audit: implement all object interfield comparisons

This completes the matrix of interfield comparisons between uid/gid
information for the current task and the uid/gid information for inodes.
aka I can audit based on differences between the euid of the process and
the uid of fs objects.

Signed-off-by: Peter Moody <pmoody@google.com>
Signed-off-by: Eric Paris <eparis@redhat.com>

1 files changed, 29 insertions, 0 deletions

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 861c7b9c565a..b8cee462b99e 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -508,6 +508,7 @@ static int audit_field_compare(struct task_struct *tsk,
                                struct audit_names *name)
 {
         switch (f->val) {
+        /* process to file object comparisons */
         case AUDIT_COMPARE_UID_TO_OBJ_UID:
                 return audit_compare_id(cred->uid,
                                         name, offsetof(struct audit_names, uid),
@@ -516,6 +517,34 @@ static int audit_field_compare(struct task_struct *tsk,
                 return audit_compare_id(cred->gid,
                                         name, offsetof(struct audit_names, gid),
                                         f, ctx);
+        case AUDIT_COMPARE_EUID_TO_OBJ_UID:
+                return audit_compare_id(cred->euid,
+                                        name, offsetof(struct audit_names, uid),
+                                        f, ctx);
+        case AUDIT_COMPARE_EGID_TO_OBJ_GID:
+                return audit_compare_id(cred->egid,
+                                        name, offsetof(struct audit_names, gid),
+                                        f, ctx);
+        case AUDIT_COMPARE_AUID_TO_OBJ_UID:
+                return audit_compare_id(tsk->loginuid,
+                                        name, offsetof(struct audit_names, uid),
+                                        f, ctx);
+        case AUDIT_COMPARE_SUID_TO_OBJ_UID:
+                return audit_compare_id(cred->suid,
+                                        name, offsetof(struct audit_names, uid),
+                                        f, ctx);
+        case AUDIT_COMPARE_SGID_TO_OBJ_GID:
+                return audit_compare_id(cred->sgid,
+                                        name, offsetof(struct audit_names, gid),
+                                        f, ctx);
+        case AUDIT_COMPARE_FSUID_TO_OBJ_UID:
+                return audit_compare_id(cred->fsuid,
+                                        name, offsetof(struct audit_names, uid),
+                                        f, ctx);
+        case AUDIT_COMPARE_FSGID_TO_OBJ_GID:
+                return audit_compare_id(cred->fsgid,
+                                        name, offsetof(struct audit_names, gid),
+                                        f, ctx);
         default:
                 WARN(1, "Missing AUDIT_COMPARE define.  Report as a bug\n");
                 return 0;