Merge branch 'stable-4.11' of git://git.infradead.org/users/pcmoore/audit

Pull audit updates from Paul Moore:
 "The audit changes for v4.11 are relatively small compared to what we
  did for v4.10, both in terms of size and impact.

   - two patches from Steve tweak the formatting for some of the audit
     records to make them more consistent with other audit records.

   - three patches from Richard record the name of a module on module
     load, fix the logging of sockaddr information when using
     socketcall() on 32-bit systems, and add the ability to reset
     audit's lost record counter.

   - my lone patch just fixes an annoying style nit that I was reminded
     about by one of Richard's patches.

  All these patches pass our test suite"

* 'stable-4.11' of git://git.infradead.org/users/pcmoore/audit:
  audit: remove unnecessary curly braces from switch/case statements
  audit: log module name on init_module
  audit: log 32-bit socketcalls
  audit: add feature audit_lost reset
  audit: Make AUDIT_ANOM_ABEND event normalized
  audit: Make AUDIT_KERNEL event conform to the specification

4 files changed, 44 insertions, 16 deletions

diff --git a/kernel/audit.c b/kernel/audit.c
index 6e399bb69d7c..e794544f5e63 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -121,7 +121,7 @@ u32		audit_sig_sid = 0;
    3) suppressed due to audit_rate_limit
    4) suppressed due to audit_backlog_limit
 */
-static atomic_t    audit_lost = ATOMIC_INIT(0);
+static atomic_t audit_lost = ATOMIC_INIT(0);
 
 /* The netlink socket. */
 static struct sock *audit_sock;
@@ -1058,6 +1058,12 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                         if (err < 0)
                                 return err;
                 }
+                if (s.mask == AUDIT_STATUS_LOST) {
+                        u32 lost = atomic_xchg(&audit_lost, 0);
+
+                        audit_log_config_change("lost", 0, lost, 1);
+                        return lost;
+                }
                 break;
         }
         case AUDIT_GET_FEATURE:
@@ -1349,7 +1355,9 @@ static int __init audit_init(void)
                 panic("audit: failed to start the kauditd thread (%d)\n", err);
         }
 
-        audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized");
+        audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL,
+                "state=initialized audit_enabled=%u res=1",
+                 audit_enabled);
 
         return 0;
 }
diff --git a/kernel/audit.h b/kernel/audit.h
index 960d49c9db5e..ca579880303a 100644
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -199,6 +199,9 @@ struct audit_context {
                 struct {
                         int                     argc;
                 } execve;
+                struct {
+                        char                    *name;
+                } module;
         };
         int fds[2];
         struct audit_proctitle proctitle;
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index cf1fa43512c1..d6a8de5f8fa3 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1221,7 +1221,7 @@ static void show_special(struct audit_context *context, int *call_panic)
                                 context->ipc.perm_mode);
                 }
                 break; }
-        case AUDIT_MQ_OPEN: {
+        case AUDIT_MQ_OPEN:
                 audit_log_format(ab,
                         "oflag=0x%x mode=%#ho mq_flags=0x%lx mq_maxmsg=%ld "
                         "mq_msgsize=%ld mq_curmsgs=%ld",
@@ -1230,8 +1230,8 @@ static void show_special(struct audit_context *context, int *call_panic)
                         context->mq_open.attr.mq_maxmsg,
                         context->mq_open.attr.mq_msgsize,
                         context->mq_open.attr.mq_curmsgs);
-                break; }
-        case AUDIT_MQ_SENDRECV: {
+                break;
+        case AUDIT_MQ_SENDRECV:
                 audit_log_format(ab,
                         "mqdes=%d msg_len=%zd msg_prio=%u "
                         "abs_timeout_sec=%ld abs_timeout_nsec=%ld",
@@ -1240,12 +1240,12 @@ static void show_special(struct audit_context *context, int *call_panic)
                         context->mq_sendrecv.msg_prio,
                         context->mq_sendrecv.abs_timeout.tv_sec,
                         context->mq_sendrecv.abs_timeout.tv_nsec);
-                break; }
-        case AUDIT_MQ_NOTIFY: {
+                break;
+        case AUDIT_MQ_NOTIFY:
                 audit_log_format(ab, "mqdes=%d sigev_signo=%d",
                                 context->mq_notify.mqdes,
                                 context->mq_notify.sigev_signo);
-                break; }
+                break;
         case AUDIT_MQ_GETSETATTR: {
                 struct mq_attr *attr = &context->mq_getsetattr.mqstat;
                 audit_log_format(ab,
@@ -1255,19 +1255,24 @@ static void show_special(struct audit_context *context, int *call_panic)
                         attr->mq_flags, attr->mq_maxmsg,
                         attr->mq_msgsize, attr->mq_curmsgs);
                 break; }
-        case AUDIT_CAPSET: {
+        case AUDIT_CAPSET:
                 audit_log_format(ab, "pid=%d", context->capset.pid);
                 audit_log_cap(ab, "cap_pi", &context->capset.cap.inheritable);
                 audit_log_cap(ab, "cap_pp", &context->capset.cap.permitted);
                 audit_log_cap(ab, "cap_pe", &context->capset.cap.effective);
-                break; }
-        case AUDIT_MMAP: {
+                break;
+        case AUDIT_MMAP:
                 audit_log_format(ab, "fd=%d flags=0x%x", context->mmap.fd,
                                  context->mmap.flags);
-                break; }
-        case AUDIT_EXECVE: {
+                break;
+        case AUDIT_EXECVE:
                 audit_log_execve_info(context, &ab);
-                break; }
+                break;
+        case AUDIT_KERN_MODULE:
+                audit_log_format(ab, "name=");
+                audit_log_untrustedstring(ab, context->module.name);
+                kfree(context->module.name);
+                break;
         }
         audit_log_end(ab);
 }
@@ -2368,6 +2373,15 @@ void __audit_mmap_fd(int fd, int flags)
         context->type = AUDIT_MMAP;
 }
 
+void __audit_log_kern_module(char *name)
+{
+        struct audit_context *context = current->audit_context;
+
+        context->module.name = kmalloc(strlen(name) + 1, GFP_KERNEL);
+        strcpy(context->module.name, name);
+        context->type = AUDIT_KERN_MODULE;
+}
+
 static void audit_log_task(struct audit_buffer *ab)
 {
         kuid_t auid, uid;
@@ -2411,7 +2425,7 @@ void audit_core_dumps(long signr)
         if (unlikely(!ab))
                 return;
         audit_log_task(ab);
-        audit_log_format(ab, " sig=%ld", signr);
+        audit_log_format(ab, " sig=%ld res=1", signr);
         audit_log_end(ab);
 }
 
diff --git a/kernel/module.c b/kernel/module.c
index 3d8f126208e3..e2eec4b47143 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -61,6 +61,7 @@
 #include <linux/pfn.h>
 #include <linux/bsearch.h>
 #include <linux/dynamic_debug.h>
+#include <linux/audit.h>
 #include <uapi/linux/module.h>
 #include "module-internal.h"
 
@@ -3608,6 +3609,8 @@ static int load_module(struct load_info *info, const char __user *uargs,
                 goto free_copy;
         }
 
+        audit_log_kern_module(mod->name);
+
         /* Reserve our place in the list. */
         err = add_unformed_module(mod);
         if (err)
@@ -3696,7 +3699,7 @@ static int load_module(struct load_info *info, const char __user *uargs,
                        mod->name, after_dashes);
         }
 
-        /* Link in to syfs. */
+        /* Link in to sysfs. */
         err = mod_sysfs_setup(mod, info, mod->kp, mod->num_kp);
         if (err < 0)
                 goto coming_cleanup;