[PATCH] audit signal recipients

When auditing syscalls that send signals, log the pid and security
context for each target process. Optimize the data collection by
adding a counter for signal-related rules, and avoiding allocating an
aux struct unless we have more than one target process. For process
groups, collect pid/context data in blocks of 16. Move the
audit_signal_info() hook up in check_kill_permission() so we audit
attempts where permission is denied.

Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

11 files changed, 206 insertions, 29 deletions

diff --git a/arch/ia64/kernel/audit.c b/arch/ia64/kernel/audit.c
index 538312adc53b..f3802ae89b10 100644
--- a/arch/ia64/kernel/audit.c
+++ b/arch/ia64/kernel/audit.c
@@ -28,6 +28,15 @@ static unsigned signal_class[] = {
 ~0U
 };
 
+int audit_classify_arch(int arch)
+{
+#ifdef CONFIG_IA32_SUPPORT
+        if (arch == AUDIT_ARCH_I386)
+                return 1;
+#endif
+        return 0;
+}
+
 int audit_classify_syscall(int abi, unsigned syscall)
 {
 #ifdef CONFIG_IA32_SUPPORT
diff --git a/arch/powerpc/kernel/audit.c b/arch/powerpc/kernel/audit.c
index 66d54bada0bf..a4dab7cab348 100644
--- a/arch/powerpc/kernel/audit.c
+++ b/arch/powerpc/kernel/audit.c
@@ -28,6 +28,15 @@ static unsigned signal_class[] = {
 ~0U
 };
 
+int audit_classify_arch(int arch)
+{
+#ifdef CONFIG_PPC64
+        if (arch == AUDIT_ARCH_PPC)
+                return 1;
+#endif
+        return 0;
+}
+
 int audit_classify_syscall(int abi, unsigned syscall)
 {
 #ifdef CONFIG_PPC64
diff --git a/arch/s390/kernel/audit.c b/arch/s390/kernel/audit.c
index 7affafe626d2..d1c76fe10f29 100644
--- a/arch/s390/kernel/audit.c
+++ b/arch/s390/kernel/audit.c
@@ -28,6 +28,15 @@ static unsigned signal_class[] = {
 ~0U
 };
 
+int audit_classify_arch(int arch)
+{
+#ifdef CONFIG_COMPAT
+        if (arch == AUDIT_ARCH_S390)
+                return 1;
+#endif
+        return 0;
+}
+
 int audit_classify_syscall(int abi, unsigned syscall)
 {
 #ifdef CONFIG_COMPAT
diff --git a/arch/sparc64/kernel/audit.c b/arch/sparc64/kernel/audit.c
index d57a9dad0ab7..24d7f4b4178a 100644
--- a/arch/sparc64/kernel/audit.c
+++ b/arch/sparc64/kernel/audit.c
@@ -28,6 +28,15 @@ static unsigned signal_class[] = {
 ~0U
 };
 
+int audit_classify_arch(int arch)
+{
+#ifdef CONFIG_SPARC32_COMPAT
+        if (arch == AUDIT_ARCH_SPARC)
+                return 1;
+#endif
+        return 0;
+}
+
 int audit_classify_syscall(int abi, unsigned syscall)
 {
 #ifdef CONFIG_SPARC32_COMPAT
diff --git a/arch/x86_64/kernel/audit.c b/arch/x86_64/kernel/audit.c
index b970de66ee59..06d3e5a14d9d 100644
--- a/arch/x86_64/kernel/audit.c
+++ b/arch/x86_64/kernel/audit.c
@@ -28,6 +28,15 @@ static unsigned signal_class[] = {
 ~0U
 };
 
+int audit_classify_arch(int arch)
+{
+#ifdef CONFIG_IA32_EMULATION
+        if (arch == AUDIT_ARCH_I386)
+                return 1;
+#endif
+        return 0;
+}
+
 int audit_classify_syscall(int abi, unsigned syscall)
 {
 #ifdef CONFIG_IA32_EMULATION
diff --git a/include/linux/audit.h b/include/linux/audit.h
index f165308254dc..fde0f1420cd2 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -340,6 +340,7 @@ struct mqstat;
 #define AUDITSC_RESULT(x) ( ((long)(x))<0?AUDITSC_FAILURE:AUDITSC_SUCCESS )
 extern int __init audit_register_class(int class, unsigned *list);
 extern int audit_classify_syscall(int abi, unsigned syscall);
+extern int audit_classify_arch(int arch);
 #ifdef CONFIG_AUDITSYSCALL
 /* These are defined in auditsc.c */
                                 /* Public API */
@@ -458,6 +459,7 @@ static inline int audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
         return 0;
 }
 extern int audit_n_rules;
+extern int audit_signals;
 #else
 #define audit_alloc(t) ({ 0; })
 #define audit_free(t) do { ; } while (0)
@@ -490,6 +492,7 @@ extern int audit_n_rules;
 #define audit_mq_getsetattr(d,s) ({ 0; })
 #define audit_ptrace(t) ((void)0)
 #define audit_n_rules 0
+#define audit_signals 0
 #endif
 
 #ifdef CONFIG_AUDIT
diff --git a/kernel/audit.h b/kernel/audit.h
index a3370232a390..815d6f5c04ee 100644
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -83,6 +83,7 @@ struct audit_krule {
         u32                     field_count;
         char                    *filterkey; /* ties events to rules */
         struct audit_field      *fields;
+        struct audit_field      *arch_f; /* quick access to arch field */
         struct audit_field      *inode_f; /* quick access to an inode field */
         struct audit_watch      *watch; /* associated watch */
         struct list_head        rlist;  /* entry in audit_watch.rules list */
@@ -131,17 +132,19 @@ extern void audit_handle_ievent(struct inotify_watch *, u32, u32, u32,
 extern int selinux_audit_rule_update(void);
 
 #ifdef CONFIG_AUDITSYSCALL
-extern void __audit_signal_info(int sig, struct task_struct *t);
-static inline void audit_signal_info(int sig, struct task_struct *t)
+extern int __audit_signal_info(int sig, struct task_struct *t);
+static inline int audit_signal_info(int sig, struct task_struct *t)
 {
-        if (unlikely(audit_pid && t->tgid == audit_pid))
-                __audit_signal_info(sig, t);
+        if (unlikely((audit_pid && t->tgid == audit_pid) ||
+                     (audit_signals && !audit_dummy_context())))
+                return __audit_signal_info(sig, t);
+        return 0;
 }
 extern enum audit_state audit_filter_inodes(struct task_struct *,
                                             struct audit_context *);
 extern void audit_set_auditable(struct audit_context *);
 #else
-#define audit_signal_info(s,t)
+#define audit_signal_info(s,t) AUDIT_DISABLED
 #define audit_filter_inodes(t,c) AUDIT_DISABLED
 #define audit_set_auditable(c)
 #endif
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index 3749193aed8c..6c61263ff96d 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -311,6 +311,43 @@ int audit_match_class(int class, unsigned syscall)
         return classes[class][AUDIT_WORD(syscall)] & AUDIT_BIT(syscall);
 }
 
+static inline int audit_match_class_bits(int class, u32 *mask)
+{