Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 78e2e802 authored by Jeff Layton's avatar Jeff Layton Committed by Al Viro
Browse files

audit: add a new "type" field to audit_names struct 



For now, we just have two possibilities:

UNKNOWN: for a new audit_names record that we don't know anything about yet
NORMAL: for everything else

In later patches, we'll add other types so we can distinguish and update
records created under different circumstances.

Signed-off-by: default avatarJeff Layton <jlayton@redhat.com>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent c43a25ab

include/linux/audit.h

+5 −0
Original line number Original line Diff line number Diff line
@@ -452,6 +452,11 @@ struct audit_field { 
extern int __init audit_register_class(int class, unsigned *list);

extern int __init audit_register_class(int class, unsigned *list);

extern int audit_classify_syscall(int abi, unsigned syscall);

extern int audit_classify_syscall(int abi, unsigned syscall);

extern int audit_classify_arch(int arch);

extern int audit_classify_arch(int arch);



/* audit_names->type values */

#define	AUDIT_TYPE_UNKNOWN	0	/* we don't know yet */

#define	AUDIT_TYPE_NORMAL	1	/* a "normal" audit record */



#ifdef CONFIG_AUDITSYSCALL

#ifdef CONFIG_AUDITSYSCALL

/* These are defined in auditsc.c */

/* These are defined in auditsc.c */

				/* Public API */

				/* Public API */

kernel/auditsc.c

+10 −5
Original line number Original line Diff line number Diff line
@@ -120,6 +120,7 @@ struct audit_names { 
	struct audit_cap_data fcap;

	struct audit_cap_data fcap;

	unsigned int	fcap_ver;

	unsigned int	fcap_ver;

	int		name_len;	/* number of name's characters to log */

	int		name_len;	/* number of name's characters to log */

	unsigned char	type;		/* record type */

	bool		name_put;	/* call __putname() for this name */

	bool		name_put;	/* call __putname() for this name */

	/*

	/*

	 * This was an allocated audit_names and not from the array of

	 * This was an allocated audit_names and not from the array of
@@ -1995,7 +1996,8 @@ static void handle_path(const struct dentry *dentry) 
#endif

#endif

}

}





static struct audit_names *audit_alloc_name(struct audit_context *context)

static struct audit_names *audit_alloc_name(struct audit_context *context,

						unsigned char type)

{

{

	struct audit_names *aname;

	struct audit_names *aname;
@@ -2010,6 +2012,7 @@ static struct audit_names *audit_alloc_name(struct audit_context *context) 
	}

	}





	aname->ino = (unsigned long)-1;

	aname->ino = (unsigned long)-1;

	aname->type = type;

	list_add_tail(&aname->list, &context->names_list);

	list_add_tail(&aname->list, &context->names_list);





	context->name_count++;

	context->name_count++;
@@ -2040,7 +2043,7 @@ void __audit_getname(const char *name) 
		return;

		return;

	}

	}





	n = audit_alloc_name(context);

	n = audit_alloc_name(context, AUDIT_TYPE_UNKNOWN);

	if (!n)

	if (!n)

		return;

		return;
@@ -2157,12 +2160,13 @@ void __audit_inode(const char *name, const struct dentry *dentry) 




out_alloc:

out_alloc:

	/* unable to find the name from a previous getname() */

	/* unable to find the name from a previous getname() */

	n = audit_alloc_name(context);

	n = audit_alloc_name(context, AUDIT_TYPE_NORMAL);

	if (!n)

	if (!n)

		return;

		return;

out:

out:

	handle_path(dentry);

	handle_path(dentry);

	audit_copy_inode(n, dentry, inode);

	audit_copy_inode(n, dentry, inode);

	n->type = AUDIT_TYPE_NORMAL;

}

}





/**

/**
@@ -2219,6 +2223,7 @@ void __audit_inode_child(const struct inode *parent, 
				audit_copy_inode(n, dentry, inode);

				audit_copy_inode(n, dentry, inode);

			else

			else

				n->ino = (unsigned long)-1;

				n->ino = (unsigned long)-1;

			n->type = AUDIT_TYPE_NORMAL;

			found_child = n->name;

			found_child = n->name;

			goto add_names;

			goto add_names;

		}

		}
@@ -2226,14 +2231,14 @@ void __audit_inode_child(const struct inode *parent, 




add_names:

add_names:

	if (!found_parent) {

	if (!found_parent) {

		n = audit_alloc_name(context);

		n = audit_alloc_name(context, AUDIT_TYPE_NORMAL);

		if (!n)

		if (!n)

			return;

			return;

		audit_copy_inode(n, NULL, parent);

		audit_copy_inode(n, NULL, parent);

	}

	}





	if (!found_child) {

	if (!found_child) {

		n = audit_alloc_name(context);

		n = audit_alloc_name(context, AUDIT_TYPE_NORMAL);

		if (!n)

		if (!n)

			return;

			return;