audit: ignore fcaps on umount

Don't fetch fcaps when umount2 is called to avoid a process hang while
it waits for the missing resource to (possibly never) re-appear.

Note the comment above user_path_mountpoint_at():
 * A umount is a special case for path walking. We're not actually interested
 * in the inode in this situation, and ESTALE errors can be a problem.  We
 * simply want track down the dentry and vfsmount attached at the mountpoint
 * and avoid revalidating the last component.

This can happen on ceph, cifs, 9p, lustre, fuse (gluster) or NFS.

Please see the github issue tracker
https://github.com/linux-audit/audit-kernel/issues/100

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
[PM: merge fuzz in audit_log_fcaps()]
Signed-off-by: Paul Moore <paul@paul-moore.com>

1 files changed, 9 insertions, 1 deletions

diff --git a/kernel/audit.c b/kernel/audit.c
index 3f3f1888cac7..b7177a8def2e 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -2082,6 +2082,10 @@ void audit_log_cap(struct audit_buffer *ab, char *prefix, kernel_cap_t *cap)
 
 static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name)
 {
+        if (name->fcap_ver == -1) {
+                audit_log_format(ab, " cap_fe=? cap_fver=? cap_fp=? cap_fi=?");
+                return;
+        }
         audit_log_cap(ab, "cap_fp", &name->fcap.permitted);
         audit_log_cap(ab, "cap_fi", &name->fcap.inheritable);
         audit_log_format(ab, " cap_fe=%d cap_fver=%x cap_frootid=%d",
@@ -2114,7 +2118,7 @@ static inline int audit_copy_fcaps(struct audit_names *name,
 
 /* Copy inode data into an audit_names. */
 void audit_copy_inode(struct audit_names *name, const struct dentry *dentry,
-                      struct inode *inode)
+                      struct inode *inode, unsigned int flags)
 {
         name->ino   = inode->i_ino;
         name->dev   = inode->i_sb->s_dev;
@@ -2123,6 +2127,10 @@ void audit_copy_inode(struct audit_names *name, const struct dentry *dentry,
         name->gid   = inode->i_gid;
         name->rdev  = inode->i_rdev;
         security_inode_getsecid(inode, &name->osid);
+        if (flags & AUDIT_INODE_NOEVAL) {
+                name->fcap_ver = -1;
+                return;
+        }
         audit_copy_fcaps(name, dentry);
 }