audit: use session_info helper
  audit: localize audit_log_session_info prototype
  audit: Use 'mark' name for fsnotify_mark variables
  audit: Replace chunk attached to mark instead of replacing mark
  audit: Simplify locking around untag_chunk()
  audit: Drop all unused chunk nodes during deletion
  audit: Guarantee forward progress of chunk untagging
  audit: Allocate fsnotify mark independently of chunk
  audit: Provide helper for dropping mark's chunk reference
  audit: Remove pointless check in insert_hash()
  audit: Factor out chunk replacement code
  audit: Make hash table insertion safe against concurrent lookups
  audit: Embed key into chunk
  audit: Fix possible tagging failures
  audit: Fix possible spurious -ENOSPC error
  ...
parents a3b5c106 d406db52

drivers/tty/tty_audit.c

+6 −7
Original line number Diff line number Diff line
@@ -61,20 +61,19 @@ static void tty_audit_log(const char *description, dev_t dev, 
			  unsigned char *data, size_t size)

{

	struct audit_buffer *ab;

	struct task_struct *tsk = current;

	pid_t pid = task_pid_nr(tsk);

	uid_t uid = from_kuid(&init_user_ns, task_uid(tsk));

	uid_t loginuid = from_kuid(&init_user_ns, audit_get_loginuid(tsk));

	unsigned int sessionid = audit_get_sessionid(tsk);

	pid_t pid = task_pid_nr(current);

	uid_t uid = from_kuid(&init_user_ns, task_uid(current));

	uid_t loginuid = from_kuid(&init_user_ns, audit_get_loginuid(current));

	unsigned int sessionid = audit_get_sessionid(current);



	ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_TTY);

	if (ab) {

		char name[sizeof(tsk->comm)];

		char name[sizeof(current->comm)];



		audit_log_format(ab, "%s pid=%u uid=%u auid=%u ses=%u major=%d"

				 " minor=%d comm=", description, pid, uid,

				 loginuid, sessionid, MAJOR(dev), MINOR(dev));

		get_task_comm(name, tsk);

		get_task_comm(name, current);

		audit_log_untrustedstring(ab, name);

		audit_log_format(ab, " data=");

		audit_log_n_hex(ab, data, size);

include/linux/audit.h

+2 −6
Original line number Diff line number Diff line
@@ -115,8 +115,6 @@ extern int audit_classify_compat_syscall(int abi, unsigned syscall); 


struct filename;



extern void audit_log_session_info(struct audit_buffer *ab);



#define AUDIT_OFF	0

#define AUDIT_ON	1

#define AUDIT_LOCKED	2
@@ -153,8 +151,7 @@ extern void audit_log_link_denied(const char *operation); 
extern void		    audit_log_lost(const char *message);



extern int audit_log_task_context(struct audit_buffer *ab);

extern void audit_log_task_info(struct audit_buffer *ab,

				struct task_struct *tsk);

extern void audit_log_task_info(struct audit_buffer *ab);



extern int		    audit_update_lsm_rules(void);
@@ -202,8 +199,7 @@ static inline int audit_log_task_context(struct audit_buffer *ab) 
{

	return 0;

}

static inline void audit_log_task_info(struct audit_buffer *ab,

				       struct task_struct *tsk)

static inline void audit_log_task_info(struct audit_buffer *ab)

{ }

#define audit_enabled AUDIT_OFF

#endif /* CONFIG_AUDIT */

init/Kconfig

+0 −9
Original line number Diff line number Diff line
@@ -335,15 +335,6 @@ config HAVE_ARCH_AUDITSYSCALL 
config AUDITSYSCALL

	def_bool y

	depends on AUDIT && HAVE_ARCH_AUDITSYSCALL



config AUDIT_WATCH

	def_bool y

	depends on AUDITSYSCALL

	select FSNOTIFY



config AUDIT_TREE

	def_bool y

	depends on AUDITSYSCALL

	select FSNOTIFY



source "kernel/irq/Kconfig"

kernel/Makefile

+1 −3
Original line number Diff line number Diff line
@@ -76,9 +76,7 @@ obj-$(CONFIG_IKCONFIG) += configs.o 
obj-$(CONFIG_SMP) += stop_machine.o

obj-$(CONFIG_KPROBES_SANITY_TEST) += test_kprobes.o

obj-$(CONFIG_AUDIT) += audit.o auditfilter.o

obj-$(CONFIG_AUDITSYSCALL) += auditsc.o

obj-$(CONFIG_AUDIT_WATCH) += audit_watch.o audit_fsnotify.o

obj-$(CONFIG_AUDIT_TREE) += audit_tree.o

obj-$(CONFIG_AUDITSYSCALL) += auditsc.o audit_watch.o audit_fsnotify.o audit_tree.o

obj-$(CONFIG_GCOV_KERNEL) += gcov/

obj-$(CONFIG_KCOV) += kcov.o

obj-$(CONFIG_KPROBES) += kprobes.o

kernel/audit.c

+31 −31
Original line number Diff line number Diff line
@@ -60,7 +60,6 @@ 
#include <linux/mutex.h>

#include <linux/gfp.h>

#include <linux/pid.h>

#include <linux/slab.h>



#include <linux/audit.h>
@@ -1096,10 +1095,11 @@ static void audit_log_feature_change(int which, u32 old_feature, u32 new_feature 


	if (audit_enabled == AUDIT_OFF)

		return;



	ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_FEATURE_CHANGE);

	if (!ab)

		return;

	audit_log_task_info(ab, current);

	audit_log_task_info(ab);

	audit_log_format(ab, " feature=%s old=%u new=%u old_lock=%u new_lock=%u res=%d",

			 audit_feature_names[which], !!old_feature, !!new_feature,

			 !!old_lock, !!new_lock, res);
@@ -2058,11 +2058,13 @@ void audit_log_cap(struct audit_buffer *ab, char *prefix, kernel_cap_t *cap) 
{

	int i;



	audit_log_format(ab, " %s=", prefix);

	CAP_FOR_EACH_U32(i) {

		audit_log_format(ab, "%08x",

				 cap->cap[CAP_LAST_U32 - i]);

	if (cap_isclear(*cap)) {

		audit_log_format(ab, " %s=0", prefix);

		return;

	}

	audit_log_format(ab, " %s=", prefix);

	CAP_FOR_EACH_U32(i)

		audit_log_format(ab, "%08x", cap->cap[CAP_LAST_U32 - i]);

}



static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name)
@@ -2177,22 +2179,21 @@ void audit_log_name(struct audit_context *context, struct audit_names *n, 
	}



	/* log the audit_names record type */

	audit_log_format(ab, " nametype=");

	switch(n->type) {

	case AUDIT_TYPE_NORMAL:

		audit_log_format(ab, "NORMAL");

		audit_log_format(ab, " nametype=NORMAL");

		break;

	case AUDIT_TYPE_PARENT:

		audit_log_format(ab, "PARENT");

		audit_log_format(ab, " nametype=PARENT");

		break;

	case AUDIT_TYPE_CHILD_DELETE:

		audit_log_format(ab, "DELETE");

		audit_log_format(ab, " nametype=DELETE");

		break;

	case AUDIT_TYPE_CHILD_CREATE:

		audit_log_format(ab, "CREATE");

		audit_log_format(ab, " nametype=CREATE");

		break;

	default:

		audit_log_format(ab, "UNKNOWN");

		audit_log_format(ab, " nametype=UNKNOWN");

		break;

	}
@@ -2247,15 +2248,15 @@ void audit_log_d_path_exe(struct audit_buffer *ab, 
	audit_log_format(ab, " exe=(null)");

}



struct tty_struct *audit_get_tty(struct task_struct *tsk)

struct tty_struct *audit_get_tty(void)

{

	struct tty_struct *tty = NULL;

	unsigned long flags;



	spin_lock_irqsave(&tsk->sighand->siglock, flags);

	if (tsk->signal)

		tty = tty_kref_get(tsk->signal->tty);

	spin_unlock_irqrestore(&tsk->sighand->siglock, flags);

	spin_lock_irqsave(&current->sighand->siglock, flags);

	if (current->signal)

		tty = tty_kref_get(current->signal->tty);

	spin_unlock_irqrestore(&current->sighand->siglock, flags);

	return tty;

}
@@ -2264,25 +2265,24 @@ void audit_put_tty(struct tty_struct *tty) 
	tty_kref_put(tty);

}



void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk)

void audit_log_task_info(struct audit_buffer *ab)

{

	const struct cred *cred;

	char comm[sizeof(tsk->comm)];

	char comm[sizeof(current->comm)];

	struct tty_struct *tty;



	if (!ab)

		return;



	/* tsk == current */

	cred = current_cred();

	tty = audit_get_tty(tsk);

	tty = audit_get_tty();

	audit_log_format(ab,

			 " ppid=%d pid=%d auid=%u uid=%u gid=%u"

			 " euid=%u suid=%u fsuid=%u"

			 " egid=%u sgid=%u fsgid=%u tty=%s ses=%u",

			 task_ppid_nr(tsk),

			 task_tgid_nr(tsk),

			 from_kuid(&init_user_ns, audit_get_loginuid(tsk)),

			 task_ppid_nr(current),

			 task_tgid_nr(current),

			 from_kuid(&init_user_ns, audit_get_loginuid(current)),

			 from_kuid(&init_user_ns, cred->uid),

			 from_kgid(&init_user_ns, cred->gid),

			 from_kuid(&init_user_ns, cred->euid),
@@ -2292,11 +2292,11 @@ void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk) 
			 from_kgid(&init_user_ns, cred->sgid),

			 from_kgid(&init_user_ns, cred->fsgid),

			 tty ? tty_name(tty) : "(none)",

			 audit_get_sessionid(tsk));

			 audit_get_sessionid(current));

	audit_put_tty(tty);

	audit_log_format(ab, " comm=");

	audit_log_untrustedstring(ab, get_task_comm(comm, tsk));

	audit_log_d_path_exe(ab, tsk->mm);

	audit_log_untrustedstring(ab, get_task_comm(comm, current));

	audit_log_d_path_exe(ab, current->mm);

	audit_log_task_context(ab);

}

EXPORT_SYMBOL(audit_log_task_info);
@@ -2317,7 +2317,7 @@ void audit_log_link_denied(const char *operation) 
	if (!ab)

		return;

	audit_log_format(ab, "op=%s", operation);

	audit_log_task_info(ab, current);

	audit_log_task_info(ab);

	audit_log_format(ab, " res=0");

	audit_log_end(ab);

}