1 files changed, 115 insertions, 133 deletions

diff --git a/kernel/audit.c b/kernel/audit.c
index d596e5355f1..0a1355ca3d7 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -45,7 +45,7 @@
 #include <asm/types.h>
 #include <linux/atomic.h>
 #include <linux/mm.h>
-#include <linux/export.h>
+#include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/err.h>
 #include <linux/kthread.h>
@@ -61,7 +61,6 @@
 #include <linux/netlink.h>
 #include <linux/freezer.h>
 #include <linux/tty.h>
-#include <linux/pid_namespace.h>
 
 #include "audit.h"
 
@@ -88,11 +87,11 @@ static int	audit_failure = AUDIT_FAIL_PRINTK;
 
 /*
  * If audit records are to be written to the netlink socket, audit_pid
- * contains the pid of the auditd process and audit_nlk_portid contains
- * the portid to use to send netlink messages to that process.
+ * contains the pid of the auditd process and audit_nlk_pid contains
+ * the pid to use to send netlink messages to that process.
  */
 int             audit_pid;
-static int      audit_nlk_portid;
+static int      audit_nlk_pid;
 
 /* If audit_rate_limit is non-zero, limit the rate of sending audit records
  * to that number per second.  This prevents DoS attacks, but results in
@@ -105,7 +104,7 @@ static int	audit_backlog_wait_time = 60 * HZ;
 static int      audit_backlog_wait_overflow = 0;
 
 /* The identity of the user shutting down the audit system. */
-kuid_t          audit_sig_uid = INVALID_UID;
+uid_t           audit_sig_uid = -1;
 pid_t           audit_sig_pid = -1;
 u32             audit_sig_sid = 0;
 
@@ -265,17 +264,15 @@ void audit_log_lost(const char *message)
 }
 
 static int audit_log_config_change(char *function_name, int new, int old,
-                                   kuid_t loginuid, u32 sessionid, u32 sid,
+                                   uid_t loginuid, u32 sessionid, u32 sid,
                                    int allow_changes)
 {
         struct audit_buffer *ab;
         int rc = 0;
 
         ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
-        if (unlikely(!ab))
-                return rc;
         audit_log_format(ab, "%s=%d old=%d auid=%u ses=%u", function_name, new,
-                         old, from_kuid(&init_user_ns, loginuid), sessionid);
+                         old, loginuid, sessionid);
         if (sid) {
                 char *ctx = NULL;
                 u32 len;
@@ -295,7 +292,7 @@ static int audit_log_config_change(char *function_name, int new, int old,
 }
 
 static int audit_do_config_change(char *function_name, int *to_change,
-                                  int new, kuid_t loginuid, u32 sessionid,
+                                  int new, uid_t loginuid, u32 sessionid,
                                   u32 sid)
 {
         int allow_changes, rc = 0, old = *to_change;
@@ -322,21 +319,21 @@ static int audit_do_config_change(char *function_name, int *to_change,
         return rc;
 }
 
-static int audit_set_rate_limit(int limit, kuid_t loginuid, u32 sessionid,
+static int audit_set_rate_limit(int limit, uid_t loginuid, u32 sessionid,
                                 u32 sid)
 {
         return audit_do_config_change("audit_rate_limit", &audit_rate_limit,
                                       limit, loginuid, sessionid, sid);
 }
 
-static int audit_set_backlog_limit(int limit, kuid_t loginuid, u32 sessionid,
+static int audit_set_backlog_limit(int limit, uid_t loginuid, u32 sessionid,
                                    u32 sid)
 {
         return audit_do_config_change("audit_backlog_limit", &audit_backlog_limit,
                                       limit, loginuid, sessionid, sid);
 }
 
-static int audit_set_enabled(int state, kuid_t loginuid, u32 sessionid, u32 sid)
+static int audit_set_enabled(int state, uid_t loginuid, u32 sessionid, u32 sid)
 {
         int rc;
         if (state < AUDIT_OFF || state > AUDIT_LOCKED)
@@ -351,7 +348,7 @@ static int audit_set_enabled(int state, kuid_t loginuid, u32 sessionid, u32 sid)
         return rc;
 }
 
-static int audit_set_failure(int state, kuid_t loginuid, u32 sessionid, u32 sid)
+static int audit_set_failure(int state, uid_t loginuid, u32 sessionid, u32 sid)
 {
         if (state != AUDIT_FAIL_SILENT
             && state != AUDIT_FAIL_PRINTK
@@ -387,7 +384,7 @@ static void audit_hold_skb(struct sk_buff *skb)
 static void audit_printk_skb(struct sk_buff *skb)
 {
         struct nlmsghdr *nlh = nlmsg_hdr(skb);
-        char *data = nlmsg_data(nlh);
+        char *data = NLMSG_DATA(nlh);
 
         if (nlh->nlmsg_type != AUDIT_EOE) {
                 if (printk_ratelimit())
@@ -404,7 +401,7 @@ static void kauditd_send_skb(struct sk_buff *skb)
         int err;
         /* take a reference in case we can't send it and we want to hold it */
         skb_get(skb);
-        err = netlink_unicast(audit_sock, skb, audit_nlk_portid, 0);
+        err = netlink_unicast(audit_sock, skb, audit_nlk_pid, 0);
         if (err < 0) {
                 BUG_ON(err != -ECONNREFUSED); /* Shouldn't happen */
                 printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n", audit_pid);
@@ -470,6 +467,24 @@ static int kauditd_thread(void *dummy)
         return 0;
 }
 
+static int audit_prepare_user_tty(pid_t pid, uid_t loginuid, u32 sessionid)
+{
+        struct task_struct *tsk;
+        int err;
+
+        rcu_read_lock();
+        tsk = find_task_by_vpid(pid);
+        if (!tsk) {
+                rcu_read_unlock();
+                return -ESRCH;
+        }
+        get_task_struct(tsk);
+        rcu_read_unlock();
+        err = tty_audit_push_task(tsk, loginuid, sessionid);
+        put_task_struct(tsk);
+        return err;
+}
+
 int audit_send_list(void *_dest)
 {
         struct audit_netlink_list *dest = _dest;
@@ -501,15 +516,14 @@ struct sk_buff *audit_make_reply(int pid, int seq, int type, int done,
         if (!skb)
                 return NULL;
 
-        nlh     = nlmsg_put(skb, pid, seq, t, size, flags);
-        if (!nlh)
-                goto out_kfree_skb;
-        data = nlmsg_data(nlh);
+        nlh     = NLMSG_NEW(skb, pid, seq, t, size, flags);
+        data    = NLMSG_DATA(nlh);
         memcpy(data, payload, size);
         return skb;
 
-out_kfree_skb:
-        kfree_skb(skb);
+nlmsg_failure:                  /* Used by NLMSG_NEW */
+        if (skb)
+                kfree_skb(skb);
         return NULL;
 }
 
@@ -573,11 +587,6 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
 {
         int err = 0;
 
-        /* Only support the initial namespaces for now. */
-        if ((current_user_ns() != &init_user_ns) ||
-            (task_active_pid_ns(current) != &init_pid_ns))
-                return -EPERM;
-
         switch (msg_type) {
         case AUDIT_GET:
         case AUDIT_LIST:
@@ -592,13 +601,13 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
         case AUDIT_TTY_SET:
         case AUDIT_TRIM:
         case AUDIT_MAKE_EQUIV:
-                if (!capable(CAP_AUDIT_CONTROL))
+                if (security_netlink_recv(skb, CAP_AUDIT_CONTROL))
                         err = -EPERM;
                 break;
         case AUDIT_USER:
         case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
         case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
-                if (!capable(CAP_AUDIT_WRITE))
+                if (security_netlink_recv(skb, CAP_AUDIT_WRITE))
                         err = -EPERM;
                 break;
         default:  /* bad msg */
@@ -609,7 +618,8 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
 }
 
 static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type,
-                                     kuid_t auid, u32 ses, u32 sid)
+                                     u32 pid, u32 uid, uid_t auid, u32 ses,
+                                     u32 sid)
 {
         int rc = 0;
         char *ctx = NULL;
@@ -621,12 +631,8 @@ static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type,
         }
 
         *ab = audit_log_start(NULL, GFP_KERNEL, msg_type);
-        if (unlikely(!*ab))
-                return rc;
-        audit_log_format(*ab, "pid=%d uid=%u auid=%u ses=%u",
-                         task_tgid_vnr(current),
-                         from_kuid(&init_user_ns, current_uid()),
-                         from_kuid(&init_user_ns, auid), ses);
+        audit_log_format(*ab, "user pid=%d uid=%u auid=%u ses=%u",
+                         pid, uid, auid, ses);
         if (sid) {
                 rc = security_secid_to_secctx(sid, &ctx, &len);
                 if (rc)
@@ -642,13 +648,13 @@ static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type,
 
 static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 {
-        u32                     seq, sid;
+        u32                     uid, pid, seq, sid;
         void                    *data;
         struct audit_status     *status_get, status_set;
         int                     err;
         struct audit_buffer     *ab;
         u16                     msg_type = nlh->nlmsg_type;
-        kuid_t                  loginuid; /* loginuid of sender */
+        uid_t                   loginuid; /* loginuid of sender */
         u32                     sessionid;
         struct audit_sig_info   *sig_data;
         char                    *ctx = NULL;
@@ -668,11 +674,13 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 return err;
         }
 
+        pid  = NETLINK_CREDS(skb)->pid;
+        uid  = NETLINK_CREDS(skb)->uid;
         loginuid = audit_get_loginuid(current);
         sessionid = audit_get_sessionid(current);
         security_task_getsecid(current, &sid);
         seq  = nlh->nlmsg_seq;
-        data = nlmsg_data(nlh);
+        data = NLMSG_DATA(nlh);
 
         switch (msg_type) {
         case AUDIT_GET:
@@ -683,7 +691,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 status_set.backlog_limit = audit_backlog_limit;
                 status_set.lost          = atomic_read(&audit_lost);
                 status_set.backlog       = skb_queue_len(&audit_skb_queue);
-                audit_send_reply(NETLINK_CB(skb).portid, seq, AUDIT_GET, 0, 0,
+                audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0,
                                  &status_set, sizeof(status_set));
                 break;
         case AUDIT_SET:
@@ -711,7 +719,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                                                         sessionid, sid, 1);
 
                         audit_pid = new_pid;
-                        audit_nlk_portid = NETLINK_CB(skb).portid;
+                        audit_nlk_pid = NETLINK_CB(skb).pid;
                 }
                 if (status_get->mask & AUDIT_STATUS_RATE_LIMIT) {
                         err = audit_set_rate_limit(status_get->rate_limit,
@@ -729,16 +737,16 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 if (!audit_enabled && msg_type != AUDIT_USER_AVC)
                         return 0;
 
-                err = audit_filter_user();
+                err = audit_filter_user(&NETLINK_CB(skb));
                 if (err == 1) {
                         err = 0;
                         if (msg_type == AUDIT_USER_TTY) {
-                                err = tty_audit_push_task(current, loginuid,
+                                err = audit_prepare_user_tty(pid, loginuid,
                                                              sessionid);
                                 if (err)
                                         break;
                         }
-                        audit_log_common_recv_msg(&ab, msg_type,
+                        audit_log_common_recv_msg(&ab, msg_type, pid, uid,
                                                   loginuid, sessionid, sid);
 
                         if (msg_type != AUDIT_USER_TTY)
@@ -754,7 +762,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                                         size--;
                                 audit_log_n_untrustedstring(ab, data, size);
                         }
-                        audit_set_pid(ab, NETLINK_CB(skb).portid);
+                        audit_set_pid(ab, pid);
                         audit_log_end(ab);
                 }
                 break;
@@ -763,8 +771,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 if (nlmsg_len(nlh) < sizeof(struct audit_rule))
                         return -EINVAL;
                 if (audit_enabled == AUDIT_LOCKED) {
-                        audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE,
-                                                  loginuid, sessionid, sid);
+                        audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid,
+                                                  uid, loginuid, sessionid, sid);
 
                         audit_log_format(ab, " audit_enabled=%d res=0",
                                          audit_enabled);
@@ -773,8 +781,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 }
                 /* fallthrough */
         case AUDIT_LIST:
-                err = audit_receive_filter(msg_type, NETLINK_CB(skb).portid,
-                                           seq, data, nlmsg_len(nlh),
+                err = audit_receive_filter(msg_type, NETLINK_CB(skb).pid,
+                                           uid, seq, data, nlmsg_len(nlh),
                                            loginuid, sessionid, sid);
                 break;
         case AUDIT_ADD_RULE:
@@ -782,8 +790,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 if (nlmsg_len(nlh) < sizeof(struct audit_rule_data))
                         return -EINVAL;
                 if (audit_enabled == AUDIT_LOCKED) {
-                        audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE,
-                                                  loginuid, sessionid, sid);
+                        audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid,
+                                                  uid, loginuid, sessionid, sid);
 
                         audit_log_format(ab, " audit_enabled=%d res=0",
                                          audit_enabled);
@@ -792,15 +800,15 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 }
                 /* fallthrough */
         case AUDIT_LIST_RULES:
-                err = audit_receive_filter(msg_type, NETLINK_CB(skb).portid,
-                                           seq, data, nlmsg_len(nlh),
+                err = audit_receive_filter(msg_type, NETLINK_CB(skb).pid,
+                                           uid, seq, data, nlmsg_len(nlh),
                                            loginuid, sessionid, sid);
                 break;
         case AUDIT_TRIM:
                 audit_trim_trees();
 
-                audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE,
-                                          loginuid, sessionid, sid);
+                audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid,
+                                          uid, loginuid, sessionid, sid);
 
                 audit_log_format(ab, " op=trim res=1");
                 audit_log_end(ab);
@@ -831,8 +839,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 /* OK, here comes... */
                 err = audit_tag_tree(old, new);
 
-                audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE,
-                                          loginuid, sessionid, sid);
+                audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE, pid,
+                                          uid, loginuid, sessionid, sid);
 
                 audit_log_format(ab, " op=make_equiv old=");
                 audit_log_untrustedstring(ab, old);
@@ -857,41 +865,53 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                                 security_release_secctx(ctx, len);
                         return -ENOMEM;
                 }
-                sig_data->uid = from_kuid(&init_user_ns, audit_sig_uid);
+                sig_data->uid = audit_sig_uid;
                 sig_data->pid = audit_sig_pid;
                 if (audit_sig_sid) {
                         memcpy(sig_data->ctx, ctx, len);
                         security_release_secctx(ctx, len);
                 }
-                audit_send_reply(NETLINK_CB(skb).portid, seq, AUDIT_SIGNAL_INFO,
+                audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_SIGNAL_INFO,
                                 0, 0, sig_data, sizeof(*sig_data) + len);
                 kfree(sig_data);
                 break;
         case AUDIT_TTY_GET: {
                 struct audit_tty_status s;
-                struct task_struct *tsk = current;
-
-                spin_lock_irq(&tsk->sighand->siglock);
-                s.enabled = tsk->signal->audit_tty != 0;
-                spin_unlock_irq(&tsk->sighand->siglock);
-
-                audit_send_reply(NETLINK_CB(skb).portid, seq,
-                                 AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
+                struct task_struct *tsk;
+                unsigned long flags;
+
+                rcu_read_lock();
+                tsk = find_task_by_vpid(pid);
+                if (tsk && lock_task_sighand(tsk, &flags)) {
+                        s.enabled = tsk->signal->audit_tty != 0;
+                        unlock_task_sighand(tsk, &flags);
+                } else
+                        err = -ESRCH;
+                rcu_read_unlock();
+
+                if (!err)
+                        audit_send_reply(NETLINK_CB(skb).pid, seq,
+                                         AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
                 break;
         }
         case AUDIT_TTY_SET: {
                 struct audit_tty_status *s;
-                struct task_struct *tsk = current;
+                struct task_struct *tsk;
+                unsigned long flags;
 
                 if (nlh->nlmsg_len < sizeof(struct audit_tty_status))
                         return -EINVAL;
                 s = data;
                 if (s->enabled != 0 && s->enabled != 1)
                         return -EINVAL;
-
-                spin_lock_irq(&tsk->sighand->siglock);
-                tsk->signal->audit_tty = s->enabled != 0;
-                spin_unlock_irq(&tsk->sighand->siglock);
+                rcu_read_lock();
+                tsk = find_task_by_vpid(pid);
+                if (tsk && lock_task_sighand(tsk, &flags)) {
+                        tsk->signal->audit_tty = s->enabled != 0;
+                        unlock_task_sighand(tsk, &flags);
+                } else
+                        err = -ESRCH;
+                rcu_read_unlock();
                 break;
         }
         default:
@@ -941,16 +961,14 @@ static void audit_receive(struct sk_buff  *skb)
 static int __init audit_init(void)
 {
         int i;
-        struct netlink_kernel_cfg cfg = {
-                .input  = audit_receive,
-        };
 
         if (audit_initialized == AUDIT_DISABLED)
                 return 0;
 
         printk(KERN_INFO "audit: initializing netlink socket (%s)\n",
                audit_default ? "enabled" : "disabled");
-        audit_sock = netlink_kernel_create(&init_net, NETLINK_AUDIT, &cfg);
+        audit_sock = netlink_kernel_create(&init_net, NETLINK_AUDIT, 0,
+                                           audit_receive, NULL, THIS_MODULE);
         if (!audit_sock)
                 audit_panic("cannot initialize netlink socket");
         else
@@ -1042,15 +1060,13 @@ static struct audit_buffer * audit_buffer_alloc(struct audit_context *ctx,
 
         ab->skb = nlmsg_new(AUDIT_BUFSIZ, gfp_mask);
         if (!ab->skb)
-                goto err;
+                goto nlmsg_failure;
 
-        nlh = nlmsg_put(ab->skb, 0, 0, type, 0, 0);
-        if (!nlh)
-                goto out_kfree_skb;
+        nlh = NLMSG_NEW(ab->skb, 0, 0, type, 0, 0);
 
         return ab;
 
-out_kfree_skb:
+nlmsg_failure:                  /* Used by NLMSG_NEW */
         kfree_skb(ab->skb);
         ab->skb = NULL;
 err:
@@ -1101,23 +1117,6 @@ static inline void audit_get_stamp(struct audit_context *ctx,
         }
 }
 
-/*
- * Wait for auditd to drain the queue a little
- */
-static void wait_for_auditd(unsigned long sleep_time)
-{
-        DECLARE_WAITQUEUE(wait, current);
-        set_current_state(TASK_INTERRUPTIBLE);
-        add_wait_queue(&audit_backlog_wait, &wait);
-
-        if (audit_backlog_limit &&
-            skb_queue_len(&audit_skb_queue) > audit_backlog_limit)
-                schedule_timeout(sleep_time);
-
-        __set_current_state(TASK_RUNNING);
-        remove_wait_queue(&audit_backlog_wait, &wait);
-}
-
 /* Obtain an audit buffer.  This routine does locking to obtain the
  * audit buffer, but then no locking is required for calls to
  * audit_log_*format.  If the tsk is a task that is currently in a
@@ -1163,13 +1162,20 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
 
         while (audit_backlog_limit
                && skb_queue_len(&audit_skb_queue) > audit_backlog_limit + reserve) {
-                if (gfp_mask & __GFP_WAIT && audit_backlog_wait_time) {
-                        unsigned long sleep_time;
+                if (gfp_mask & __GFP_WAIT && audit_backlog_wait_time
+                    && time_before(jiffies, timeout_start + audit_backlog_wait_time)) {
+
+                        /* Wait for auditd to drain the queue a little */
+                        DECLARE_WAITQUEUE(wait, current);
+                        set_current_state(TASK_INTERRUPTIBLE);
+                        add_wait_queue(&audit_backlog_wait, &wait);
 
-                        sleep_time = timeout_start + audit_backlog_wait_time -
-                                        jiffies;
-                        if ((long)sleep_time > 0)
-                                wait_for_auditd(sleep_time);
+                        if (audit_backlog_limit &&
+                            skb_queue_len(&audit_skb_queue) > audit_backlog_limit)
+                                schedule_timeout(timeout_start + audit_backlog_wait_time - jiffies);
+
+                        __set_current_state(TASK_RUNNING);
+                        remove_wait_queue(&audit_backlog_wait, &wait);
                         continue;
                 }
                 if (audit_rate_check() && printk_ratelimit())
@@ -1254,13 +1260,12 @@ static void audit_log_vformat(struct audit_buffer *ab, const char *fmt,
                 avail = audit_expand(ab,
                         max_t(unsigned, AUDIT_BUFSIZ, 1+len-avail));
                 if (!avail)
-                        goto out_va_end;
+                        goto out;
                 len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args2);
         }
+        va_end(args2);
         if (len > 0)
                 skb_put(skb, len);
-out_va_end:
-        va_end(args2);
 out:
         return;
 }
@@ -1412,12 +1417,12 @@ void audit_log_untrustedstring(struct audit_buffer *ab, const char *string)
 
 /* This is a helper-function to print the escaped d_path */
 void audit_log_d_path(struct audit_buffer *ab, const char *prefix,
-                      const struct path *path)
+                      struct path *path)
 {
         char *p, *pathname;
 
         if (prefix)
-                audit_log_format(ab, "%s", prefix);
+                audit_log_format(ab, " %s", prefix);
 
         /* We will allow 11 spaces for ' (deleted)' to be appended */
         pathname = kmalloc(PATH_MAX+11, ab->gfp_mask);
@@ -1444,29 +1449,6 @@ void audit_log_key(struct audit_buffer *ab, char *key)
 }
 
 /**
- * audit_log_link_denied - report a link restriction denial
- * @operation: specific link opreation
- * @link: the path that triggered the restriction
- */
-void audit_log_link_denied(const char *operation, struct path *link)
-{
-        struct audit_buffer *ab;
-
-        ab = audit_log_start(current->audit_context, GFP_KERNEL,
-                             AUDIT_ANOM_LINK);
-        if (!ab)
-                return;
-        audit_log_format(ab, "op=%s action=denied", operation);
-        audit_log_format(ab, " pid=%d comm=", current->pid);
-        audit_log_untrustedstring(ab, current->comm);
-        audit_log_d_path(ab, " path=", link);
-        audit_log_format(ab, " dev=");
-        audit_log_untrustedstring(ab, link->dentry->d_inode->i_sb->s_id);
-        audit_log_format(ab, " ino=%lu", link->dentry->d_inode->i_ino);
-        audit_log_end(ab);
-}
-
-/**
  * audit_log_end - end one audit record
  * @ab: the audit_buffer
  *