aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--MAINTAINERS7
-rw-r--r--fs/namei.c2
-rw-r--r--include/linux/audit.h32
-rw-r--r--kernel/audit.c95
-rw-r--r--kernel/auditsc.c216
-rw-r--r--security/selinux/avc.c4
-rw-r--r--security/selinux/hooks.c2
-rw-r--r--security/selinux/ss/services.c4
8 files changed, 255 insertions, 107 deletions
diff --git a/MAINTAINERS b/MAINTAINERS
index 19a9a1c53037..aa1d9d702e2d 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -363,6 +363,13 @@ L: linux-atm-general@lists.sourceforge.net
363W: http://linux-atm.sourceforge.net 363W: http://linux-atm.sourceforge.net
364S: Maintained 364S: Maintained
365 365
366AUDIT SUBSYSTEM
367P: David Woodhouse
368M: dwmw2@infradead.org
369L: linux-audit@redhat.com
370W: http://people.redhat.com/sgrubb/audit/
371S: Maintained
372
366ATMEL WIRELESS DRIVER 373ATMEL WIRELESS DRIVER
367P: Simon Kelley 374P: Simon Kelley
368M: simon@thekelleys.org.uk 375M: simon@thekelleys.org.uk
diff --git a/fs/namei.c b/fs/namei.c
index fa8df81ce8ca..56e9f0f7e761 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1043,7 +1043,7 @@ int fastcall path_lookup(const char *name, unsigned int flags, struct nameidata
1043out: 1043out:
1044 if (unlikely(current->audit_context 1044 if (unlikely(current->audit_context
1045 && nd && nd->dentry && nd->dentry->d_inode)) 1045 && nd && nd->dentry && nd->dentry->d_inode))
1046 audit_inode(name, nd->dentry->d_inode); 1046 audit_inode(name, nd->dentry->d_inode, flags);
1047 return retval; 1047 return retval;
1048} 1048}
1049 1049
diff --git a/include/linux/audit.h b/include/linux/audit.h
index bf2ad3ba72eb..38999f827a36 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -51,7 +51,8 @@
51#define AUDIT_WATCH_LIST 1009 /* List all file/dir watches */ 51#define AUDIT_WATCH_LIST 1009 /* List all file/dir watches */
52#define AUDIT_SIGNAL_INFO 1010 /* Get info about sender of signal to auditd */ 52#define AUDIT_SIGNAL_INFO 1010 /* Get info about sender of signal to auditd */
53 53
54#define AUDIT_FIRST_USER_MSG 1100 /* Userspace messages uninteresting to kernel */ 54#define AUDIT_FIRST_USER_MSG 1100 /* Userspace messages mostly uninteresting to kernel */
55#define AUDIT_USER_AVC 1107 /* We filter this differently */
55#define AUDIT_LAST_USER_MSG 1199 56#define AUDIT_LAST_USER_MSG 1199
56 57
57#define AUDIT_DAEMON_START 1200 /* Daemon startup record */ 58#define AUDIT_DAEMON_START 1200 /* Daemon startup record */
@@ -75,10 +76,15 @@
75#define AUDIT_KERNEL 2000 /* Asynchronous audit record. NOT A REQUEST. */ 76#define AUDIT_KERNEL 2000 /* Asynchronous audit record. NOT A REQUEST. */
76 77
77/* Rule flags */ 78/* Rule flags */
78#define AUDIT_PER_TASK 0x01 /* Apply rule at task creation (not syscall) */ 79#define AUDIT_FILTER_USER 0x00 /* Apply rule to user-generated messages */
79#define AUDIT_AT_ENTRY 0x02 /* Apply rule at syscall entry */ 80#define AUDIT_FILTER_TASK 0x01 /* Apply rule at task creation (not syscall) */
80#define AUDIT_AT_EXIT 0x04 /* Apply rule at syscall exit */ 81#define AUDIT_FILTER_ENTRY 0x02 /* Apply rule at syscall entry */
81#define AUDIT_PREPEND 0x10 /* Prepend to front of list */ 82#define AUDIT_FILTER_WATCH 0x03 /* Apply rule to file system watches */
83#define AUDIT_FILTER_EXIT 0x04 /* Apply rule at syscall exit */
84
85#define AUDIT_NR_FILTERS 5
86
87#define AUDIT_FILTER_PREPEND 0x10 /* Prepend to front of list */
82 88
83/* Rule actions */ 89/* Rule actions */
84#define AUDIT_NEVER 0 /* Do not build context if rule matches */ 90#define AUDIT_NEVER 0 /* Do not build context if rule matches */
@@ -199,6 +205,7 @@ struct audit_sig_info {
199struct audit_buffer; 205struct audit_buffer;
200struct audit_context; 206struct audit_context;
201struct inode; 207struct inode;
208struct netlink_skb_parms;
202 209
203#define AUDITSC_INVALID 0 210#define AUDITSC_INVALID 0
204#define AUDITSC_SUCCESS 1 211#define AUDITSC_SUCCESS 1
@@ -215,7 +222,7 @@ extern void audit_syscall_entry(struct task_struct *task, int arch,
215extern void audit_syscall_exit(struct task_struct *task, int failed, long return_code); 222extern void audit_syscall_exit(struct task_struct *task, int failed, long return_code);
216extern void audit_getname(const char *name); 223extern void audit_getname(const char *name);
217extern void audit_putname(const char *name); 224extern void audit_putname(const char *name);
218extern void audit_inode(const char *name, const struct inode *inode); 225extern void audit_inode(const char *name, const struct inode *inode, unsigned flags);
219 226
220 /* Private API (for audit.c only) */ 227 /* Private API (for audit.c only) */
221extern int audit_receive_filter(int type, int pid, int uid, int seq, 228extern int audit_receive_filter(int type, int pid, int uid, int seq,
@@ -230,6 +237,7 @@ extern int audit_socketcall(int nargs, unsigned long *args);
230extern int audit_sockaddr(int len, void *addr); 237extern int audit_sockaddr(int len, void *addr);
231extern int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt); 238extern int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt);
232extern void audit_signal_info(int sig, struct task_struct *t); 239extern void audit_signal_info(int sig, struct task_struct *t);
240extern int audit_filter_user(struct netlink_skb_parms *cb, int type);
233#else 241#else
234#define audit_alloc(t) ({ 0; }) 242#define audit_alloc(t) ({ 0; })
235#define audit_free(t) do { ; } while (0) 243#define audit_free(t) do { ; } while (0)
@@ -237,7 +245,7 @@ extern void audit_signal_info(int sig, struct task_struct *t);
237#define audit_syscall_exit(t,f,r) do { ; } while (0) 245#define audit_syscall_exit(t,f,r) do { ; } while (0)
238#define audit_getname(n) do { ; } while (0) 246#define audit_getname(n) do { ; } while (0)
239#define audit_putname(n) do { ; } while (0) 247#define audit_putname(n) do { ; } while (0)
240#define audit_inode(n,i) do { ; } while (0) 248#define audit_inode(n,i,f) do { ; } while (0)
241#define audit_receive_filter(t,p,u,s,d,l) ({ -EOPNOTSUPP; }) 249#define audit_receive_filter(t,p,u,s,d,l) ({ -EOPNOTSUPP; })
242#define auditsc_get_stamp(c,t,s) do { BUG(); } while (0) 250#define auditsc_get_stamp(c,t,s) do { BUG(); } while (0)
243#define audit_get_loginuid(c) ({ -1; }) 251#define audit_get_loginuid(c) ({ -1; })
@@ -246,16 +254,17 @@ extern void audit_signal_info(int sig, struct task_struct *t);
246#define audit_sockaddr(len, addr) ({ 0; }) 254#define audit_sockaddr(len, addr) ({ 0; })
247#define audit_avc_path(dentry, mnt) ({ 0; }) 255#define audit_avc_path(dentry, mnt) ({ 0; })
248#define audit_signal_info(s,t) do { ; } while (0) 256#define audit_signal_info(s,t) do { ; } while (0)
257#define audit_filter_user(cb,t) ({ 1; })
249#endif 258#endif
250 259
251#ifdef CONFIG_AUDIT 260#ifdef CONFIG_AUDIT
252/* These are defined in audit.c */ 261/* These are defined in audit.c */
253 /* Public API */ 262 /* Public API */
254extern void audit_log(struct audit_context *ctx, int type, 263extern void audit_log(struct audit_context *ctx, int gfp_mask,
255 const char *fmt, ...) 264 int type, const char *fmt, ...)
256 __attribute__((format(printf,3,4))); 265 __attribute__((format(printf,4,5)));
257 266
258extern struct audit_buffer *audit_log_start(struct audit_context *ctx,int type); 267extern struct audit_buffer *audit_log_start(struct audit_context *ctx, int gfp_mask, int type);
259extern void audit_log_format(struct audit_buffer *ab, 268extern void audit_log_format(struct audit_buffer *ab,
260 const char *fmt, ...) 269 const char *fmt, ...)
261 __attribute__((format(printf,2,3))); 270 __attribute__((format(printf,2,3)));
@@ -274,6 +283,7 @@ extern void audit_send_reply(int pid, int seq, int type,
274 int done, int multi, 283 int done, int multi,
275 void *payload, int size); 284 void *payload, int size);
276extern void audit_log_lost(const char *message); 285extern void audit_log_lost(const char *message);
286extern struct semaphore audit_netlink_sem;
277#else 287#else
278#define audit_log(c,t,f,...) do { ; } while (0) 288#define audit_log(c,t,f,...) do { ; } while (0)
279#define audit_log_start(c,t) ({ NULL; }) 289#define audit_log_start(c,t) ({ NULL; })
diff --git a/kernel/audit.c b/kernel/audit.c
index ef35166fdc29..2617d0552400 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -106,18 +106,12 @@ static LIST_HEAD(audit_freelist);
106static struct sk_buff_head audit_skb_queue; 106static struct sk_buff_head audit_skb_queue;
107static struct task_struct *kauditd_task; 107static struct task_struct *kauditd_task;
108static DECLARE_WAIT_QUEUE_HEAD(kauditd_wait); 108static DECLARE_WAIT_QUEUE_HEAD(kauditd_wait);
109 109static DECLARE_WAIT_QUEUE_HEAD(audit_backlog_wait);
110/* There are three lists of rules -- one to search at task creation
111 * time, one to search at syscall entry time, and another to search at
112 * syscall exit time. */
113static LIST_HEAD(audit_tsklist);
114static LIST_HEAD(audit_entlist);
115static LIST_HEAD(audit_extlist);
116 110
117/* The netlink socket is only to be read by 1 CPU, which lets us assume 111/* The netlink socket is only to be read by 1 CPU, which lets us assume
118 * that list additions and deletions never happen simultaneously in 112 * that list additions and deletions never happen simultaneously in
119 * auditsc.c */ 113 * auditsc.c */
120static DECLARE_MUTEX(audit_netlink_sem); 114DECLARE_MUTEX(audit_netlink_sem);
121 115
122/* AUDIT_BUFSIZ is the size of the temporary buffer used for formatting 116/* AUDIT_BUFSIZ is the size of the temporary buffer used for formatting
123 * audit records. Since printk uses a 1024 byte buffer, this buffer 117 * audit records. Since printk uses a 1024 byte buffer, this buffer
@@ -137,6 +131,7 @@ struct audit_buffer {
137 struct list_head list; 131 struct list_head list;
138 struct sk_buff *skb; /* formatted skb ready to send */ 132 struct sk_buff *skb; /* formatted skb ready to send */
139 struct audit_context *ctx; /* NULL or associated context */ 133 struct audit_context *ctx; /* NULL or associated context */
134 int gfp_mask;
140}; 135};
141 136
142static void audit_set_pid(struct audit_buffer *ab, pid_t pid) 137static void audit_set_pid(struct audit_buffer *ab, pid_t pid)
@@ -233,7 +228,7 @@ static int audit_set_rate_limit(int limit, uid_t loginuid)
233{ 228{
234 int old = audit_rate_limit; 229 int old = audit_rate_limit;
235 audit_rate_limit = limit; 230 audit_rate_limit = limit;
236 audit_log(NULL, AUDIT_CONFIG_CHANGE, 231 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
237 "audit_rate_limit=%d old=%d by auid=%u", 232 "audit_rate_limit=%d old=%d by auid=%u",
238 audit_rate_limit, old, loginuid); 233 audit_rate_limit, old, loginuid);
239 return old; 234 return old;
@@ -243,7 +238,7 @@ static int audit_set_backlog_limit(int limit, uid_t loginuid)
243{ 238{
244 int old = audit_backlog_limit; 239 int old = audit_backlog_limit;
245 audit_backlog_limit = limit; 240 audit_backlog_limit = limit;
246 audit_log(NULL, AUDIT_CONFIG_CHANGE, 241 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
247 "audit_backlog_limit=%d old=%d by auid=%u", 242 "audit_backlog_limit=%d old=%d by auid=%u",
248 audit_backlog_limit, old, loginuid); 243 audit_backlog_limit, old, loginuid);
249 return old; 244 return old;
@@ -255,7 +250,7 @@ static int audit_set_enabled(int state, uid_t loginuid)
255 if (state != 0 && state != 1) 250 if (state != 0 && state != 1)
256 return -EINVAL; 251 return -EINVAL;
257 audit_enabled = state; 252 audit_enabled = state;
258 audit_log(NULL, AUDIT_CONFIG_CHANGE, 253 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
259 "audit_enabled=%d old=%d by auid=%u", 254 "audit_enabled=%d old=%d by auid=%u",
260 audit_enabled, old, loginuid); 255 audit_enabled, old, loginuid);
261 return old; 256 return old;
@@ -269,7 +264,7 @@ static int audit_set_failure(int state, uid_t loginuid)
269 && state != AUDIT_FAIL_PANIC) 264 && state != AUDIT_FAIL_PANIC)
270 return -EINVAL; 265 return -EINVAL;
271 audit_failure = state; 266 audit_failure = state;
272 audit_log(NULL, AUDIT_CONFIG_CHANGE, 267 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
273 "audit_failure=%d old=%d by auid=%u", 268 "audit_failure=%d old=%d by auid=%u",
274 audit_failure, old, loginuid); 269 audit_failure, old, loginuid);
275 return old; 270 return old;
@@ -281,6 +276,7 @@ int kauditd_thread(void *dummy)
281 276
282 while (1) { 277 while (1) {
283 skb = skb_dequeue(&audit_skb_queue); 278 skb = skb_dequeue(&audit_skb_queue);
279 wake_up(&audit_backlog_wait);
284 if (skb) { 280 if (skb) {
285 if (audit_pid) { 281 if (audit_pid) {
286 int err = netlink_unicast(audit_sock, skb, audit_pid, 0); 282 int err = netlink_unicast(audit_sock, skb, audit_pid, 0);
@@ -290,7 +286,7 @@ int kauditd_thread(void *dummy)
290 audit_pid = 0; 286 audit_pid = 0;
291 } 287 }
292 } else { 288 } else {
293 printk(KERN_ERR "%s\n", skb->data + NLMSG_SPACE(0)); 289 printk(KERN_NOTICE "%s\n", skb->data + NLMSG_SPACE(0));
294 kfree_skb(skb); 290 kfree_skb(skb);
295 } 291 }
296 } else { 292 } else {
@@ -423,7 +419,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
423 if (status_get->mask & AUDIT_STATUS_PID) { 419 if (status_get->mask & AUDIT_STATUS_PID) {
424 int old = audit_pid; 420 int old = audit_pid;
425 audit_pid = status_get->pid; 421 audit_pid = status_get->pid;
426 audit_log(NULL, AUDIT_CONFIG_CHANGE, 422 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
427 "audit_pid=%d old=%d by auid=%u", 423 "audit_pid=%d old=%d by auid=%u",
428 audit_pid, old, loginuid); 424 audit_pid, old, loginuid);
429 } 425 }
@@ -435,15 +431,21 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
435 break; 431 break;
436 case AUDIT_USER: 432 case AUDIT_USER:
437 case AUDIT_FIRST_USER_MSG...AUDIT_LAST_USER_MSG: 433 case AUDIT_FIRST_USER_MSG...AUDIT_LAST_USER_MSG:
438 ab = audit_log_start(NULL, msg_type); 434 if (!audit_enabled && msg_type != AUDIT_USER_AVC)
439 if (!ab) 435 return 0;
440 break; /* audit_panic has been called */ 436
441 audit_log_format(ab, 437 err = audit_filter_user(&NETLINK_CB(skb), msg_type);
442 "user pid=%d uid=%u auid=%u" 438 if (err == 1) {
443 " msg='%.1024s'", 439 err = 0;
444 pid, uid, loginuid, (char *)data); 440 ab = audit_log_start(NULL, GFP_KERNEL, msg_type);
445 audit_set_pid(ab, pid); 441 if (ab) {
446 audit_log_end(ab); 442 audit_log_format(ab,
443 "user pid=%d uid=%u auid=%u msg='%.1024s'",
444 pid, uid, loginuid, (char *)data);
445 audit_set_pid(ab, pid);
446 audit_log_end(ab);
447 }
448 }
447 break; 449 break;
448 case AUDIT_ADD: 450 case AUDIT_ADD:
449 case AUDIT_DEL: 451 case AUDIT_DEL:
@@ -522,7 +524,7 @@ static int __init audit_init(void)
522 skb_queue_head_init(&audit_skb_queue); 524 skb_queue_head_init(&audit_skb_queue);
523 audit_initialized = 1; 525 audit_initialized = 1;
524 audit_enabled = audit_default; 526 audit_enabled = audit_default;
525 audit_log(NULL, AUDIT_KERNEL, "initialized"); 527 audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized");
526 return 0; 528 return 0;
527} 529}
528__initcall(audit_init); 530__initcall(audit_init);
@@ -586,6 +588,7 @@ static struct audit_buffer * audit_buffer_alloc(struct audit_context *ctx,
586 goto err; 588 goto err;
587 589
588 ab->ctx = ctx; 590 ab->ctx = ctx;
591 ab->gfp_mask = gfp_mask;
589 nlh = (struct nlmsghdr *)skb_put(ab->skb, NLMSG_SPACE(0)); 592 nlh = (struct nlmsghdr *)skb_put(ab->skb, NLMSG_SPACE(0));
590 nlh->nlmsg_type = type; 593 nlh->nlmsg_type = type;
591 nlh->nlmsg_flags = 0; 594 nlh->nlmsg_flags = 0;
@@ -644,17 +647,42 @@ static inline void audit_get_stamp(struct audit_context *ctx,
644 * syscall, then the syscall is marked as auditable and an audit record 647 * syscall, then the syscall is marked as auditable and an audit record
645 * will be written at syscall exit. If there is no associated task, tsk 648 * will be written at syscall exit. If there is no associated task, tsk
646 * should be NULL. */ 649 * should be NULL. */
647struct audit_buffer *audit_log_start(struct audit_context *ctx, int type) 650
651struct audit_buffer *audit_log_start(struct audit_context *ctx, int gfp_mask,
652 int type)
648{ 653{
649 struct audit_buffer *ab = NULL; 654 struct audit_buffer *ab = NULL;
650 struct timespec t; 655 struct timespec t;
651 unsigned int serial; 656 unsigned int serial;
657 int reserve;
652 658
653 if (!audit_initialized) 659 if (!audit_initialized)
654 return NULL; 660 return NULL;
655 661
656 if (audit_backlog_limit 662 if (gfp_mask & __GFP_WAIT)
657 && skb_queue_len(&audit_skb_queue) > audit_backlog_limit) { 663 reserve = 0;
664 else
665 reserve = 5; /* Allow atomic callers to go up to five
666 entries over the normal backlog limit */
667
668 while (audit_backlog_limit
669 && skb_queue_len(&audit_skb_queue) > audit_backlog_limit + reserve) {
670 if (gfp_mask & __GFP_WAIT) {
671 int ret = 1;
672 /* Wait for auditd to drain the queue a little */
673 DECLARE_WAITQUEUE(wait, current);
674 set_current_state(TASK_INTERRUPTIBLE);
675 add_wait_queue(&audit_backlog_wait, &wait);
676
677 if (audit_backlog_limit &&
678 skb_queue_len(&audit_skb_queue) > audit_backlog_limit)
679 ret = schedule_timeout(HZ * 60);
680
681 __set_current_state(TASK_RUNNING);
682 remove_wait_queue(&audit_backlog_wait, &wait);
683 if (ret)
684 continue;
685 }
658 if (audit_rate_check()) 686 if (audit_rate_check())
659 printk(KERN_WARNING 687 printk(KERN_WARNING
660 "audit: audit_backlog=%d > " 688 "audit: audit_backlog=%d > "
@@ -665,7 +693,7 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, int type)
665 return NULL; 693 return NULL;
666 } 694 }
667 695
668 ab = audit_buffer_alloc(ctx, GFP_ATOMIC, type); 696 ab = audit_buffer_alloc(ctx, gfp_mask, type);
669 if (!ab) { 697 if (!ab) {
670 audit_log_lost("out of memory in audit_log_start"); 698 audit_log_lost("out of memory in audit_log_start");
671 return NULL; 699 return NULL;
@@ -689,7 +717,7 @@ static inline int audit_expand(struct audit_buffer *ab, int extra)
689{ 717{
690 struct sk_buff *skb = ab->skb; 718 struct sk_buff *skb = ab->skb;
691 int ret = pskb_expand_head(skb, skb_headroom(skb), extra, 719 int ret = pskb_expand_head(skb, skb_headroom(skb), extra,
692 GFP_ATOMIC); 720 ab->gfp_mask);
693 if (ret < 0) { 721 if (ret < 0) {
694 audit_log_lost("out of memory in audit_expand"); 722 audit_log_lost("out of memory in audit_expand");
695 return 0; 723 return 0;
@@ -808,7 +836,7 @@ void audit_log_d_path(struct audit_buffer *ab, const char *prefix,
808 audit_log_format(ab, " %s", prefix); 836 audit_log_format(ab, " %s", prefix);
809 837
810 /* We will allow 11 spaces for ' (deleted)' to be appended */ 838 /* We will allow 11 spaces for ' (deleted)' to be appended */
811 path = kmalloc(PATH_MAX+11, GFP_KERNEL); 839 path = kmalloc(PATH_MAX+11, ab->gfp_mask);
812 if (!path) { 840 if (!path) {
813 audit_log_format(ab, "<no memory>"); 841 audit_log_format(ab, "<no memory>");
814 return; 842 return;
@@ -840,7 +868,7 @@ void audit_log_end(struct audit_buffer *ab)
840 ab->skb = NULL; 868 ab->skb = NULL;
841 wake_up_interruptible(&kauditd_wait); 869 wake_up_interruptible(&kauditd_wait);
842 } else { 870 } else {
843 printk("%s\n", ab->skb->data + NLMSG_SPACE(0)); 871 printk(KERN_NOTICE "%s\n", ab->skb->data + NLMSG_SPACE(0));
844 } 872 }
845 } 873 }
846 audit_buffer_free(ab); 874 audit_buffer_free(ab);
@@ -849,12 +877,13 @@ void audit_log_end(struct audit_buffer *ab)
849/* Log an audit record. This is a convenience function that calls 877/* Log an audit record. This is a convenience function that calls
850 * audit_log_start, audit_log_vformat, and audit_log_end. It may be 878 * audit_log_start, audit_log_vformat, and audit_log_end. It may be
851 * called in any context. */ 879 * called in any context. */
852void audit_log(struct audit_context *ctx, int type, const char *fmt, ...) 880void audit_log(struct audit_context *ctx, int gfp_mask, int type,
881 const char *fmt, ...)
853{ 882{
854 struct audit_buffer *ab; 883 struct audit_buffer *ab;
855 va_list args; 884 va_list args;
856 885
857 ab = audit_log_start(ctx, type); 886 ab = audit_log_start(ctx, gfp_mask, type);
858 if (ab) { 887 if (ab) {
859 va_start(args, fmt); 888 va_start(args, fmt);
860 audit_log_vformat(ab, fmt, args); 889 audit_log_vformat(ab, fmt, args);
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index e75f84e1a1a0..34a990223c9e 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -39,6 +39,8 @@
39#include <linux/audit.h> 39#include <linux/audit.h>
40#include <linux/personality.h> 40#include <linux/personality.h>
41#include <linux/time.h> 41#include <linux/time.h>
42#include <linux/kthread.h>
43#include <linux/netlink.h>
42#include <asm/unistd.h> 44#include <asm/unistd.h>
43 45
44/* 0 = no checking 46/* 0 = no checking
@@ -95,6 +97,7 @@ struct audit_names {
95 uid_t uid; 97 uid_t uid;
96 gid_t gid; 98 gid_t gid;
97 dev_t rdev; 99 dev_t rdev;
100 unsigned flags;
98}; 101};
99 102
100struct audit_aux_data { 103struct audit_aux_data {
@@ -167,9 +170,16 @@ struct audit_context {
167/* There are three lists of rules -- one to search at task creation 170/* There are three lists of rules -- one to search at task creation
168 * time, one to search at syscall entry time, and another to search at 171 * time, one to search at syscall entry time, and another to search at
169 * syscall exit time. */ 172 * syscall exit time. */
170static LIST_HEAD(audit_tsklist); 173static struct list_head audit_filter_list[AUDIT_NR_FILTERS] = {
171static LIST_HEAD(audit_entlist); 174 LIST_HEAD_INIT(audit_filter_list[0]),
172static LIST_HEAD(audit_extlist); 175 LIST_HEAD_INIT(audit_filter_list[1]),
176 LIST_HEAD_INIT(audit_filter_list[2]),
177 LIST_HEAD_INIT(audit_filter_list[3]),
178 LIST_HEAD_INIT(audit_filter_list[4]),
179#if AUDIT_NR_FILTERS != 5
180#error Fix audit_filter_list initialiser
181#endif
182};
173 183
174struct audit_entry { 184struct audit_entry {
175 struct list_head list; 185 struct list_head list;
@@ -210,16 +220,15 @@ static int audit_compare_rule(struct audit_rule *a, struct audit_rule *b)
210/* Note that audit_add_rule and audit_del_rule are called via 220/* Note that audit_add_rule and audit_del_rule are called via
211 * audit_receive() in audit.c, and are protected by 221 * audit_receive() in audit.c, and are protected by
212 * audit_netlink_sem. */ 222 * audit_netlink_sem. */
213static inline int audit_add_rule(struct audit_entry *entry, 223static inline void audit_add_rule(struct audit_entry *entry,
214 struct list_head *list) 224 struct list_head *list)
215{ 225{
216 if (entry->rule.flags & AUDIT_PREPEND) { 226 if (entry->rule.flags & AUDIT_FILTER_PREPEND) {
217 entry->rule.flags &= ~AUDIT_PREPEND; 227 entry->rule.flags &= ~AUDIT_FILTER_PREPEND;
218 list_add_rcu(&entry->list, list); 228 list_add_rcu(&entry->list, list);
219 } else { 229 } else {
220 list_add_tail_rcu(&entry->list, list); 230 list_add_tail_rcu(&entry->list, list);
221 } 231 }
222 return 0;
223} 232}
224 233
225static void audit_free_rule(struct rcu_head *head) 234static void audit_free_rule(struct rcu_head *head)
@@ -245,7 +254,7 @@ static inline int audit_del_rule(struct audit_rule *rule,
245 return 0; 254 return 0;
246 } 255 }
247 } 256 }
248 return -EFAULT; /* No matching rule */ 257 return -ENOENT; /* No matching rule */
249} 258}
250 259
251/* Copy rule from user-space to kernel-space. Called during 260/* Copy rule from user-space to kernel-space. Called during
@@ -260,6 +269,8 @@ static int audit_copy_rule(struct audit_rule *d, struct audit_rule *s)
260 return -1; 269 return -1;
261 if (s->field_count < 0 || s->field_count > AUDIT_MAX_FIELDS) 270 if (s->field_count < 0 || s->field_count > AUDIT_MAX_FIELDS)
262 return -1; 271 return -1;
272 if ((s->flags & ~AUDIT_FILTER_PREPEND) >= AUDIT_NR_FILTERS)
273 return -1;
263 274
264 d->flags = s->flags; 275 d->flags = s->flags;
265 d->action = s->action; 276 d->action = s->action;
@@ -272,27 +283,60 @@ static int audit_copy_rule(struct audit_rule *d, struct audit_rule *s)
272 return 0; 283 return 0;
273} 284}
274 285
286static int audit_list_rules(void *_dest)
287{
288 int pid, seq;
289 int *dest = _dest;
290 struct audit_entry *entry;
291 int i;
292
293 pid = dest[0];
294 seq = dest[1];
295 kfree(dest);
296
297 down(&audit_netlink_sem);
298
299 /* The *_rcu iterators not needed here because we are
300 always called with audit_netlink_sem held. */
301 for (i=0; i<AUDIT_NR_FILTERS; i++) {
302 list_for_each_entry(entry, &audit_filter_list[i], list)
303 audit_send_reply(pid, seq, AUDIT_LIST, 0, 1,
304 &entry->rule, sizeof(entry->rule));
305 }
306 audit_send_reply(pid, seq, AUDIT_LIST, 1, 1, NULL, 0);
307
308 up(&audit_netlink_sem);
309 return 0;
310}
311
275int audit_receive_filter(int type, int pid, int uid, int seq, void *data, 312int audit_receive_filter(int type, int pid, int uid, int seq, void *data,
276 uid_t loginuid) 313 uid_t loginuid)
277{ 314{
278 u32 flags;
279 struct audit_entry *entry; 315 struct audit_entry *entry;
316 struct task_struct *tsk;
317 int *dest;
280 int err = 0; 318 int err = 0;
319 unsigned listnr;
281 320
282 switch (type) { 321 switch (type) {
283 case AUDIT_LIST: 322 case AUDIT_LIST:
284 /* The *_rcu iterators not needed here because we are 323 /* We can't just spew out the rules here because we might fill
285 always called with audit_netlink_sem held. */ 324 * the available socket buffer space and deadlock waiting for
286 list_for_each_entry(entry, &audit_tsklist, list) 325 * auditctl to read from it... which isn't ever going to
287 audit_send_reply(pid, seq, AUDIT_LIST, 0, 1, 326 * happen if we're actually running in the context of auditctl
288 &entry->rule, sizeof(entry->rule)); 327 * trying to _send_ the stuff */
289 list_for_each_entry(entry, &audit_entlist, list) 328
290 audit_send_reply(pid, seq, AUDIT_LIST, 0, 1, 329 dest = kmalloc(2 * sizeof(int), GFP_KERNEL);
291 &entry->rule, sizeof(entry->rule)); 330 if (!dest)
292 list_for_each_entry(entry, &audit_extlist, list) 331 return -ENOMEM;
293 audit_send_reply(pid, seq, AUDIT_LIST, 0, 1, 332 dest[0] = pid;
294 &entry->rule, sizeof(entry->rule)); 333 dest[1] = seq;
295 audit_send_reply(pid, seq, AUDIT_LIST, 1, 1, NULL, 0); 334
335 tsk = kthread_run(audit_list_rules, dest, "audit_list_rules");
336 if (IS_ERR(tsk)) {
337 kfree(dest);
338 err = PTR_ERR(tsk);
339 }
296 break; 340 break;
297 case AUDIT_ADD: 341 case AUDIT_ADD:
298 if (!(entry = kmalloc(sizeof(*entry), GFP_KERNEL))) 342 if (!(entry = kmalloc(sizeof(*entry), GFP_KERNEL)))
@@ -301,26 +345,20 @@ int audit_receive_filter(int type, int pid, int uid, int seq, void *data,
301 kfree(entry); 345 kfree(entry);
302 return -EINVAL; 346 return -EINVAL;
303 } 347 }
304 flags = entry->rule.flags; 348 listnr = entry->rule.flags & ~AUDIT_FILTER_PREPEND;
305 if (!err && (flags & AUDIT_PER_TASK)) 349 audit_add_rule(entry, &audit_filter_list[listnr]);
306 err = audit_add_rule(entry, &audit_tsklist); 350 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
307 if (!err && (flags & AUDIT_AT_ENTRY))
308 err = audit_add_rule(entry, &audit_entlist);
309 if (!err && (flags & AUDIT_AT_EXIT))
310 err = audit_add_rule(entry, &audit_extlist);
311 audit_log(NULL, AUDIT_CONFIG_CHANGE,
312 "auid=%u added an audit rule\n", loginuid); 351 "auid=%u added an audit rule\n", loginuid);
313 break; 352 break;
314 case AUDIT_DEL: 353 case AUDIT_DEL:
315 flags =((struct audit_rule *)data)->flags; 354 listnr =((struct audit_rule *)data)->flags & ~AUDIT_FILTER_PREPEND;
316 if (!err && (flags & AUDIT_PER_TASK)) 355 if (listnr >= AUDIT_NR_FILTERS)
317 err = audit_del_rule(data, &audit_tsklist); 356 return -EINVAL;
318 if (!err && (flags & AUDIT_AT_ENTRY)) 357
319 err = audit_del_rule(data, &audit_entlist); 358 err = audit_del_rule(data, &audit_filter_list[listnr]);
320 if (!err && (flags & AUDIT_AT_EXIT)) 359 if (!err)
321 err = audit_del_rule(data, &audit_extlist); 360 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
322 audit_log(NULL, AUDIT_CONFIG_CHANGE, 361 "auid=%u removed an audit rule\n", loginuid);
323 "auid=%u removed an audit rule\n", loginuid);
324 break; 362 break;
325 default: 363 default:
326 return -EINVAL; 364 return -EINVAL;
@@ -454,7 +492,7 @@ static enum audit_state audit_filter_task(struct task_struct *tsk)
454 enum audit_state state; 492 enum audit_state state;
455 493
456 rcu_read_lock(); 494 rcu_read_lock();
457 list_for_each_entry_rcu(e, &audit_tsklist, list) { 495 list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TASK], list) {
458 if (audit_filter_rules(tsk, &e->rule, NULL, &state)) { 496 if (audit_filter_rules(tsk, &e->rule, NULL, &state)) {
459 rcu_read_unlock(); 497 rcu_read_unlock();
460 return state; 498 return state;
@@ -478,6 +516,9 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk,
478 int word = AUDIT_WORD(ctx->major); 516 int word = AUDIT_WORD(ctx->major);
479 int bit = AUDIT_BIT(ctx->major); 517 int bit = AUDIT_BIT(ctx->major);
480 518
519 if (audit_pid && ctx->pid == audit_pid)
520 return AUDIT_DISABLED;
521
481 rcu_read_lock(); 522 rcu_read_lock();
482 list_for_each_entry_rcu(e, list, list) { 523 list_for_each_entry_rcu(e, list, list) {
483 if ((e->rule.mask[word] & bit) == bit 524 if ((e->rule.mask[word] & bit) == bit
@@ -490,6 +531,64 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk,
490 return AUDIT_BUILD_CONTEXT; 531 return AUDIT_BUILD_CONTEXT;
491} 532}
492 533
534static int audit_filter_user_rules(struct netlink_skb_parms *cb,
535 struct audit_rule *rule,
536 enum audit_state *state)
537{
538 int i;
539
540 for (i = 0; i < rule->field_count; i++) {
541 u32 field = rule->fields[i] & ~AUDIT_NEGATE;
542 u32 value = rule->values[i];
543 int result = 0;
544
545 switch (field) {
546 case AUDIT_PID:
547 result = (cb->creds.pid == value);
548 break;
549 case AUDIT_UID:
550 result = (cb->creds.uid == value);
551 break;
552 case AUDIT_GID:
553 result = (cb->creds.gid == value);
554 break;
555 case AUDIT_LOGINUID:
556 result = (cb->loginuid == value);
557 break;
558 }
559
560 if (rule->fields[i] & AUDIT_NEGATE)
561 result = !result;
562 if (!result)
563 return 0;
564 }
565 switch (rule->action) {
566 case AUDIT_NEVER: *state = AUDIT_DISABLED; break;
567 case AUDIT_POSSIBLE: *state = AUDIT_BUILD_CONTEXT; break;
568 case AUDIT_ALWAYS: *state = AUDIT_RECORD_CONTEXT; break;
569 }
570 return 1;
571}
572
573int audit_filter_user(struct netlink_skb_parms *cb, int type)
574{
575 struct audit_entry *e;
576 enum audit_state state;
577 int ret = 1;
578
579 rcu_read_lock();
580 list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_USER], list) {
581 if (audit_filter_user_rules(cb, &e->rule, &state)) {
582 if (state == AUDIT_DISABLED)
583 ret = 0;
584 break;
585 }
586 }
587 rcu_read_unlock();
588
589 return ret; /* Audit by default */
590}
591
493/* This should be called with task_lock() held. */ 592/* This should be called with task_lock() held. */
494static inline struct audit_context *audit_get_context(struct task_struct *tsk, 593static inline struct audit_context *audit_get_context(struct task_struct *tsk,
495 int return_valid, 594 int return_valid,
@@ -502,9 +601,9 @@ static inline struct audit_context *audit_get_context(struct task_struct *tsk,
502 context->return_valid = return_valid; 601 context->return_valid = return_valid;
503 context->return_code = return_code; 602 context->return_code = return_code;
504 603
505 if (context->in_syscall && !context->auditable) { 604 if (context->in_syscall && !context->auditable && tsk->pid != audit_pid) {
506 enum audit_state state; 605 enum audit_state state;
507 state = audit_filter_syscall(tsk, context, &audit_extlist); 606 state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_EXIT]);
508 if (state == AUDIT_RECORD_CONTEXT) 607 if (state == AUDIT_RECORD_CONTEXT)
509 context->auditable = 1; 608 context->auditable = 1;
510 } 609 }
@@ -685,7 +784,7 @@ static void audit_log_exit(struct audit_context *context)
685 struct audit_buffer *ab; 784 struct audit_buffer *ab;
686 struct audit_aux_data *aux; 785 struct audit_aux_data *aux;
687 786
688 ab = audit_log_start(context, AUDIT_SYSCALL); 787 ab = audit_log_start(context, GFP_KERNEL, AUDIT_SYSCALL);
689 if (!ab) 788 if (!ab)
690 return; /* audit_panic has been called */ 789 return; /* audit_panic has been called */
691 audit_log_format(ab, "arch=%x syscall=%d", 790 audit_log_format(ab, "arch=%x syscall=%d",
@@ -717,7 +816,7 @@ static void audit_log_exit(struct audit_context *context)
717 816
718 for (aux = context->aux; aux; aux = aux->next) { 817 for (aux = context->aux; aux; aux = aux->next) {
719 818
720 ab = audit_log_start(context, aux->type); 819 ab = audit_log_start(context, GFP_KERNEL, aux->type);
721 if (!ab) 820 if (!ab)
722 continue; /* audit_panic has been called */ 821 continue; /* audit_panic has been called */
723 822
@@ -754,14 +853,14 @@ static void audit_log_exit(struct audit_context *context)
754 } 853 }
755 854
756 if (context->pwd && context->pwdmnt) { 855 if (context->pwd && context->pwdmnt) {
757 ab = audit_log_start(context, AUDIT_CWD); 856 ab = audit_log_start(context, GFP_KERNEL, AUDIT_CWD);
758 if (ab) { 857 if (ab) {
759 audit_log_d_path(ab, "cwd=", context->pwd, context->pwdmnt); 858 audit_log_d_path(ab, "cwd=", context->pwd, context->pwdmnt);
760 audit_log_end(ab); 859 audit_log_end(ab);
761 } 860 }
762 } 861 }
763 for (i = 0; i < context->name_count; i++) { 862 for (i = 0; i < context->name_count; i++) {
764 ab = audit_log_start(context, AUDIT_PATH); 863 ab = audit_log_start(context, GFP_KERNEL, AUDIT_PATH);
765 if (!ab) 864 if (!ab)
766 continue; /* audit_panic has been called */ 865 continue; /* audit_panic has been called */
767 866
@@ -770,6 +869,8 @@ static void audit_log_exit(struct audit_context *context)
770 audit_log_format(ab, " name="); 869 audit_log_format(ab, " name=");
771 audit_log_untrustedstring(ab, context->names[i].name); 870 audit_log_untrustedstring(ab, context->names[i].name);
772 } 871 }
872 audit_log_format(ab, " flags=%x\n", context->names[i].flags);
873
773 if (context->names[i].ino != (unsigned long)-1) 874 if (context->names[i].ino != (unsigned long)-1)
774 audit_log_format(ab, " inode=%lu dev=%02x:%02x mode=%#o" 875 audit_log_format(ab, " inode=%lu dev=%02x:%02x mode=%#o"
775 " ouid=%u ogid=%u rdev=%02x:%02x", 876 " ouid=%u ogid=%u rdev=%02x:%02x",
@@ -800,7 +901,7 @@ void audit_free(struct task_struct *tsk)
800 901
801 /* Check for system calls that do not go through the exit 902 /* Check for system calls that do not go through the exit
802 * function (e.g., exit_group), then free context block. */ 903 * function (e.g., exit_group), then free context block. */
803 if (context->in_syscall && context->auditable && context->pid != audit_pid) 904 if (context->in_syscall && context->auditable)
804 audit_log_exit(context); 905 audit_log_exit(context);
805 906
806 audit_free_context(context); 907 audit_free_context(context);
@@ -876,7 +977,7 @@ void audit_syscall_entry(struct task_struct *tsk, int arch, int major,
876 977
877 state = context->state; 978 state = context->state;
878 if (state == AUDIT_SETUP_CONTEXT || state == AUDIT_BUILD_CONTEXT) 979 if (state == AUDIT_SETUP_CONTEXT || state == AUDIT_BUILD_CONTEXT)
879 state = audit_filter_syscall(tsk, context, &audit_entlist); 980 state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_ENTRY]);
880 if (likely(state == AUDIT_DISABLED)) 981 if (likely(state == AUDIT_DISABLED))
881 return; 982 return;
882 983
@@ -905,7 +1006,7 @@ void audit_syscall_exit(struct task_struct *tsk, int valid, long return_code)
905 if (likely(!context)) 1006 if (likely(!context))
906 return; 1007 return;
907 1008
908 if (context->in_syscall && context->auditable && context->pid != audit_pid) 1009 if (context->in_syscall && context->auditable)
909 audit_log_exit(context); 1010 audit_log_exit(context);
910 1011
911 context->in_syscall = 0; 1012 context->in_syscall = 0;
@@ -996,7 +1097,7 @@ void audit_putname(const char *name)
996 1097
997/* Store the inode and device from a lookup. Called from 1098/* Store the inode and device from a lookup. Called from
998 * fs/namei.c:path_lookup(). */ 1099 * fs/namei.c:path_lookup(). */
999void audit_inode(const char *name, const struct inode *inode) 1100void audit_inode(const char *name, const struct inode *inode, unsigned flags)
1000{ 1101{
1001 int idx; 1102 int idx;
1002 struct audit_context *context = current->audit_context; 1103 struct audit_context *context = current->audit_context;
@@ -1022,12 +1123,13 @@ void audit_inode(const char *name, const struct inode *inode)
1022 ++context->ino_count; 1123 ++context->ino_count;
1023#endif 1124#endif
1024 } 1125 }
1025 context->names[idx].ino = inode->i_ino; 1126 context->names[idx].flags = flags;
1026 context->names[idx].dev = inode->i_sb->s_dev; 1127 context->names[idx].ino = inode->i_ino;
1027 context->names[idx].mode = inode->i_mode; 1128 context->names[idx].dev = inode->i_sb->s_dev;
1028 context->names[idx].uid = inode->i_uid; 1129 context->names[idx].mode = inode->i_mode;
1029 context->names[idx].gid = inode->i_gid; 1130 context->names[idx].uid = inode->i_uid;
1030 context->names[idx].rdev = inode->i_rdev; 1131 context->names[idx].gid = inode->i_gid;
1132 context->names[idx].rdev = inode->i_rdev;
1031} 1133}
1032 1134
1033void auditsc_get_stamp(struct audit_context *ctx, 1135void auditsc_get_stamp(struct audit_context *ctx,
@@ -1044,7 +1146,7 @@ int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
1044 if (task->audit_context) { 1146 if (task->audit_context) {
1045 struct audit_buffer *ab; 1147 struct audit_buffer *ab;
1046 1148
1047 ab = audit_log_start(NULL, AUDIT_LOGIN); 1149 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_LOGIN);
1048 if (ab) { 1150 if (ab) {
1049 audit_log_format(ab, "login pid=%d uid=%u " 1151 audit_log_format(ab, "login pid=%d uid=%u "
1050 "old auid=%u new auid=%u", 1152 "old auid=%u new auid=%u",
diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index 451502467a9b..2d088bb65ee8 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -242,7 +242,7 @@ void __init avc_init(void)
242 avc_node_cachep = kmem_cache_create("avc_node", sizeof(struct avc_node), 242 avc_node_cachep = kmem_cache_create("avc_node", sizeof(struct avc_node),
243 0, SLAB_PANIC, NULL, NULL); 243 0, SLAB_PANIC, NULL, NULL);
244 244
245 audit_log(current->audit_context, AUDIT_KERNEL, "AVC INITIALIZED\n"); 245 audit_log(current->audit_context, GFP_KERNEL, AUDIT_KERNEL, "AVC INITIALIZED\n");
246} 246}
247 247
248int avc_get_hash_stats(char *page) 248int avc_get_hash_stats(char *page)
@@ -550,7 +550,7 @@ void avc_audit(u32 ssid, u32 tsid,
550 return; 550 return;
551 } 551 }
552 552
553 ab = audit_log_start(current->audit_context, AUDIT_AVC); 553 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_AVC);
554 if (!ab) 554 if (!ab)
555 return; /* audit_panic has been called */ 555 return; /* audit_panic has been called */
556 audit_log_format(ab, "avc: %s ", denied ? "denied" : "granted"); 556 audit_log_format(ab, "avc: %s ", denied ? "denied" : "granted");
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 6be273851144..5e755a3f4cae 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3441,7 +3441,7 @@ static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3441 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm); 3441 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3442 if (err) { 3442 if (err) {
3443 if (err == -EINVAL) { 3443 if (err == -EINVAL) {
3444 audit_log(current->audit_context, AUDIT_SELINUX_ERR, 3444 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3445 "SELinux: unrecognized netlink message" 3445 "SELinux: unrecognized netlink message"
3446 " type=%hu for sclass=%hu\n", 3446 " type=%hu for sclass=%hu\n",
3447 nlh->nlmsg_type, isec->sclass); 3447 nlh->nlmsg_type, isec->sclass);
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 922bb45054aa..bfa5a7dd6cf5 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -365,7 +365,7 @@ static int security_validtrans_handle_fail(struct context *ocontext,
365 goto out; 365 goto out;
366 if (context_struct_to_string(tcontext, &t, &tlen) < 0) 366 if (context_struct_to_string(tcontext, &t, &tlen) < 0)
367 goto out; 367 goto out;
368 audit_log(current->audit_context, AUDIT_SELINUX_ERR, 368 audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
369 "security_validate_transition: denied for" 369 "security_validate_transition: denied for"
370 " oldcontext=%s newcontext=%s taskcontext=%s tclass=%s", 370 " oldcontext=%s newcontext=%s taskcontext=%s tclass=%s",
371 o, n, t, policydb.p_class_val_to_name[tclass-1]); 371 o, n, t, policydb.p_class_val_to_name[tclass-1]);
@@ -742,7 +742,7 @@ static int compute_sid_handle_invalid_context(
742 goto out; 742 goto out;
743 if (context_struct_to_string(newcontext, &n, &nlen) < 0) 743 if (context_struct_to_string(newcontext, &n, &nlen) < 0)
744 goto out; 744 goto out;
745 audit_log(current->audit_context, AUDIT_SELINUX_ERR, 745 audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
746 "security_compute_sid: invalid context %s" 746 "security_compute_sid: invalid context %s"
747 " for scontext=%s" 747 " for scontext=%s"
748 " tcontext=%s" 748 " tcontext=%s"
generated by cgit v1.2.2 (git 2.25.0) at 2024-11-19 09:36:45 -0500