audit: listen in all network namespaces (33faba7f) · Commits · e / devices / android_kernel_xiaomi_nabu

kernel/audit.c

+55 −12

Original line number	Original line	Diff line number	Diff line
	@@ -63,6 +63,7 @@
	#include <linux/freezer.h>		#include <linux/freezer.h>
	#include <linux/tty.h>		#include <linux/tty.h>
	#include <linux/pid_namespace.h>		#include <linux/pid_namespace.h>
			#include <net/netns/generic.h>

	#include "audit.h"		#include "audit.h"

	@@ -121,6 +122,7 @@ static atomic_t audit_lost = ATOMIC_INIT(0);

	/* The netlink socket. */		/* The netlink socket. */
	static struct sock *audit_sock;		static struct sock *audit_sock;
			int audit_net_id;

	/* Hash for inode-based rules */		/* Hash for inode-based rules */
	struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS];		struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS];
	@@ -176,6 +178,7 @@ struct audit_buffer {

	struct audit_reply {		struct audit_reply {
	__u32 portid;		__u32 portid;
			pid_t pid;
	struct sk_buff *skb;		struct sk_buff *skb;
	};		};

	@@ -401,6 +404,7 @@ static void kauditd_send_skb(struct sk_buff *skb)
	printk(KERN_ERR "audit: NO daemon at audit_pid=%d\n", audit_pid);		printk(KERN_ERR "audit: NO daemon at audit_pid=%d\n", audit_pid);
	audit_log_lost("auditd disappeared\n");		audit_log_lost("auditd disappeared\n");
	audit_pid = 0;		audit_pid = 0;
			audit_sock = NULL;
	/* we might get lucky and get this in the next auditd */		/* we might get lucky and get this in the next auditd */
	audit_hold_skb(skb);		audit_hold_skb(skb);
	} else		} else
	@@ -482,15 +486,16 @@ static int kauditd_thread(void *dummy)
	int audit_send_list(void *_dest)		int audit_send_list(void *_dest)
	{		{
	struct audit_netlink_list *dest = _dest;		struct audit_netlink_list *dest = _dest;
	__u32 portid = dest->portid;
	struct sk_buff *skb;		struct sk_buff *skb;
			struct net *net = get_net_ns_by_pid(dest->pid);
			struct audit_net *aunet = net_generic(net, audit_net_id);

	/* wait for parent to finish and send an ACK */		/* wait for parent to finish and send an ACK */
	mutex_lock(&audit_cmd_mutex);		mutex_lock(&audit_cmd_mutex);
	mutex_unlock(&audit_cmd_mutex);		mutex_unlock(&audit_cmd_mutex);

	while ((skb = __skb_dequeue(&dest->q)) != NULL)		while ((skb = __skb_dequeue(&dest->q)) != NULL)
	netlink_unicast(audit_sock, skb, portid, 0);		netlink_unicast(aunet->nlsk, skb, dest->portid, 0);

	kfree(dest);		kfree(dest);

	@@ -525,13 +530,15 @@ struct sk_buff *audit_make_reply(__u32 portid, int seq, int type, int done,
	static int audit_send_reply_thread(void *arg)		static int audit_send_reply_thread(void *arg)
	{		{
	struct audit_reply reply = (struct audit_reply )arg;		struct audit_reply reply = (struct audit_reply )arg;
			struct net *net = get_net_ns_by_pid(reply->pid);
			struct audit_net *aunet = net_generic(net, audit_net_id);

	mutex_lock(&audit_cmd_mutex);		mutex_lock(&audit_cmd_mutex);
	mutex_unlock(&audit_cmd_mutex);		mutex_unlock(&audit_cmd_mutex);

	/* Ignore failure. It'll only happen if the sender goes away,		/* Ignore failure. It'll only happen if the sender goes away,
	because our timeout is set to infinite. */		because our timeout is set to infinite. */
	netlink_unicast(audit_sock, reply->skb, reply->portid, 0);		netlink_unicast(aunet->nlsk , reply->skb, reply->portid, 0);
	kfree(reply);		kfree(reply);
	return 0;		return 0;
	}		}
	@@ -564,6 +571,7 @@ static void audit_send_reply(__u32 portid, int seq, int type, int done,
	goto out;		goto out;

	reply->portid = portid;		reply->portid = portid;
			reply->pid = task_pid_vnr(current);
	reply->skb = skb;		reply->skb = skb;

	tsk = kthread_run(audit_send_reply_thread, reply, "audit_send_reply");		tsk = kthread_run(audit_send_reply_thread, reply, "audit_send_reply");
	@@ -791,6 +799,7 @@ static int audit_receive_msg(struct sk_buff skb, struct nlmsghdr nlh)
	audit_log_config_change("audit_pid", new_pid, audit_pid, 1);		audit_log_config_change("audit_pid", new_pid, audit_pid, 1);
	audit_pid = new_pid;		audit_pid = new_pid;
	audit_nlk_portid = NETLINK_CB(skb).portid;		audit_nlk_portid = NETLINK_CB(skb).portid;
			audit_sock = NETLINK_CB(skb).sk;
	}		}
	if (status_get->mask & AUDIT_STATUS_RATE_LIMIT) {		if (status_get->mask & AUDIT_STATUS_RATE_LIMIT) {
	err = audit_set_rate_limit(status_get->rate_limit);		err = audit_set_rate_limit(status_get->rate_limit);
	@@ -998,24 +1007,58 @@ static void audit_receive(struct sk_buff *skb)
	mutex_unlock(&audit_cmd_mutex);		mutex_unlock(&audit_cmd_mutex);
	}		}

	/* Initialize audit support at boot time. */		static int __net_init audit_net_init(struct net *net)
	static int __init audit_init(void)
	{		{
	int i;
	struct netlink_kernel_cfg cfg = {		struct netlink_kernel_cfg cfg = {
	.input = audit_receive,		.input = audit_receive,
	};		};

			struct audit_net *aunet = net_generic(net, audit_net_id);

			pr_info("audit: initializing netlink socket in namespace\n");

			aunet->nlsk = netlink_kernel_create(net, NETLINK_AUDIT, &cfg);
			if (aunet->nlsk == NULL)
			return -ENOMEM;
			if (!aunet->nlsk)
			audit_panic("cannot initialize netlink socket in namespace");
			else
			aunet->nlsk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
			return 0;
			}

			static void __net_exit audit_net_exit(struct net *net)
			{
			struct audit_net *aunet = net_generic(net, audit_net_id);
			struct sock *sock = aunet->nlsk;
			if (sock == audit_sock) {
			audit_pid = 0;
			audit_sock = NULL;
			}

			rcu_assign_pointer(aunet->nlsk, NULL);
			synchronize_net();
			netlink_kernel_release(sock);
			}

			static struct pernet_operations __net_initdata audit_net_ops = {
			.init = audit_net_init,
			.exit = audit_net_exit,
			.id = &audit_net_id,
			.size = sizeof(struct audit_net),
			};

			/* Initialize audit support at boot time. */
			static int __init audit_init(void)
			{
			int i;

	if (audit_initialized == AUDIT_DISABLED)		if (audit_initialized == AUDIT_DISABLED)
	return 0;		return 0;

	printk(KERN_INFO "audit: initializing netlink socket (%s)\n",		pr_info("audit: initializing netlink subsys (%s)\n",
	audit_default ? "enabled" : "disabled");		audit_default ? "enabled" : "disabled");
	audit_sock = netlink_kernel_create(&init_net, NETLINK_AUDIT, &cfg);		register_pernet_subsys(&audit_net_ops);
	if (!audit_sock)
	audit_panic("cannot initialize netlink socket");
	else
	audit_sock->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;

	skb_queue_head_init(&audit_skb_queue);		skb_queue_head_init(&audit_skb_queue);
	skb_queue_head_init(&audit_skb_hold_queue);		skb_queue_head_init(&audit_skb_hold_queue);

kernel/audit.h

+5 −0

Original line number	Original line	Diff line number	Diff line
	@@ -247,11 +247,16 @@ extern void audit_panic(const char *message);

	struct audit_netlink_list {		struct audit_netlink_list {
	__u32 portid;		__u32 portid;
			pid_t pid;
	struct sk_buff_head q;		struct sk_buff_head q;
	};		};

	int audit_send_list(void *);		int audit_send_list(void *);

			struct audit_net {
			struct sock *nlsk;
			};

	extern int selinux_audit_rule_update(void);		extern int selinux_audit_rule_update(void);

	extern struct mutex audit_filter_mutex;		extern struct mutex audit_filter_mutex;

kernel/auditfilter.c

+1 −0

Original line number	Original line	Diff line number	Diff line
	@@ -1050,6 +1050,7 @@ int audit_receive_filter(int type, __u32 portid, int seq, void *data,
	if (!dest)		if (!dest)
	return -ENOMEM;		return -ENOMEM;
	dest->portid = portid;		dest->portid = portid;
			dest->pid = task_pid_vnr(current);
	skb_queue_head_init(&dest->q);		skb_queue_head_init(&dest->q);

	mutex_lock(&audit_filter_mutex);		mutex_lock(&audit_filter_mutex);