The attached patch addresses the problem with getting the audit daemon

shutdown credential information. It creates a new message type 
AUDIT_TERM_INFO, which is used by the audit daemon to query who issued the 
shutdown. 

It requires the placement of a hook function that gathers the information. The 
hook is after the DAC & MAC checks and before the function returns. Racing 
threads could overwrite the uid & pid - but they would have to be root and 
have policy that allows signalling the audit daemon. That should be a 
manageable risk.

The userspace component will be released later in audit 0.7.2. When it 
receives the TERM signal, it queries the kernel for shutdown information. 
When it receives it, it writes the message and exits. The message looks 
like this:

type=DAEMON msg=auditd(1114551182.000) auditd normal halt, sending pid=2650 
uid=525, auditd pid=1685

Signed-off-by: Steve Grubb <sgrubb@redhat.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

1 files changed, 17 insertions, 8 deletions

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 19f04b049798..baa80760824c 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -28,14 +28,16 @@
 #include <linux/elf.h>
 
 /* Request and reply types */
-#define AUDIT_GET      1000     /* Get status */
-#define AUDIT_SET      1001     /* Set status (enable/disable/auditd) */
-#define AUDIT_LIST     1002     /* List filtering rules */
-#define AUDIT_ADD      1003     /* Add filtering rule */
-#define AUDIT_DEL      1004     /* Delete filtering rule */
-#define AUDIT_USER     1005     /* Send a message from user-space */
-#define AUDIT_LOGIN    1006     /* Define the login id and informaiton */
-#define AUDIT_KERNEL   2000     /* Asynchronous audit record. NOT A REQUEST. */
+#define AUDIT_GET               1000    /* Get status */
+#define AUDIT_SET               1001    /* Set status (enable/disable/auditd) */
+#define AUDIT_LIST              1002    /* List filtering rules */
+#define AUDIT_ADD               1003    /* Add filtering rule */
+#define AUDIT_DEL               1004    /* Delete filtering rule */
+#define AUDIT_USER              1005    /* Send a message from user-space */
+#define AUDIT_LOGIN             1006    /* Define the login id and information */
+#define AUDIT_SIGNAL_INFO       1010    /* Get information about sender of signal*/
+
+#define AUDIT_KERNEL            2000    /* Asynchronous audit record. NOT A REQUEST. */
 
 /* Rule flags */
 #define AUDIT_PER_TASK 0x01     /* Apply rule at task creation (not syscall) */
@@ -161,6 +163,11 @@ struct audit_rule {		/* for AUDIT_LIST, AUDIT_ADD, and AUDIT_DEL */
 
 #ifdef __KERNEL__
 
+struct audit_sig_info {
+        uid_t           uid;
+        pid_t           pid;
+};
+
 struct audit_buffer;
 struct audit_context;
 struct inode;
@@ -190,6 +197,7 @@ extern void audit_get_stamp(struct audit_context *ctx,
 extern int  audit_set_loginuid(struct task_struct *task, uid_t loginuid);
 extern uid_t audit_get_loginuid(struct audit_context *ctx);
 extern int audit_ipc_perms(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode);
+extern void audit_signal_info(int sig, struct task_struct *t);
 #else
 #define audit_alloc(t) ({ 0; })
 #define audit_free(t) do { ; } while (0)
@@ -200,6 +208,7 @@ extern int audit_ipc_perms(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mo
 #define audit_inode(n,i) do { ; } while (0)
 #define audit_get_loginuid(c) ({ -1; })
 #define audit_ipc_perms(q,u,g,m) ({ 0; })
+#define audit_signal_info(s,t) do { ; } while (0)
 #endif
 
 #ifdef CONFIG_AUDIT