Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 01116105 authored by Stephen Smalley's avatar Stephen Smalley Committed by David Woodhouse
Browse files

AUDIT: Avoid sleeping function in SElinux AVC audit. 



This patch changes the SELinux AVC to defer logging of paths to the audit
framework upon syscall exit, by saving a reference to the (dentry,vfsmount)
pair in an auxiliary audit item on the current audit context for processing
by audit_log_exit.

Signed-off-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: default avatarDavid Woodhouse <dwmw2@infradead.org>
parent fb19b4c6

include/linux/audit.h

+3 −0
Original line number Original line Diff line number Diff line
@@ -69,6 +69,7 @@ 




#define AUDIT_AVC		1400	/* SE Linux avc denial or grant */

#define AUDIT_AVC		1400	/* SE Linux avc denial or grant */

#define AUDIT_SELINUX_ERR	1401	/* Internal SE Linux Errors */

#define AUDIT_SELINUX_ERR	1401	/* Internal SE Linux Errors */

#define AUDIT_AVC_PATH		1402	/* dentry, vfsmount pair from avc */





#define AUDIT_KERNEL		2000	/* Asynchronous audit record. NOT A REQUEST. */

#define AUDIT_KERNEL		2000	/* Asynchronous audit record. NOT A REQUEST. */
@@ -225,6 +226,7 @@ extern uid_t audit_get_loginuid(struct audit_context *ctx); 
extern int audit_ipc_perms(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode);

extern int audit_ipc_perms(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode);

extern int audit_socketcall(int nargs, unsigned long *args);

extern int audit_socketcall(int nargs, unsigned long *args);

extern int audit_sockaddr(int len, void *addr);

extern int audit_sockaddr(int len, void *addr);

extern int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt);

extern void audit_signal_info(int sig, struct task_struct *t);

extern void audit_signal_info(int sig, struct task_struct *t);

#else

#else

#define audit_alloc(t) ({ 0; })

#define audit_alloc(t) ({ 0; })
@@ -240,6 +242,7 @@ extern void audit_signal_info(int sig, struct task_struct *t); 
#define audit_ipc_perms(q,u,g,m) ({ 0; })

#define audit_ipc_perms(q,u,g,m) ({ 0; })

#define audit_socketcall(n,a) ({ 0; })

#define audit_socketcall(n,a) ({ 0; })

#define audit_sockaddr(len, addr) ({ 0; })

#define audit_sockaddr(len, addr) ({ 0; })

#define audit_avc_path(dentry, mnt) ({ 0; })

#define audit_signal_info(s,t) do { ; } while (0)

#define audit_signal_info(s,t) do { ; } while (0)

#endif

#endif

kernel/auditsc.c

+40 −0
Original line number Original line Diff line number Diff line
@@ -34,6 +34,7 @@ 
#include <asm/types.h>

#include <asm/types.h>

#include <linux/mm.h>

#include <linux/mm.h>

#include <linux/module.h>

#include <linux/module.h>

#include <linux/mount.h>

#include <linux/socket.h>

#include <linux/socket.h>

#include <linux/audit.h>

#include <linux/audit.h>

#include <linux/personality.h>

#include <linux/personality.h>
@@ -124,6 +125,11 @@ struct audit_aux_data_sockaddr { 
	char			a[0];

	char			a[0];

};

};





struct audit_aux_data_path {

	struct audit_aux_data	d;

	struct dentry		*dentry;

	struct vfsmount		*mnt;

};





/* The per-task audit context. */

/* The per-task audit context. */

struct audit_context {

struct audit_context {
@@ -553,6 +559,11 @@ static inline void audit_free_aux(struct audit_context *context) 
	struct audit_aux_data *aux;

	struct audit_aux_data *aux;





	while ((aux = context->aux)) {

	while ((aux = context->aux)) {

		if (aux->type == AUDIT_AVC_PATH) {

			struct audit_aux_data_path *axi = (void *)aux;

			dput(axi->dentry);

			mntput(axi->mnt);

		}

		context->aux = aux->next;

		context->aux = aux->next;

		kfree(aux);

		kfree(aux);

	}

	}
@@ -724,6 +735,14 @@ static void audit_log_exit(struct audit_context *context) 
			audit_log_format(ab, "saddr=");

			audit_log_format(ab, "saddr=");

			audit_log_hex(ab, axs->a, axs->len);

			audit_log_hex(ab, axs->a, axs->len);

			break; }

			break; }



		case AUDIT_AVC_PATH: {

			struct audit_aux_data_path *axi = (void *)aux;

			audit_log_d_path(ab, "path=", axi->dentry, axi->mnt);

			dput(axi->dentry);

			mntput(axi->mnt);

			break; }



		}

		}

		audit_log_end(ab);

		audit_log_end(ab);
@@ -1124,6 +1143,27 @@ int audit_sockaddr(int len, void *a) 
	return 0;

	return 0;

}

}





int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt)

{

	struct audit_aux_data_path *ax;

	struct audit_context *context = current->audit_context;



	if (likely(!context))

		return 0;



	ax = kmalloc(sizeof(*ax), GFP_ATOMIC);

	if (!ax)

		return -ENOMEM;



	ax->dentry = dget(dentry);

	ax->mnt = mntget(mnt);



	ax->d.type = AUDIT_AVC_PATH;

	ax->d.next = context->aux;

	context->aux = (void *)ax;

	return 0;

}



void audit_signal_info(int sig, struct task_struct *t)

void audit_signal_info(int sig, struct task_struct *t)

{

{

	extern pid_t audit_sig_pid;

	extern pid_t audit_sig_pid;

security/selinux/avc.c

+8 −9
Original line number Original line Diff line number Diff line
@@ -573,13 +573,10 @@ void avc_audit(u32 ssid, u32 tsid, 
		case AVC_AUDIT_DATA_FS:

		case AVC_AUDIT_DATA_FS:

			if (a->u.fs.dentry) {

			if (a->u.fs.dentry) {

				struct dentry *dentry = a->u.fs.dentry;

				struct dentry *dentry = a->u.fs.dentry;

				if (a->u.fs.mnt) {

				if (a->u.fs.mnt)

					audit_log_d_path(ab, "path=", dentry,

					audit_avc_path(dentry, a->u.fs.mnt);

							a->u.fs.mnt);

				} else {

				audit_log_format(ab, " name=%s",

				audit_log_format(ab, " name=%s",

						 dentry->d_name.name);

						 dentry->d_name.name);

				}

				inode = dentry->d_inode;

				inode = dentry->d_inode;

			} else if (a->u.fs.inode) {

			} else if (a->u.fs.inode) {

				struct dentry *dentry;

				struct dentry *dentry;
@@ -630,8 +627,10 @@ void avc_audit(u32 ssid, u32 tsid, 
				case AF_UNIX:

				case AF_UNIX:

					u = unix_sk(sk);

					u = unix_sk(sk);

					if (u->dentry) {

					if (u->dentry) {

						audit_log_d_path(ab, "path=",

						audit_avc_path(u->dentry, u->mnt);

							u->dentry, u->mnt);

						audit_log_format(ab, " name=%s",

								 u->dentry->d_name.name);



						break;

						break;

					}

					}

					if (!u->addr)

					if (!u->addr)