aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--include/linux/audit.h2
-rw-r--r--kernel/auditsc.c47
-rw-r--r--security/selinux/avc.c15
3 files changed, 8 insertions, 56 deletions
diff --git a/include/linux/audit.h b/include/linux/audit.h
index a35859ab2fdb..4bbd8601b8f0 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -411,7 +411,6 @@ extern int audit_bprm(struct linux_binprm *bprm);
411extern int audit_socketcall(int nargs, unsigned long *args); 411extern int audit_socketcall(int nargs, unsigned long *args);
412extern int audit_sockaddr(int len, void *addr); 412extern int audit_sockaddr(int len, void *addr);
413extern int __audit_fd_pair(int fd1, int fd2); 413extern int __audit_fd_pair(int fd1, int fd2);
414extern int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt);
415extern int audit_set_macxattr(const char *name); 414extern int audit_set_macxattr(const char *name);
416extern int __audit_mq_open(int oflag, mode_t mode, struct mq_attr __user *u_attr); 415extern int __audit_mq_open(int oflag, mode_t mode, struct mq_attr __user *u_attr);
417extern int __audit_mq_timedsend(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec __user *u_abs_timeout); 416extern int __audit_mq_timedsend(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec __user *u_abs_timeout);
@@ -491,7 +490,6 @@ extern int audit_signals;
491#define audit_socketcall(n,a) ({ 0; }) 490#define audit_socketcall(n,a) ({ 0; })
492#define audit_fd_pair(n,a) ({ 0; }) 491#define audit_fd_pair(n,a) ({ 0; })
493#define audit_sockaddr(len, addr) ({ 0; }) 492#define audit_sockaddr(len, addr) ({ 0; })
494#define audit_avc_path(dentry, mnt) ({ 0; })
495#define audit_set_macxattr(n) do { ; } while (0) 493#define audit_set_macxattr(n) do { ; } while (0)
496#define audit_mq_open(o,m,a) ({ 0; }) 494#define audit_mq_open(o,m,a) ({ 0; })
497#define audit_mq_timedsend(d,l,p,t) ({ 0; }) 495#define audit_mq_timedsend(d,l,p,t) ({ 0; })
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index f5e917e60ac2..bde1124d5908 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -173,12 +173,6 @@ struct audit_aux_data_fd_pair {
173 int fd[2]; 173 int fd[2];
174}; 174};
175 175
176struct audit_aux_data_path {
177 struct audit_aux_data d;
178 struct dentry *dentry;
179 struct vfsmount *mnt;
180};
181
182struct audit_aux_data_pids { 176struct audit_aux_data_pids {
183 struct audit_aux_data d; 177 struct audit_aux_data d;
184 pid_t target_pid[AUDIT_AUX_PIDS]; 178 pid_t target_pid[AUDIT_AUX_PIDS];
@@ -654,12 +648,6 @@ static inline void audit_free_aux(struct audit_context *context)
654 struct audit_aux_data *aux; 648 struct audit_aux_data *aux;
655 649
656 while ((aux = context->aux)) { 650 while ((aux = context->aux)) {
657 if (aux->type == AUDIT_AVC_PATH) {
658 struct audit_aux_data_path *axi = (void *)aux;
659 dput(axi->dentry);
660 mntput(axi->mnt);
661 }
662
663 context->aux = aux->next; 651 context->aux = aux->next;
664 kfree(aux); 652 kfree(aux);
665 } 653 }
@@ -1038,11 +1026,6 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
1038 audit_log_hex(ab, axs->a, axs->len); 1026 audit_log_hex(ab, axs->a, axs->len);
1039 break; } 1027 break; }
1040 1028
1041 case AUDIT_AVC_PATH: {
1042 struct audit_aux_data_path *axi = (void *)aux;
1043 audit_log_d_path(ab, "path=", axi->dentry, axi->mnt);
1044 break; }
1045
1046 case AUDIT_FD_PAIR: { 1029 case AUDIT_FD_PAIR: {
1047 struct audit_aux_data_fd_pair *axs = (void *)aux; 1030 struct audit_aux_data_fd_pair *axs = (void *)aux;
1048 audit_log_format(ab, "fd0=%d fd1=%d", axs->fd[0], axs->fd[1]); 1031 audit_log_format(ab, "fd0=%d fd1=%d", axs->fd[0], axs->fd[1]);
@@ -1991,36 +1974,6 @@ void __audit_ptrace(struct task_struct *t)
1991} 1974}
1992 1975
1993/** 1976/**
1994 * audit_avc_path - record the granting or denial of permissions
1995 * @dentry: dentry to record
1996 * @mnt: mnt to record
1997 *
1998 * Returns 0 for success or NULL context or < 0 on error.
1999 *
2000 * Called from security/selinux/avc.c::avc_audit()
2001 */
2002int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt)
2003{
2004 struct audit_aux_data_path *ax;
2005 struct audit_context *context = current->audit_context;
2006
2007 if (likely(!context))
2008 return 0;
2009
2010 ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
2011 if (!ax)
2012 return -ENOMEM;
2013
2014 ax->dentry = dget(dentry);
2015 ax->mnt = mntget(mnt);
2016
2017 ax->d.type = AUDIT_AVC_PATH;
2018 ax->d.next = context->aux;
2019 context->aux = (void *)ax;
2020 return 0;
2021}
2022
2023/**
2024 * audit_signal_info - record signal info for shutting down audit subsystem 1977 * audit_signal_info - record signal info for shutting down audit subsystem
2025 * @sig: signal value 1978 * @sig: signal value
2026 * @t: task being signaled 1979 * @t: task being signaled
diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index ecd067384531..0e69adf63bdb 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -570,10 +570,12 @@ void avc_audit(u32 ssid, u32 tsid,
570 case AVC_AUDIT_DATA_FS: 570 case AVC_AUDIT_DATA_FS:
571 if (a->u.fs.dentry) { 571 if (a->u.fs.dentry) {
572 struct dentry *dentry = a->u.fs.dentry; 572 struct dentry *dentry = a->u.fs.dentry;
573 if (a->u.fs.mnt) 573 if (a->u.fs.mnt) {
574 audit_avc_path(dentry, a->u.fs.mnt); 574 audit_log_d_path(ab, "path=", dentry, a->u.fs.mnt);
575 audit_log_format(ab, " name="); 575 } else {
576 audit_log_untrustedstring(ab, dentry->d_name.name); 576 audit_log_format(ab, " name=");
577 audit_log_untrustedstring(ab, dentry->d_name.name);
578 }
577 inode = dentry->d_inode; 579 inode = dentry->d_inode;
578 } else if (a->u.fs.inode) { 580 } else if (a->u.fs.inode) {
579 struct dentry *dentry; 581 struct dentry *dentry;
@@ -624,9 +626,8 @@ void avc_audit(u32 ssid, u32 tsid,
624 case AF_UNIX: 626 case AF_UNIX:
625 u = unix_sk(sk); 627 u = unix_sk(sk);
626 if (u->dentry) { 628 if (u->dentry) {
627 audit_avc_path(u->dentry, u->mnt); 629 audit_log_d_path(ab, "path=",
628 audit_log_format(ab, " name="); 630 u->dentry, u->mnt);
629 audit_log_untrustedstring(ab, u->dentry->d_name.name);
630 break; 631 break;
631 } 632 }
632 if (!u->addr) 633 if (!u->addr)