Merge master.kernel.org:/pub/scm/linux/kernel/git/dwmw2/audit-2.6

2 files changed, 308 insertions, 147 deletions

diff --git a/kernel/audit.c b/kernel/audit.c
index 7f0699790d46..83096b67510a 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -79,6 +79,8 @@ static int	audit_rate_limit;
 
 /* Number of outstanding audit_buffers allowed. */
 static int      audit_backlog_limit = 64;
+static int      audit_backlog_wait_time = 60 * HZ;
+static int      audit_backlog_wait_overflow = 0;
 
 /* The identity of the user shutting down the audit system. */
 uid_t           audit_sig_uid = -1;
@@ -106,18 +108,12 @@ static LIST_HEAD(audit_freelist);
 static struct sk_buff_head audit_skb_queue;
 static struct task_struct *kauditd_task;
 static DECLARE_WAIT_QUEUE_HEAD(kauditd_wait);
-
-/* There are three lists of rules -- one to search at task creation
- * time, one to search at syscall entry time, and another to search at
- * syscall exit time. */
-static LIST_HEAD(audit_tsklist);
-static LIST_HEAD(audit_entlist);
-static LIST_HEAD(audit_extlist);
+static DECLARE_WAIT_QUEUE_HEAD(audit_backlog_wait);
 
 /* The netlink socket is only to be read by 1 CPU, which lets us assume
  * that list additions and deletions never happen simultaneously in
  * auditsc.c */
-static DECLARE_MUTEX(audit_netlink_sem);
+DECLARE_MUTEX(audit_netlink_sem);
 
 /* AUDIT_BUFSIZ is the size of the temporary buffer used for formatting
  * audit records.  Since printk uses a 1024 byte buffer, this buffer
@@ -137,6 +133,7 @@ struct audit_buffer {
         struct list_head     list;
         struct sk_buff       *skb;      /* formatted skb ready to send */
         struct audit_context *ctx;      /* NULL or associated context */
+        int                  gfp_mask;
 };
 
 static void audit_set_pid(struct audit_buffer *ab, pid_t pid)
@@ -145,11 +142,6 @@ static void audit_set_pid(struct audit_buffer *ab, pid_t pid)
         nlh->nlmsg_pid = pid;
 }
 
-struct audit_entry {
-        struct list_head  list;
-        struct audit_rule rule;
-};
-
 static void audit_panic(const char *message)
 {
         switch (audit_failure)
@@ -233,7 +225,7 @@ static int audit_set_rate_limit(int limit, uid_t loginuid)
 {
         int old          = audit_rate_limit;
         audit_rate_limit = limit;
-        audit_log(NULL, AUDIT_CONFIG_CHANGE, 
+        audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 
                         "audit_rate_limit=%d old=%d by auid=%u",
                         audit_rate_limit, old, loginuid);
         return old;
@@ -243,7 +235,7 @@ static int audit_set_backlog_limit(int limit, uid_t loginuid)
 {
         int old          = audit_backlog_limit;
         audit_backlog_limit = limit;
-        audit_log(NULL, AUDIT_CONFIG_CHANGE,
+        audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
                         "audit_backlog_limit=%d old=%d by auid=%u",
                         audit_backlog_limit, old, loginuid);
         return old;
@@ -255,7 +247,7 @@ static int audit_set_enabled(int state, uid_t loginuid)
         if (state != 0 && state != 1)
                 return -EINVAL;
         audit_enabled = state;
-        audit_log(NULL, AUDIT_CONFIG_CHANGE,
+        audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
                         "audit_enabled=%d old=%d by auid=%u",
                         audit_enabled, old, loginuid);
         return old;
@@ -269,7 +261,7 @@ static int audit_set_failure(int state, uid_t loginuid)
             && state != AUDIT_FAIL_PANIC)
                 return -EINVAL;
         audit_failure = state;
-        audit_log(NULL, AUDIT_CONFIG_CHANGE,
+        audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
                         "audit_failure=%d old=%d by auid=%u",
                         audit_failure, old, loginuid);
         return old;
@@ -281,6 +273,7 @@ int kauditd_thread(void *dummy)
 
         while (1) {
                 skb = skb_dequeue(&audit_skb_queue);
+                wake_up(&audit_backlog_wait);
                 if (skb) {
                         if (audit_pid) {
                                 int err = netlink_unicast(audit_sock, skb, audit_pid, 0);
@@ -290,7 +283,7 @@ int kauditd_thread(void *dummy)
                                         audit_pid = 0;
                                 }
                         } else {
-                                printk(KERN_ERR "%s\n", skb->data + NLMSG_SPACE(0));
+                                printk(KERN_NOTICE "%s\n", skb->data + NLMSG_SPACE(0));
                                 kfree_skb(skb);
                         }
                 } else {
@@ -423,7 +416,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 if (status_get->mask & AUDIT_STATUS_PID) {
                         int old   = audit_pid;
                         audit_pid = status_get->pid;
-                        audit_log(NULL, AUDIT_CONFIG_CHANGE,
+                        audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
                                 "audit_pid=%d old=%d by auid=%u",
                                   audit_pid, old, loginuid);
                 }
@@ -435,15 +428,21 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 break;
         case AUDIT_USER:
         case AUDIT_FIRST_USER_MSG...AUDIT_LAST_USER_MSG:
-                ab = audit_log_start(NULL, msg_type);
-                if (!ab)
-                        break;  /* audit_panic has been called */
-                audit_log_format(ab,
-                                 "user pid=%d uid=%u auid=%u"
-                                 " msg='%.1024s'",
-                                 pid, uid, loginuid, (char *)data);
-                audit_set_pid(ab, pid);
-                audit_log_end(ab);
+                if (!audit_enabled && msg_type != AUDIT_USER_AVC)
+                        return 0;
+
+                err = audit_filter_user(&NETLINK_CB(skb), msg_type);
+                if (err == 1) {
+                        err = 0;
+                        ab = audit_log_start(NULL, GFP_KERNEL, msg_type);
+                        if (ab) {
+                                audit_log_format(ab,
+                                                 "user pid=%d uid=%u auid=%u msg='%.1024s'",
+                                                 pid, uid, loginuid, (char *)data);
+                                audit_set_pid(ab, pid);
+                                audit_log_end(ab);
+                        }
+                }
                 break;
         case AUDIT_ADD:
         case AUDIT_DEL:
@@ -523,7 +522,7 @@ static int __init audit_init(void)
         skb_queue_head_init(&audit_skb_queue);
         audit_initialized = 1;
         audit_enabled = audit_default;
-        audit_log(NULL, AUDIT_KERNEL, "initialized");
+        audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized");
         return 0;
 }
 __initcall(audit_init);
@@ -561,7 +560,7 @@ static void audit_buffer_free(struct audit_buffer *ab)
 }
 
 static struct audit_buffer * audit_buffer_alloc(struct audit_context *ctx,
-                                                int gfp_mask, int type)
+                                                unsigned int __nocast gfp_mask, int type)
 {
         unsigned long flags;
         struct audit_buffer *ab = NULL;
@@ -587,6 +586,7 @@ static struct audit_buffer * audit_buffer_alloc(struct audit_context *ctx,