Merge branch 'upstream' of git://git.infradead.org/users/pcmoore/audit

Pull audit fixes from Paul Moore:
 "Four patches to fix various problems with the audit subsystem, all are
  fairly small and straightforward.

  One patch fixes a problem where we weren't using the correct gfp
  allocation flags (GFP_KERNEL regardless of context, oops), one patch
  fixes a problem with old userspace tools (this was broken for a
  while), one patch fixes a problem where we weren't recording pathnames
  correctly, and one fixes a problem with PID based filters.

  In general I don't think there is anything controversial with this
  patchset, and it fixes some rather unfortunate bugs; the allocation
  flag one can be particularly scary looking for users"

* 'upstream' of git://git.infradead.org/users/pcmoore/audit:
  audit: restore AUDIT_LOGINUID unset ABI
  audit: correctly record file names with different path name types
  audit: use supplied gfp_mask from audit_buffer in kauditd_send_multicast_skb
  audit: don't attempt to lookup PIDs when changing PID filtering audit rules

4 files changed, 28 insertions, 21 deletions

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 0c04917c2f12..af84234e1f6e 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -47,6 +47,7 @@ struct sk_buff;
 
 struct audit_krule {
         int                     vers_ops;
+        u32                     pflags;
         u32                     flags;
         u32                     listnr;
         u32                     action;
@@ -64,6 +65,9 @@ struct audit_krule {
         u64                     prio;
 };
 
+/* Flag to indicate legacy AUDIT_LOGINUID unset usage */
+#define AUDIT_LOGINUID_LEGACY           0x1
+
 struct audit_field {
         u32                             type;
         union {
diff --git a/kernel/audit.c b/kernel/audit.c
index f8f203e8018c..231b7dcb154b 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -429,7 +429,7 @@ static void kauditd_send_skb(struct sk_buff *skb)
  * This function doesn't consume an skb as might be expected since it has to
  * copy it anyways.
  */
-static void kauditd_send_multicast_skb(struct sk_buff *skb)
+static void kauditd_send_multicast_skb(struct sk_buff *skb, gfp_t gfp_mask)
 {
         struct sk_buff          *copy;
         struct audit_net        *aunet = net_generic(&init_net, audit_net_id);
@@ -448,11 +448,11 @@ static void kauditd_send_multicast_skb(struct sk_buff *skb)
          * no reason for new multicast clients to continue with this
          * non-compliance.
          */
-        copy = skb_copy(skb, GFP_KERNEL);
+        copy = skb_copy(skb, gfp_mask);
         if (!copy)
                 return;
 
-        nlmsg_multicast(sock, copy, 0, AUDIT_NLGRP_READLOG, GFP_KERNEL);
+        nlmsg_multicast(sock, copy, 0, AUDIT_NLGRP_READLOG, gfp_mask);
 }
 
 /*
@@ -1940,7 +1940,7 @@ void audit_log_end(struct audit_buffer *ab)
                 struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
 
                 nlh->nlmsg_len = ab->skb->len;
-                kauditd_send_multicast_skb(ab->skb);
+                kauditd_send_multicast_skb(ab->skb, ab->gfp_mask);
 
                 /*
                  * The original kaudit unicast socket sends up messages with
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index 3598e13f2a65..4f68a326d92e 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -442,19 +442,7 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
                 if ((f->type == AUDIT_LOGINUID) && (f->val == AUDIT_UID_UNSET)) {
                         f->type = AUDIT_LOGINUID_SET;
                         f->val = 0;
-                }
-
-                if ((f->type == AUDIT_PID) || (f->type == AUDIT_PPID)) {
-                        struct pid *pid;
-                        rcu_read_lock();
-                        pid = find_vpid(f->val);
-                        if (!pid) {
-                                rcu_read_unlock();
-                                err = -ESRCH;
-                                goto exit_free;
-                        }
-                        f->val = pid_nr(pid);
-                        rcu_read_unlock();
+                        entry->rule.pflags |= AUDIT_LOGINUID_LEGACY;
                 }
 
                 err = audit_field_valid(entry, f);
@@ -630,6 +618,13 @@ static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule)
                         data->buflen += data->values[i] =
                                 audit_pack_string(&bufp, krule->filterkey);
                         break;
+                case AUDIT_LOGINUID_SET:
+                        if (krule->pflags & AUDIT_LOGINUID_LEGACY && !f->val) {
+                                data->fields[i] = AUDIT_LOGINUID;
+                                data->values[i] = AUDIT_UID_UNSET;
+                                break;
+                        }
+                        /* fallthrough if set */
                 default:
                         data->values[i] = f->val;
                 }
@@ -646,6 +641,7 @@ static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b)
         int i;
 
         if (a->flags != b->flags ||
+            a->pflags != b->pflags ||
             a->listnr != b->listnr ||
             a->action != b->action ||
             a->field_count != b->field_count)
@@ -764,6 +760,7 @@ struct audit_entry *audit_dupe_rule(struct audit_krule *old)
         new = &entry->rule;
         new->vers_ops = old->vers_ops;
         new->flags = old->flags;
+        new->pflags = old->pflags;
         new->listnr = old->listnr;
         new->action = old->action;
         for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index c75522a83678..37c69ab561da 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1877,12 +1877,18 @@ void __audit_inode(struct filename *name, const struct dentry *dentry,
         }
 
 out_alloc:
-        /* unable to find the name from a previous getname(). Allocate a new
-         * anonymous entry.
-         */
-        n = audit_alloc_name(context, AUDIT_TYPE_NORMAL);
+        /* unable to find an entry with both a matching name and type */
+        n = audit_alloc_name(context, AUDIT_TYPE_UNKNOWN);
         if (!n)
                 return;
+        if (name)
+                /* since name is not NULL we know there is already a matching
+                 * name record, see audit_getname(), so there must be a type
+                 * mismatch; reuse the string path since the original name
+                 * record will keep the string valid until we free it in
+                 * audit_free_names() */
+                n->name = name;
+
 out:
         if (parent) {
                 n->name_len = n->name ? parent_len(n->name->name) : AUDIT_NAME_FULL;