[PATCH] collect sid of those who send signals to auditd (e1396065) · Commits · e / devices / android_kernel_oneplus_sm7250

include/linux/audit.h

+1 −2

Original line number	Diff line number	Diff line
		@@ -278,6 +278,7 @@ struct audit_rule { /* for AUDIT_LIST, AUDIT_ADD, and AUDIT_DEL */
		struct audit_sig_info {
		uid_t uid;
		pid_t pid;
		char ctx[0];
		};

		struct audit_buffer;
		@@ -328,7 +329,6 @@ extern int audit_bprm(struct linux_binprm *bprm);
		extern int audit_socketcall(int nargs, unsigned long *args);
		extern int audit_sockaddr(int len, void *addr);
		extern int audit_avc_path(struct dentry dentry, struct vfsmount mnt);
		extern void audit_signal_info(int sig, struct task_struct *t);
		extern int audit_set_macxattr(const char *name);
		#else
		#define audit_alloc(t) ({ 0; })
		@@ -349,7 +349,6 @@ extern int audit_set_macxattr(const char *name);
		#define audit_socketcall(n,a) ({ 0; })
		#define audit_sockaddr(len, addr) ({ 0; })
		#define audit_avc_path(dentry, mnt) ({ 0; })
		#define audit_signal_info(s,t) do { ; } while (0)
		#define audit_set_macxattr(n) do { ; } while (0)
		#endif

kernel/audit.c

+20 −11

Original line number	Diff line number	Diff line
		@@ -89,6 +89,7 @@ static int audit_backlog_wait_overflow = 0;
		/* The identity of the user shutting down the audit system. */
		uid_t audit_sig_uid = -1;
		pid_t audit_sig_pid = -1;
		u32 audit_sig_sid = 0;

		/* Records can be lost in several ways:
		0) [suppressed in audit_alloc]
		@@ -479,7 +480,9 @@ static int audit_receive_msg(struct sk_buff skb, struct nlmsghdr nlh)
		struct audit_buffer *ab;
		u16 msg_type = nlh->nlmsg_type;
		uid_t loginuid; /* loginuid of sender */
		struct audit_sig_info sig_data;
		struct audit_sig_info *sig_data;
		char *ctx;
		u32 len;

		err = audit_netlink_ok(NETLINK_CB(skb).eff_cap, msg_type);
		if (err)
		@@ -531,12 +534,9 @@ static int audit_receive_msg(struct sk_buff skb, struct nlmsghdr nlh)
		if (status_get->mask & AUDIT_STATUS_PID) {
		int old = audit_pid;
		if (sid) {
		char *ctx = NULL;
		u32 len;
		int rc;
		if ((rc = selinux_ctxid_to_string(
		if ((err = selinux_ctxid_to_string(
		sid, &ctx, &len)))
		return rc;
		return err;
		else
		audit_log(NULL, GFP_KERNEL,
		AUDIT_CONFIG_CHANGE,
		@@ -572,8 +572,6 @@ static int audit_receive_msg(struct sk_buff skb, struct nlmsghdr nlh)
		"user pid=%d uid=%u auid=%u",
		pid, uid, loginuid);
		if (sid) {
		char *ctx = NULL;
		u32 len;
		if (selinux_ctxid_to_string(
		sid, &ctx, &len)) {
		audit_log_format(ab,
		@@ -612,10 +610,21 @@ static int audit_receive_msg(struct sk_buff skb, struct nlmsghdr nlh)
		loginuid, sid);
		break;
		case AUDIT_SIGNAL_INFO:
		sig_data.uid = audit_sig_uid;
		sig_data.pid = audit_sig_pid;
		err = selinux_ctxid_to_string(audit_sig_sid, &ctx, &len);
		if (err)
		return err;
		sig_data = kmalloc(sizeof(*sig_data) + len, GFP_KERNEL);
		if (!sig_data) {
		kfree(ctx);
		return -ENOMEM;
		}
		sig_data->uid = audit_sig_uid;
		sig_data->pid = audit_sig_pid;
		memcpy(sig_data->ctx, ctx, len);
		kfree(ctx);
		audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_SIGNAL_INFO,
		0, 0, &sig_data, sizeof(sig_data));
		0, 0, sig_data, sizeof(*sig_data) + len);
		kfree(sig_data);
		break;
		default:
		err = -EINVAL;

kernel/audit.h

+11 −0

Original line number	Diff line number	Diff line
		@@ -101,3 +101,14 @@ struct audit_netlink_list {
		int audit_send_list(void *);

		extern int selinux_audit_rule_update(void);

		#ifdef CONFIG_AUDITSYSCALL
		extern void __audit_signal_info(int sig, struct task_struct *t);
		static inline void audit_signal_info(int sig, struct task_struct *t)
		{
		if (unlikely(audit_pid && t->tgid == audit_pid))
		__audit_signal_info(sig, t);
		}
		#else
		#define audit_signal_info(s,t)
		#endif

kernel/auditsc.c

+12 −11

Original line number	Diff line number	Diff line
		@@ -1376,19 +1376,20 @@ int audit_avc_path(struct dentry dentry, struct vfsmount mnt)
		* If the audit subsystem is being terminated, record the task (pid)
		* and uid that is doing that.
		*/
		void audit_signal_info(int sig, struct task_struct *t)
		void __audit_signal_info(int sig, struct task_struct *t)
		{
		extern pid_t audit_sig_pid;
		extern uid_t audit_sig_uid;
		extern u32 audit_sig_sid;

		if (unlikely(audit_pid && t->tgid == audit_pid)) {
		if (sig == SIGTERM \|\| sig == SIGHUP) {
		struct audit_context *ctx = current->audit_context;
		audit_sig_pid = current->pid;
		if (sig == SIGTERM \|\| sig == SIGHUP \|\| sig == SIGUSR1) {
		struct task_struct *tsk = current;
		struct audit_context *ctx = tsk->audit_context;
		audit_sig_pid = tsk->pid;
		if (ctx)
		audit_sig_uid = ctx->loginuid;
		else
		audit_sig_uid = current->uid;
		}
		audit_sig_uid = tsk->uid;
		selinux_get_task_sid(tsk, &audit_sig_sid);
		}
		}

kernel/signal.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -23,12 +23,12 @@
		#include <linux/syscalls.h>
		#include <linux/ptrace.h>
		#include <linux/signal.h>
		#include <linux/audit.h>
		#include <linux/capability.h>
		#include <asm/param.h>
		#include <asm/uaccess.h>
		#include <asm/unistd.h>
		#include <asm/siginfo.h>
		#include "audit.h" /* audit_signal_info() */

		/*
		* SLAB caches for signal bits.