diff options
author | Eric W. Biederman <ebiederm@xmission.com> | 2012-09-11 01:39:43 -0400 |
---|---|---|
committer | Eric W. Biederman <ebiederm@xmission.com> | 2012-09-17 21:08:54 -0400 |
commit | e1760bd5ffae8cb98cffb030ee8e631eba28f3d8 (patch) | |
tree | 4694a60b407c418bf7de4b97355dc3bd0e6c6559 /net/xfrm | |
parent | ca57ec0f00c3f139c41bf6b0a5b9bcc95bbb2ad7 (diff) |
userns: Convert the audit loginuid to be a kuid
Always store audit loginuids in type kuid_t.
Print loginuids by converting them into uids in the appropriate user
namespace, and then printing the resulting uid.
Modify audit_get_loginuid to return a kuid_t.
Modify audit_set_loginuid to take a kuid_t.
Modify /proc/<pid>/loginuid on read to convert the loginuid into the
user namespace of the opener of the file.
Modify /proc/<pid>/loginud on write to convert the loginuid
rom the user namespace of the opener of the file.
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Eric Paris <eparis@redhat.com>
Cc: Paul Moore <paul@paul-moore.com> ?
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Diffstat (limited to 'net/xfrm')
-rw-r--r-- | net/xfrm/xfrm_policy.c | 8 | ||||
-rw-r--r-- | net/xfrm/xfrm_state.c | 6 | ||||
-rw-r--r-- | net/xfrm/xfrm_user.c | 12 |
3 files changed, 13 insertions, 13 deletions
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index c5a5165a592..2f475151cea 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c | |||
@@ -2630,12 +2630,12 @@ static void xfrm_policy_fini(struct net *net) | |||
2630 | 2630 | ||
2631 | flush_work(&net->xfrm.policy_hash_work); | 2631 | flush_work(&net->xfrm.policy_hash_work); |
2632 | #ifdef CONFIG_XFRM_SUB_POLICY | 2632 | #ifdef CONFIG_XFRM_SUB_POLICY |
2633 | audit_info.loginuid = -1; | 2633 | audit_info.loginuid = INVALID_UID; |
2634 | audit_info.sessionid = -1; | 2634 | audit_info.sessionid = -1; |
2635 | audit_info.secid = 0; | 2635 | audit_info.secid = 0; |
2636 | xfrm_policy_flush(net, XFRM_POLICY_TYPE_SUB, &audit_info); | 2636 | xfrm_policy_flush(net, XFRM_POLICY_TYPE_SUB, &audit_info); |
2637 | #endif | 2637 | #endif |
2638 | audit_info.loginuid = -1; | 2638 | audit_info.loginuid = INVALID_UID; |
2639 | audit_info.sessionid = -1; | 2639 | audit_info.sessionid = -1; |
2640 | audit_info.secid = 0; | 2640 | audit_info.secid = 0; |
2641 | xfrm_policy_flush(net, XFRM_POLICY_TYPE_MAIN, &audit_info); | 2641 | xfrm_policy_flush(net, XFRM_POLICY_TYPE_MAIN, &audit_info); |
@@ -2742,7 +2742,7 @@ static void xfrm_audit_common_policyinfo(struct xfrm_policy *xp, | |||
2742 | } | 2742 | } |
2743 | 2743 | ||
2744 | void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, | 2744 | void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, |
2745 | uid_t auid, u32 sessionid, u32 secid) | 2745 | kuid_t auid, u32 sessionid, u32 secid) |
2746 | { | 2746 | { |
2747 | struct audit_buffer *audit_buf; | 2747 | struct audit_buffer *audit_buf; |
2748 | 2748 | ||
@@ -2757,7 +2757,7 @@ void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, | |||
2757 | EXPORT_SYMBOL_GPL(xfrm_audit_policy_add); | 2757 | EXPORT_SYMBOL_GPL(xfrm_audit_policy_add); |
2758 | 2758 | ||
2759 | void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, | 2759 | void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, |
2760 | uid_t auid, u32 sessionid, u32 secid) | 2760 | kuid_t auid, u32 sessionid, u32 secid) |
2761 | { | 2761 | { |
2762 | struct audit_buffer *audit_buf; | 2762 | struct audit_buffer *audit_buf; |
2763 | 2763 | ||
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index 5b228f97d4b..fce6a49bc7c 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c | |||
@@ -2045,7 +2045,7 @@ void xfrm_state_fini(struct net *net) | |||
2045 | unsigned int sz; | 2045 | unsigned int sz; |
2046 | 2046 | ||
2047 | flush_work(&net->xfrm.state_hash_work); | 2047 | flush_work(&net->xfrm.state_hash_work); |
2048 | audit_info.loginuid = -1; | 2048 | audit_info.loginuid = INVALID_UID; |
2049 | audit_info.sessionid = -1; | 2049 | audit_info.sessionid = -1; |
2050 | audit_info.secid = 0; | 2050 | audit_info.secid = 0; |
2051 | xfrm_state_flush(net, IPSEC_PROTO_ANY, &audit_info); | 2051 | xfrm_state_flush(net, IPSEC_PROTO_ANY, &audit_info); |
@@ -2112,7 +2112,7 @@ static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family, | |||
2112 | } | 2112 | } |
2113 | 2113 | ||
2114 | void xfrm_audit_state_add(struct xfrm_state *x, int result, | 2114 | void xfrm_audit_state_add(struct xfrm_state *x, int result, |
2115 | uid_t auid, u32 sessionid, u32 secid) | 2115 | kuid_t auid, u32 sessionid, u32 secid) |
2116 | { | 2116 | { |
2117 | struct audit_buffer *audit_buf; | 2117 | struct audit_buffer *audit_buf; |
2118 | 2118 | ||
@@ -2127,7 +2127,7 @@ void xfrm_audit_state_add(struct xfrm_state *x, int result, | |||
2127 | EXPORT_SYMBOL_GPL(xfrm_audit_state_add); | 2127 | EXPORT_SYMBOL_GPL(xfrm_audit_state_add); |
2128 | 2128 | ||
2129 | void xfrm_audit_state_delete(struct xfrm_state *x, int result, | 2129 | void xfrm_audit_state_delete(struct xfrm_state *x, int result, |
2130 | uid_t auid, u32 sessionid, u32 secid) | 2130 | kuid_t auid, u32 sessionid, u32 secid) |
2131 | { | 2131 | { |
2132 | struct audit_buffer *audit_buf; | 2132 | struct audit_buffer *audit_buf; |
2133 | 2133 | ||
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index e75d8e47f35..9ea55db737b 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c | |||
@@ -575,7 +575,7 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh, | |||
575 | struct xfrm_state *x; | 575 | struct xfrm_state *x; |
576 | int err; | 576 | int err; |
577 | struct km_event c; | 577 | struct km_event c; |
578 | uid_t loginuid = audit_get_loginuid(current); | 578 | kuid_t loginuid = audit_get_loginuid(current); |
579 | u32 sessionid = audit_get_sessionid(current); | 579 | u32 sessionid = audit_get_sessionid(current); |
580 | u32 sid; | 580 | u32 sid; |
581 | 581 | ||
@@ -654,7 +654,7 @@ static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh, | |||
654 | int err = -ESRCH; | 654 | int err = -ESRCH; |
655 | struct km_event c; | 655 | struct km_event c; |
656 | struct xfrm_usersa_id *p = nlmsg_data(nlh); | 656 | struct xfrm_usersa_id *p = nlmsg_data(nlh); |
657 | uid_t loginuid = audit_get_loginuid(current); | 657 | kuid_t loginuid = audit_get_loginuid(current); |
658 | u32 sessionid = audit_get_sessionid(current); | 658 | u32 sessionid = audit_get_sessionid(current); |
659 | u32 sid; | 659 | u32 sid; |
660 | 660 | ||
@@ -1369,7 +1369,7 @@ static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh, | |||
1369 | struct km_event c; | 1369 | struct km_event c; |
1370 | int err; | 1370 | int err; |
1371 | int excl; | 1371 | int excl; |
1372 | uid_t loginuid = audit_get_loginuid(current); | 1372 | kuid_t loginuid = audit_get_loginuid(current); |
1373 | u32 sessionid = audit_get_sessionid(current); | 1373 | u32 sessionid = audit_get_sessionid(current); |
1374 | u32 sid; | 1374 | u32 sid; |
1375 | 1375 | ||
@@ -1624,7 +1624,7 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, | |||
1624 | NETLINK_CB(skb).pid); | 1624 | NETLINK_CB(skb).pid); |
1625 | } | 1625 | } |
1626 | } else { | 1626 | } else { |
1627 | uid_t loginuid = audit_get_loginuid(current); | 1627 | kuid_t loginuid = audit_get_loginuid(current); |
1628 | u32 sessionid = audit_get_sessionid(current); | 1628 | u32 sessionid = audit_get_sessionid(current); |
1629 | u32 sid; | 1629 | u32 sid; |
1630 | 1630 | ||
@@ -1918,7 +1918,7 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh, | |||
1918 | 1918 | ||
1919 | err = 0; | 1919 | err = 0; |
1920 | if (up->hard) { | 1920 | if (up->hard) { |
1921 | uid_t loginuid = audit_get_loginuid(current); | 1921 | kuid_t loginuid = audit_get_loginuid(current); |
1922 | u32 sessionid = audit_get_sessionid(current); | 1922 | u32 sessionid = audit_get_sessionid(current); |
1923 | u32 sid; | 1923 | u32 sid; |
1924 | 1924 | ||
@@ -1961,7 +1961,7 @@ static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh, | |||
1961 | km_state_expired(x, ue->hard, current->pid); | 1961 | km_state_expired(x, ue->hard, current->pid); |
1962 | 1962 | ||
1963 | if (ue->hard) { | 1963 | if (ue->hard) { |
1964 | uid_t loginuid = audit_get_loginuid(current); | 1964 | kuid_t loginuid = audit_get_loginuid(current); |
1965 | u32 sessionid = audit_get_sessionid(current); | 1965 | u32 sessionid = audit_get_sessionid(current); |
1966 | u32 sid; | 1966 | u32 sid; |
1967 | 1967 | ||