Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5a3cb3b6 authored by Richard Guy Briggs's avatar Richard Guy Briggs Committed by Eric Paris
Browse files

audit: allow user processes to log from another PID namespace 



Still only permit the audit logging daemon and control to operate from the
initial PID namespace, but allow processes to log from another PID namespace.

Cc: "Eric W. Biederman" <ebiederm@xmission.com>
(informed by ebiederman's c776b5d2)

Signed-off-by: default avatarRichard Guy Briggs <rgb@redhat.com>
parent f1dc4867

kernel/audit.c

+7 −3
Original line number Diff line number Diff line
@@ -607,9 +607,8 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type) 
{

	int err = 0;



	/* Only support the initial namespaces for now. */

	if ((current_user_ns() != &init_user_ns) ||

	    (task_active_pid_ns(current) != &init_pid_ns))

	/* Only support initial user namespace for now. */

	if ((current_user_ns() != &init_user_ns))

		return -EPERM;



	switch (msg_type) {
@@ -629,6 +628,11 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type) 
	case AUDIT_TTY_SET:

	case AUDIT_TRIM:

	case AUDIT_MAKE_EQUIV:

		/* Only support auditd and auditctl in initial pid namespace

		 * for now. */

		if ((task_active_pid_ns(current) != &init_pid_ns))

			return -EPERM;



		if (!capable(CAP_AUDIT_CONTROL))

			err = -EPERM;

		break;