diff options
author | Eric W. Biederman <ebiederm@xmission.com> | 2013-04-09 05:22:10 -0400 |
---|---|---|
committer | Eric Paris <eparis@redhat.com> | 2013-05-07 22:27:15 -0400 |
commit | 780a7654cee8d61819512385e778e4827db4bfbc (patch) | |
tree | a97ea8256b7507c976714f9e9c48d8dd581d07a6 /kernel/auditsc.c | |
parent | b24a30a7305418ff138ff51776fc555ec57c011a (diff) |
audit: Make testing for a valid loginuid explicit.
audit rule additions containing "-F auid!=4294967295" were failing
with EINVAL because of a regression caused by e1760bd.
Apparently some userland audit rule sets want to know if loginuid uid
has been set and are using a test for auid != 4294967295 to determine
that.
In practice that is a horrible way to ask if a value has been set,
because it relies on subtle implementation details and will break
every time the uid implementation in the kernel changes.
So add a clean way to test if the audit loginuid has been set, and
silently convert the old idiom to the cleaner and more comprehensible
new idiom.
Cc: <stable@vger.kernel.org> # 3.7
Reported-By: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Tested-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
Diffstat (limited to 'kernel/auditsc.c')
-rw-r--r-- | kernel/auditsc.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/kernel/auditsc.c b/kernel/auditsc.c index add3086bdb02..3c8a601324a2 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c | |||
@@ -613,6 +613,9 @@ static int audit_filter_rules(struct task_struct *tsk, | |||
613 | if (ctx) | 613 | if (ctx) |
614 | result = audit_uid_comparator(tsk->loginuid, f->op, f->uid); | 614 | result = audit_uid_comparator(tsk->loginuid, f->op, f->uid); |
615 | break; | 615 | break; |
616 | case AUDIT_LOGINUID_SET: | ||
617 | result = audit_comparator(audit_loginuid_set(tsk), f->op, f->val); | ||
618 | break; | ||
616 | case AUDIT_SUBJ_USER: | 619 | case AUDIT_SUBJ_USER: |
617 | case AUDIT_SUBJ_ROLE: | 620 | case AUDIT_SUBJ_ROLE: |
618 | case AUDIT_SUBJ_TYPE: | 621 | case AUDIT_SUBJ_TYPE: |
@@ -1970,7 +1973,7 @@ int audit_set_loginuid(kuid_t loginuid) | |||
1970 | unsigned int sessionid; | 1973 | unsigned int sessionid; |
1971 | 1974 | ||
1972 | #ifdef CONFIG_AUDIT_LOGINUID_IMMUTABLE | 1975 | #ifdef CONFIG_AUDIT_LOGINUID_IMMUTABLE |
1973 | if (uid_valid(task->loginuid)) | 1976 | if (audit_loginuid_set(task)) |
1974 | return -EPERM; | 1977 | return -EPERM; |
1975 | #else /* CONFIG_AUDIT_LOGINUID_IMMUTABLE */ | 1978 | #else /* CONFIG_AUDIT_LOGINUID_IMMUTABLE */ |
1976 | if (!capable(CAP_AUDIT_CONTROL)) | 1979 | if (!capable(CAP_AUDIT_CONTROL)) |