audit: audit feature to set loginuid immutable

This adds a new 'audit_feature' bit which allows userspace to set it
such that the loginuid is absolutely immutable, even if you have
CAP_AUDIT_CONTROL.

Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>

1 files changed, 3 insertions, 0 deletions

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 924c0bf048d2..63223d671a6e 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1971,6 +1971,9 @@ static int audit_set_loginuid_perm(kuid_t loginuid)
         /* if we are unset, we don't need privs */
         if (!audit_loginuid_set(current))
                 return 0;
+        /* if AUDIT_FEATURE_LOGINUID_IMMUTABLE means never ever allow a change*/
+        if (is_audit_feature_set(AUDIT_FEATURE_LOGINUID_IMMUTABLE))
+                return -EPERM;
         /* it is set, you need permission */
         if (!capable(CAP_AUDIT_CONTROL))
                 return -EPERM;