xfrm: Remove useless xfrm_audit struct. (2e71029e) · Commits · e / devices / android_kernel_teracube_2e

include/net/xfrm.h

+19 −23

Original line number	Original line	Diff line number	Diff line
	@@ -691,12 +691,6 @@ struct xfrm_spi_skb_cb {

	#define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0]))		#define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0]))

	/* Audit Information */
	struct xfrm_audit {
	kuid_t loginuid;
	unsigned int sessionid;
	};

	#ifdef CONFIG_AUDITSYSCALL		#ifdef CONFIG_AUDITSYSCALL
	static inline struct audit_buffer xfrm_audit_start(const char op)		static inline struct audit_buffer xfrm_audit_start(const char op)
	{		{
	@@ -712,22 +706,24 @@ static inline struct audit_buffer xfrm_audit_start(const char op)
	return audit_buf;		return audit_buf;
	}		}

	static inline void xfrm_audit_helper_usrinfo(kuid_t auid, unsigned int ses,		static inline void xfrm_audit_helper_usrinfo(bool task_valid,
	struct audit_buffer *audit_buf)		struct audit_buffer *audit_buf)
	{		{
	audit_log_format(audit_buf, " auid=%u ses=%u",		const unsigned int auid = from_kuid(&init_user_ns, task_valid ?
	from_kuid(&init_user_ns, auid), ses);		audit_get_loginuid(current) :
			INVALID_UID);
			const unsigned int ses = task_valid ? audit_get_sessionid(current) :
			(unsigned int) -1;

			audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses);
	audit_log_task_context(audit_buf);		audit_log_task_context(audit_buf);
	}		}

	void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, kuid_t auid,		void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, bool task_valid);
	unsigned int ses);		void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
	void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, kuid_t auid,		bool task_valid);
	unsigned int ses);		void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid);
	void xfrm_audit_state_add(struct xfrm_state *x, int result, kuid_t auid,		void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid);
	unsigned int ses);
	void xfrm_audit_state_delete(struct xfrm_state *x, int result, kuid_t auid,
	unsigned int ses);
	void xfrm_audit_state_replay_overflow(struct xfrm_state *x,		void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
	struct sk_buff *skb);		struct sk_buff *skb);
	void xfrm_audit_state_replay(struct xfrm_state x, struct sk_buff skb,		void xfrm_audit_state_replay(struct xfrm_state x, struct sk_buff skb,
	@@ -740,22 +736,22 @@ void xfrm_audit_state_icvfail(struct xfrm_state x, struct sk_buff skb,
	#else		#else

	static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,		static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
	kuid_t auid, unsigned int ses)		bool task_valid)
	{		{
	}		}

	static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,		static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
	kuid_t auid, unsigned int ses)		bool task_valid)
	{		{
	}		}

	static inline void xfrm_audit_state_add(struct xfrm_state *x, int result,		static inline void xfrm_audit_state_add(struct xfrm_state *x, int result,
	kuid_t auid, unsigned int ses)		bool task_valid)
	{		{
	}		}

	static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result,		static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result,
	kuid_t auid, unsigned int ses)		bool task_valid)
	{		{
	}		}

	@@ -1499,7 +1495,7 @@ struct xfrmk_spdinfo {

	struct xfrm_state xfrm_find_acq_byseq(struct net net, u32 mark, u32 seq);		struct xfrm_state xfrm_find_acq_byseq(struct net net, u32 mark, u32 seq);
	int xfrm_state_delete(struct xfrm_state *x);		int xfrm_state_delete(struct xfrm_state *x);
	int xfrm_state_flush(struct net net, u8 proto, struct xfrm_audit audit_info);		int xfrm_state_flush(struct net *net, u8 proto, bool task_valid);
	void xfrm_sad_getinfo(struct net net, struct xfrmk_sadinfo si);		void xfrm_sad_getinfo(struct net net, struct xfrmk_sadinfo si);
	void xfrm_spd_getinfo(struct net net, struct xfrmk_spdinfo si);		void xfrm_spd_getinfo(struct net net, struct xfrmk_spdinfo si);
	u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq);		u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq);
	@@ -1594,7 +1590,7 @@ struct xfrm_policy xfrm_policy_bysel_ctx(struct net net, u32 mark,
	int *err);		int *err);
	struct xfrm_policy xfrm_policy_byid(struct net net, u32 mark, u8, int dir,		struct xfrm_policy xfrm_policy_byid(struct net net, u32 mark, u8, int dir,
	u32 id, int delete, int *err);		u32 id, int delete, int *err);
	int xfrm_policy_flush(struct net net, u8 type, struct xfrm_audit audit_info);		int xfrm_policy_flush(struct net *net, u8 type, bool task_valid);
	u32 xfrm_get_acqseq(void);		u32 xfrm_get_acqseq(void);
	int verify_spi_info(u8 proto, u32 min, u32 max);		int verify_spi_info(u8 proto, u32 min, u32 max);
	int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);		int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);

net/key/af_key.c

+7 −23

Original line number	Original line	Diff line number	Diff line
	@@ -1476,9 +1476,7 @@ static int pfkey_add(struct sock sk, struct sk_buff skb, const struct sadb_msg
	else		else
	err = xfrm_state_update(x);		err = xfrm_state_update(x);

	xfrm_audit_state_add(x, err ? 0 : 1,		xfrm_audit_state_add(x, err ? 0 : 1, true);
	audit_get_loginuid(current),
	audit_get_sessionid(current));

	if (err < 0) {		if (err < 0) {
	x->km.state = XFRM_STATE_DEAD;		x->km.state = XFRM_STATE_DEAD;
	@@ -1532,9 +1530,7 @@ static int pfkey_delete(struct sock sk, struct sk_buff skb, const struct sadb_
	c.event = XFRM_MSG_DELSA;		c.event = XFRM_MSG_DELSA;
	km_state_notify(x, &c);		km_state_notify(x, &c);
	out:		out:
	xfrm_audit_state_delete(x, err ? 0 : 1,		xfrm_audit_state_delete(x, err ? 0 : 1, true);
	audit_get_loginuid(current),
	audit_get_sessionid(current));
	xfrm_state_put(x);		xfrm_state_put(x);

	return err;		return err;
	@@ -1726,16 +1722,13 @@ static int pfkey_flush(struct sock sk, struct sk_buff skb, const struct sadb_m
	struct net *net = sock_net(sk);		struct net *net = sock_net(sk);
	unsigned int proto;		unsigned int proto;
	struct km_event c;		struct km_event c;
	struct xfrm_audit audit_info;
	int err, err2;		int err, err2;

	proto = pfkey_satype2proto(hdr->sadb_msg_satype);		proto = pfkey_satype2proto(hdr->sadb_msg_satype);
	if (proto == 0)		if (proto == 0)
	return -EINVAL;		return -EINVAL;

	audit_info.loginuid = audit_get_loginuid(current);		err = xfrm_state_flush(net, proto, true);
	audit_info.sessionid = audit_get_sessionid(current);
	err = xfrm_state_flush(net, proto, &audit_info);
	err2 = unicast_flush_resp(sk, hdr);		err2 = unicast_flush_resp(sk, hdr);
	if (err \|\| err2) {		if (err \|\| err2) {
	if (err == -ESRCH) /* empty table - go quietly */		if (err == -ESRCH) /* empty table - go quietly */
	@@ -2287,9 +2280,7 @@ static int pfkey_spdadd(struct sock sk, struct sk_buff skb, const struct sadb_
	err = xfrm_policy_insert(pol->sadb_x_policy_dir-1, xp,		err = xfrm_policy_insert(pol->sadb_x_policy_dir-1, xp,
	hdr->sadb_msg_type != SADB_X_SPDUPDATE);		hdr->sadb_msg_type != SADB_X_SPDUPDATE);

	xfrm_audit_policy_add(xp, err ? 0 : 1,		xfrm_audit_policy_add(xp, err ? 0 : 1, true);
	audit_get_loginuid(current),
	audit_get_sessionid(current));

	if (err)		if (err)
	goto out;		goto out;
	@@ -2371,9 +2362,7 @@ static int pfkey_spddelete(struct sock sk, struct sk_buff skb, const struct sa
	if (xp == NULL)		if (xp == NULL)
	return -ENOENT;		return -ENOENT;

	xfrm_audit_policy_delete(xp, err ? 0 : 1,		xfrm_audit_policy_delete(xp, err ? 0 : 1, true);
	audit_get_loginuid(current),
	audit_get_sessionid(current));

	if (err)		if (err)
	goto out;		goto out;
	@@ -2621,9 +2610,7 @@ static int pfkey_spdget(struct sock sk, struct sk_buff skb, const struct sadb_
	return -ENOENT;		return -ENOENT;

	if (delete) {		if (delete) {
	xfrm_audit_policy_delete(xp, err ? 0 : 1,		xfrm_audit_policy_delete(xp, err ? 0 : 1, true);
	audit_get_loginuid(current),
	audit_get_sessionid(current));

	if (err)		if (err)
	goto out;		goto out;
	@@ -2732,12 +2719,9 @@ static int pfkey_spdflush(struct sock sk, struct sk_buff skb, const struct sad
	{		{
	struct net *net = sock_net(sk);		struct net *net = sock_net(sk);
	struct km_event c;		struct km_event c;
	struct xfrm_audit audit_info;
	int err, err2;		int err, err2;

	audit_info.loginuid = audit_get_loginuid(current);		err = xfrm_policy_flush(net, XFRM_POLICY_TYPE_MAIN, true);
	audit_info.sessionid = audit_get_sessionid(current);
	err = xfrm_policy_flush(net, XFRM_POLICY_TYPE_MAIN, &audit_info);
	err2 = unicast_flush_resp(sk, hdr);		err2 = unicast_flush_resp(sk, hdr);
	if (err \|\| err2) {		if (err \|\| err2) {
	if (err == -ESRCH) /* empty table - old silent behavior */		if (err == -ESRCH) /* empty table - old silent behavior */

net/xfrm/xfrm_policy.c

+14 −26

Original line number	Original line	Diff line number	Diff line
	@@ -769,7 +769,7 @@ EXPORT_SYMBOL(xfrm_policy_byid);

	#ifdef CONFIG_SECURITY_NETWORK_XFRM		#ifdef CONFIG_SECURITY_NETWORK_XFRM
	static inline int		static inline int
	xfrm_policy_flush_secctx_check(struct net net, u8 type, struct xfrm_audit audit_info)		xfrm_policy_flush_secctx_check(struct net *net, u8 type, bool task_valid)
	{		{
	int dir, err = 0;		int dir, err = 0;

	@@ -783,9 +783,7 @@ xfrm_policy_flush_secctx_check(struct net net, u8 type, struct xfrm_audit audi
	continue;		continue;
	err = security_xfrm_policy_delete(pol->security);		err = security_xfrm_policy_delete(pol->security);
	if (err) {		if (err) {
	xfrm_audit_policy_delete(pol, 0,		xfrm_audit_policy_delete(pol, 0, task_valid);
	audit_info->loginuid,
	audit_info->sessionid);
	return err;		return err;
	}		}
	}		}
	@@ -799,8 +797,7 @@ xfrm_policy_flush_secctx_check(struct net net, u8 type, struct xfrm_audit audi
	pol->security);		pol->security);
	if (err) {		if (err) {
	xfrm_audit_policy_delete(pol, 0,		xfrm_audit_policy_delete(pol, 0,
	audit_info->loginuid,		task_valid);
	audit_info->sessionid);
	return err;		return err;
	}		}
	}		}
	@@ -810,19 +807,19 @@ xfrm_policy_flush_secctx_check(struct net net, u8 type, struct xfrm_audit audi
	}		}
	#else		#else
	static inline int		static inline int
	xfrm_policy_flush_secctx_check(struct net net, u8 type, struct xfrm_audit audit_info)		xfrm_policy_flush_secctx_check(struct net *net, u8 type, bool task_valid)
	{		{
	return 0;		return 0;
	}		}
	#endif		#endif

	int xfrm_policy_flush(struct net net, u8 type, struct xfrm_audit audit_info)		int xfrm_policy_flush(struct net *net, u8 type, bool task_valid)
	{		{
	int dir, err = 0, cnt = 0;		int dir, err = 0, cnt = 0;

	write_lock_bh(&net->xfrm.xfrm_policy_lock);		write_lock_bh(&net->xfrm.xfrm_policy_lock);

	err = xfrm_policy_flush_secctx_check(net, type, audit_info);		err = xfrm_policy_flush_secctx_check(net, type, task_valid);
	if (err)		if (err)
	goto out;		goto out;

	@@ -839,8 +836,7 @@ int xfrm_policy_flush(struct net net, u8 type, struct xfrm_audit audit_info)
	write_unlock_bh(&net->xfrm.xfrm_policy_lock);		write_unlock_bh(&net->xfrm.xfrm_policy_lock);
	cnt++;		cnt++;

	xfrm_audit_policy_delete(pol, 1, audit_info->loginuid,		xfrm_audit_policy_delete(pol, 1, task_valid);
	audit_info->sessionid);

	xfrm_policy_kill(pol);		xfrm_policy_kill(pol);

	@@ -859,9 +855,7 @@ int xfrm_policy_flush(struct net net, u8 type, struct xfrm_audit audit_info)
	write_unlock_bh(&net->xfrm.xfrm_policy_lock);		write_unlock_bh(&net->xfrm.xfrm_policy_lock);
	cnt++;		cnt++;

	xfrm_audit_policy_delete(pol, 1,		xfrm_audit_policy_delete(pol, 1, task_valid);
	audit_info->loginuid,
	audit_info->sessionid);
	xfrm_policy_kill(pol);		xfrm_policy_kill(pol);

	write_lock_bh(&net->xfrm.xfrm_policy_lock);		write_lock_bh(&net->xfrm.xfrm_policy_lock);
	@@ -2858,19 +2852,14 @@ static int __net_init xfrm_policy_init(struct net *net)

	static void xfrm_policy_fini(struct net *net)		static void xfrm_policy_fini(struct net *net)
	{		{
	struct xfrm_audit audit_info;
	unsigned int sz;		unsigned int sz;
	int dir;		int dir;

	flush_work(&net->xfrm.policy_hash_work);		flush_work(&net->xfrm.policy_hash_work);
	#ifdef CONFIG_XFRM_SUB_POLICY		#ifdef CONFIG_XFRM_SUB_POLICY
	audit_info.loginuid = INVALID_UID;		xfrm_policy_flush(net, XFRM_POLICY_TYPE_SUB, false);
	audit_info.sessionid = (unsigned int)-1;
	xfrm_policy_flush(net, XFRM_POLICY_TYPE_SUB, &audit_info);
	#endif		#endif
	audit_info.loginuid = INVALID_UID;		xfrm_policy_flush(net, XFRM_POLICY_TYPE_MAIN, false);
	audit_info.sessionid = (unsigned int)-1;
	xfrm_policy_flush(net, XFRM_POLICY_TYPE_MAIN, &audit_info);

	WARN_ON(!list_empty(&net->xfrm.policy_all));		WARN_ON(!list_empty(&net->xfrm.policy_all));

	@@ -2985,15 +2974,14 @@ static void xfrm_audit_common_policyinfo(struct xfrm_policy *xp,
	}		}
	}		}

	void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,		void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, bool task_valid)
	kuid_t auid, unsigned int sessionid)
	{		{
	struct audit_buffer *audit_buf;		struct audit_buffer *audit_buf;

	audit_buf = xfrm_audit_start("SPD-add");		audit_buf = xfrm_audit_start("SPD-add");
	if (audit_buf == NULL)		if (audit_buf == NULL)
	return;		return;
	xfrm_audit_helper_usrinfo(auid, sessionid, audit_buf);		xfrm_audit_helper_usrinfo(task_valid, audit_buf);
	audit_log_format(audit_buf, " res=%u", result);		audit_log_format(audit_buf, " res=%u", result);
	xfrm_audit_common_policyinfo(xp, audit_buf);		xfrm_audit_common_policyinfo(xp, audit_buf);
	audit_log_end(audit_buf);		audit_log_end(audit_buf);
	@@ -3001,14 +2989,14 @@ void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
	EXPORT_SYMBOL_GPL(xfrm_audit_policy_add);		EXPORT_SYMBOL_GPL(xfrm_audit_policy_add);

	void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,		void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
	kuid_t auid, unsigned int sessionid)		bool task_valid)
	{		{
	struct audit_buffer *audit_buf;		struct audit_buffer *audit_buf;

	audit_buf = xfrm_audit_start("SPD-delete");		audit_buf = xfrm_audit_start("SPD-delete");
	if (audit_buf == NULL)		if (audit_buf == NULL)
	return;		return;
	xfrm_audit_helper_usrinfo(auid, sessionid, audit_buf);		xfrm_audit_helper_usrinfo(task_valid, audit_buf);
	audit_log_format(audit_buf, " res=%u", result);		audit_log_format(audit_buf, " res=%u", result);
	xfrm_audit_common_policyinfo(xp, audit_buf);		xfrm_audit_common_policyinfo(xp, audit_buf);
	audit_log_end(audit_buf);		audit_log_end(audit_buf);

net/xfrm/xfrm_state.c

+12 −22

Original line number	Original line	Diff line number	Diff line
	@@ -463,9 +463,7 @@ static enum hrtimer_restart xfrm_timer_handler(struct hrtimer *me)
	if (!err)		if (!err)
	km_state_expired(x, 1, 0);		km_state_expired(x, 1, 0);

	xfrm_audit_state_delete(x, err ? 0 : 1,		xfrm_audit_state_delete(x, err ? 0 : 1, true);
	audit_get_loginuid(current),
	audit_get_sessionid(current));

	out:		out:
	spin_unlock(&x->lock);		spin_unlock(&x->lock);
	@@ -562,7 +560,7 @@ EXPORT_SYMBOL(xfrm_state_delete);

	#ifdef CONFIG_SECURITY_NETWORK_XFRM		#ifdef CONFIG_SECURITY_NETWORK_XFRM
	static inline int		static inline int
	xfrm_state_flush_secctx_check(struct net net, u8 proto, struct xfrm_audit audit_info)		xfrm_state_flush_secctx_check(struct net *net, u8 proto, bool task_valid)
	{		{
	int i, err = 0;		int i, err = 0;

	@@ -572,9 +570,7 @@ xfrm_state_flush_secctx_check(struct net net, u8 proto, struct xfrm_audit audi
	hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {		hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
	if (xfrm_id_proto_match(x->id.proto, proto) &&		if (xfrm_id_proto_match(x->id.proto, proto) &&
	(err = security_xfrm_state_delete(x)) != 0) {		(err = security_xfrm_state_delete(x)) != 0) {
	xfrm_audit_state_delete(x, 0,		xfrm_audit_state_delete(x, 0, task_valid);
	audit_info->loginuid,
	audit_info->sessionid);
	return err;		return err;
	}		}
	}		}
	@@ -584,18 +580,18 @@ xfrm_state_flush_secctx_check(struct net net, u8 proto, struct xfrm_audit audi
	}		}
	#else		#else
	static inline int		static inline int
	xfrm_state_flush_secctx_check(struct net net, u8 proto, struct xfrm_audit audit_info)		xfrm_state_flush_secctx_check(struct net *net, u8 proto, bool task_valid)
	{		{
	return 0;		return 0;
	}		}
	#endif		#endif

	int xfrm_state_flush(struct net net, u8 proto, struct xfrm_audit audit_info)		int xfrm_state_flush(struct net *net, u8 proto, bool task_valid)
	{		{
	int i, err = 0, cnt = 0;		int i, err = 0, cnt = 0;

	spin_lock_bh(&net->xfrm.xfrm_state_lock);		spin_lock_bh(&net->xfrm.xfrm_state_lock);
	err = xfrm_state_flush_secctx_check(net, proto, audit_info);		err = xfrm_state_flush_secctx_check(net, proto, task_valid);
	if (err)		if (err)
	goto out;		goto out;

	@@ -611,8 +607,7 @@ int xfrm_state_flush(struct net net, u8 proto, struct xfrm_audit audit_info)

	err = xfrm_state_delete(x);		err = xfrm_state_delete(x);
	xfrm_audit_state_delete(x, err ? 0 : 1,		xfrm_audit_state_delete(x, err ? 0 : 1,
	audit_info->loginuid,		task_valid);
	audit_info->sessionid);
	xfrm_state_put(x);		xfrm_state_put(x);
	if (!err)		if (!err)
	cnt++;		cnt++;
	@@ -2126,13 +2121,10 @@ int __net_init xfrm_state_init(struct net *net)

	void xfrm_state_fini(struct net *net)		void xfrm_state_fini(struct net *net)
	{		{
	struct xfrm_audit audit_info;
	unsigned int sz;		unsigned int sz;

	flush_work(&net->xfrm.state_hash_work);		flush_work(&net->xfrm.state_hash_work);
	audit_info.loginuid = INVALID_UID;		xfrm_state_flush(net, IPSEC_PROTO_ANY, false);
	audit_info.sessionid = (unsigned int)-1;
	xfrm_state_flush(net, IPSEC_PROTO_ANY, &audit_info);
	flush_work(&net->xfrm.state_gc_work);		flush_work(&net->xfrm.state_gc_work);

	WARN_ON(!list_empty(&net->xfrm.state_all));		WARN_ON(!list_empty(&net->xfrm.state_all));
	@@ -2195,30 +2187,28 @@ static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family,
	}		}
	}		}

	void xfrm_audit_state_add(struct xfrm_state *x, int result,		void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid)
	kuid_t auid, unsigned int sessionid)
	{		{
	struct audit_buffer *audit_buf;		struct audit_buffer *audit_buf;

	audit_buf = xfrm_audit_start("SAD-add");		audit_buf = xfrm_audit_start("SAD-add");
	if (audit_buf == NULL)		if (audit_buf == NULL)
	return;		return;
	xfrm_audit_helper_usrinfo(auid, sessionid, audit_buf);		xfrm_audit_helper_usrinfo(task_valid, audit_buf);
	xfrm_audit_helper_sainfo(x, audit_buf);		xfrm_audit_helper_sainfo(x, audit_buf);
	audit_log_format(audit_buf, " res=%u", result);		audit_log_format(audit_buf, " res=%u", result);
	audit_log_end(audit_buf);		audit_log_end(audit_buf);
	}		}
	EXPORT_SYMBOL_GPL(xfrm_audit_state_add);		EXPORT_SYMBOL_GPL(xfrm_audit_state_add);

	void xfrm_audit_state_delete(struct xfrm_state *x, int result,		void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid)
	kuid_t auid, unsigned int sessionid)
	{		{
	struct audit_buffer *audit_buf;		struct audit_buffer *audit_buf;

	audit_buf = xfrm_audit_start("SAD-delete");		audit_buf = xfrm_audit_start("SAD-delete");
	if (audit_buf == NULL)		if (audit_buf == NULL)
	return;		return;
	xfrm_audit_helper_usrinfo(auid, sessionid, audit_buf);		xfrm_audit_helper_usrinfo(task_valid, audit_buf);
	xfrm_audit_helper_sainfo(x, audit_buf);		xfrm_audit_helper_sainfo(x, audit_buf);
	audit_log_format(audit_buf, " res=%u", result);		audit_log_format(audit_buf, " res=%u", result);
	audit_log_end(audit_buf);		audit_log_end(audit_buf);

net/xfrm/xfrm_user.c

+8 −30

Original line number	Original line	Diff line number	Diff line
	@@ -597,8 +597,6 @@ static int xfrm_add_sa(struct sk_buff skb, struct nlmsghdr nlh,
	struct xfrm_state *x;		struct xfrm_state *x;
	int err;		int err;
	struct km_event c;		struct km_event c;
	kuid_t loginuid = audit_get_loginuid(current);
	unsigned int sessionid = audit_get_sessionid(current);

	err = verify_newsa_info(p, attrs);		err = verify_newsa_info(p, attrs);
	if (err)		if (err)
	@@ -614,7 +612,7 @@ static int xfrm_add_sa(struct sk_buff skb, struct nlmsghdr nlh,
	else		else
	err = xfrm_state_update(x);		err = xfrm_state_update(x);

	xfrm_audit_state_add(x, err ? 0 : 1, loginuid, sessionid);		xfrm_audit_state_add(x, err ? 0 : 1, true);

	if (err < 0) {		if (err < 0) {
	x->km.state = XFRM_STATE_DEAD;		x->km.state = XFRM_STATE_DEAD;
	@@ -674,8 +672,6 @@ static int xfrm_del_sa(struct sk_buff skb, struct nlmsghdr nlh,
	int err = -ESRCH;		int err = -ESRCH;
	struct km_event c;		struct km_event c;
	struct xfrm_usersa_id *p = nlmsg_data(nlh);		struct xfrm_usersa_id *p = nlmsg_data(nlh);
	kuid_t loginuid = audit_get_loginuid(current);
	unsigned int sessionid = audit_get_sessionid(current);

	x = xfrm_user_state_lookup(net, p, attrs, &err);		x = xfrm_user_state_lookup(net, p, attrs, &err);
	if (x == NULL)		if (x == NULL)
	@@ -700,7 +696,7 @@ static int xfrm_del_sa(struct sk_buff skb, struct nlmsghdr nlh,
	km_state_notify(x, &c);		km_state_notify(x, &c);

	out:		out:
	xfrm_audit_state_delete(x, err ? 0 : 1, loginuid, sessionid);		xfrm_audit_state_delete(x, err ? 0 : 1, true);
	xfrm_state_put(x);		xfrm_state_put(x);
	return err;		return err;
	}		}
	@@ -1410,8 +1406,6 @@ static int xfrm_add_policy(struct sk_buff skb, struct nlmsghdr nlh,
	struct km_event c;		struct km_event c;
	int err;		int err;
	int excl;		int excl;
	kuid_t loginuid = audit_get_loginuid(current);
	unsigned int sessionid = audit_get_sessionid(current);

	err = verify_newpolicy_info(p);		err = verify_newpolicy_info(p);
	if (err)		if (err)
	@@ -1430,7 +1424,7 @@ static int xfrm_add_policy(struct sk_buff skb, struct nlmsghdr nlh,
	* a type XFRM_MSG_UPDPOLICY - JHS */		* a type XFRM_MSG_UPDPOLICY - JHS */
	excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY;		excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY;
	err = xfrm_policy_insert(p->dir, xp, excl);		err = xfrm_policy_insert(p->dir, xp, excl);
	xfrm_audit_policy_add(xp, err ? 0 : 1, loginuid, sessionid);		xfrm_audit_policy_add(xp, err ? 0 : 1, true);

	if (err) {		if (err) {
	security_xfrm_policy_free(xp->security);		security_xfrm_policy_free(xp->security);
	@@ -1667,10 +1661,7 @@ static int xfrm_get_policy(struct sk_buff skb, struct nlmsghdr nlh,
	NETLINK_CB(skb).portid);		NETLINK_CB(skb).portid);
	}		}
	} else {		} else {
	kuid_t loginuid = audit_get_loginuid(current);		xfrm_audit_policy_delete(xp, err ? 0 : 1, true);
	unsigned int sessionid = audit_get_sessionid(current);

	xfrm_audit_policy_delete(xp, err ? 0 : 1, loginuid, sessionid);

	if (err != 0)		if (err != 0)
	goto out;		goto out;
	@@ -1695,12 +1686,9 @@ static int xfrm_flush_sa(struct sk_buff skb, struct nlmsghdr nlh,
	struct net *net = sock_net(skb->sk);		struct net *net = sock_net(skb->sk);
	struct km_event c;		struct km_event c;
	struct xfrm_usersa_flush *p = nlmsg_data(nlh);		struct xfrm_usersa_flush *p = nlmsg_data(nlh);
	struct xfrm_audit audit_info;
	int err;		int err;

	audit_info.loginuid = audit_get_loginuid(current);		err = xfrm_state_flush(net, p->proto, true);
	audit_info.sessionid = audit_get_sessionid(current);
	err = xfrm_state_flush(net, p->proto, &audit_info);
	if (err) {		if (err) {
	if (err == -ESRCH) /* empty table */		if (err == -ESRCH) /* empty table */
	return 0;		return 0;
	@@ -1884,15 +1872,12 @@ static int xfrm_flush_policy(struct sk_buff skb, struct nlmsghdr nlh,
	struct km_event c;		struct km_event c;
	u8 type = XFRM_POLICY_TYPE_MAIN;		u8 type = XFRM_POLICY_TYPE_MAIN;
	int err;		int err;
	struct xfrm_audit audit_info;

	err = copy_from_user_policy_type(&type, attrs);		err = copy_from_user_policy_type(&type, attrs);
	if (err)		if (err)
	return err;		return err;

	audit_info.loginuid = audit_get_loginuid(current);		err = xfrm_policy_flush(net, type, true);
	audit_info.sessionid = audit_get_sessionid(current);
	err = xfrm_policy_flush(net, type, &audit_info);
	if (err) {		if (err) {
	if (err == -ESRCH) /* empty table */		if (err == -ESRCH) /* empty table */
	return 0;		return 0;
	@@ -1958,12 +1943,8 @@ static int xfrm_add_pol_expire(struct sk_buff skb, struct nlmsghdr nlh,

	err = 0;		err = 0;
	if (up->hard) {		if (up->hard) {
	kuid_t loginuid = audit_get_loginuid(current);
	unsigned int sessionid = audit_get_sessionid(current);

	xfrm_policy_delete(xp, p->dir);		xfrm_policy_delete(xp, p->dir);
	xfrm_audit_policy_delete(xp, 1, loginuid, sessionid);		xfrm_audit_policy_delete(xp, 1, true);

	} else {		} else {
	// reset the timers here?		// reset the timers here?
	WARN(1, "Dont know what to do with soft policy expire\n");		WARN(1, "Dont know what to do with soft policy expire\n");
	@@ -1999,11 +1980,8 @@ static int xfrm_add_sa_expire(struct sk_buff skb, struct nlmsghdr nlh,
	km_state_expired(x, ue->hard, nlh->nlmsg_pid);		km_state_expired(x, ue->hard, nlh->nlmsg_pid);

	if (ue->hard) {		if (ue->hard) {
	kuid_t loginuid = audit_get_loginuid(current);
	unsigned int sessionid = audit_get_sessionid(current);

	__xfrm_state_delete(x);		__xfrm_state_delete(x);
	xfrm_audit_state_delete(x, 1, loginuid, sessionid);		xfrm_audit_state_delete(x, 1, true);
	}		}
	err = 0;		err = 0;
	out:		out: