5 files changed, 56 insertions, 10 deletions

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 19f04b049798..baa80760824c 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -28,14 +28,16 @@
 #include <linux/elf.h>
 
 /* Request and reply types */
-#define AUDIT_GET      1000     /* Get status */
-#define AUDIT_SET      1001     /* Set status (enable/disable/auditd) */
-#define AUDIT_LIST     1002     /* List filtering rules */
-#define AUDIT_ADD      1003     /* Add filtering rule */
-#define AUDIT_DEL      1004     /* Delete filtering rule */
-#define AUDIT_USER     1005     /* Send a message from user-space */
-#define AUDIT_LOGIN    1006     /* Define the login id and informaiton */
-#define AUDIT_KERNEL   2000     /* Asynchronous audit record. NOT A REQUEST. */
+#define AUDIT_GET               1000    /* Get status */
+#define AUDIT_SET               1001    /* Set status (enable/disable/auditd) */
+#define AUDIT_LIST              1002    /* List filtering rules */
+#define AUDIT_ADD               1003    /* Add filtering rule */
+#define AUDIT_DEL               1004    /* Delete filtering rule */
+#define AUDIT_USER              1005    /* Send a message from user-space */
+#define AUDIT_LOGIN             1006    /* Define the login id and information */
+#define AUDIT_SIGNAL_INFO       1010    /* Get information about sender of signal*/
+
+#define AUDIT_KERNEL            2000    /* Asynchronous audit record. NOT A REQUEST. */
 
 /* Rule flags */
 #define AUDIT_PER_TASK 0x01     /* Apply rule at task creation (not syscall) */
@@ -161,6 +163,11 @@ struct audit_rule {		/* for AUDIT_LIST, AUDIT_ADD, and AUDIT_DEL */
 
 #ifdef __KERNEL__
 
+struct audit_sig_info {
+        uid_t           uid;
+        pid_t           pid;
+};
+
 struct audit_buffer;
 struct audit_context;
 struct inode;
@@ -190,6 +197,7 @@ extern void audit_get_stamp(struct audit_context *ctx,
 extern int  audit_set_loginuid(struct task_struct *task, uid_t loginuid);
 extern uid_t audit_get_loginuid(struct audit_context *ctx);
 extern int audit_ipc_perms(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode);
+extern void audit_signal_info(int sig, struct task_struct *t);
 #else
 #define audit_alloc(t) ({ 0; })
 #define audit_free(t) do { ; } while (0)
@@ -200,6 +208,7 @@ extern int audit_ipc_perms(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mo
 #define audit_inode(n,i) do { ; } while (0)
 #define audit_get_loginuid(c) ({ -1; })
 #define audit_ipc_perms(q,u,g,m) ({ 0; })
+#define audit_signal_info(s,t) do { ; } while (0)
 #endif
 
 #ifdef CONFIG_AUDIT
diff --git a/kernel/audit.c b/kernel/audit.c
index 9c4f1af0c794..6f344b44d3d3 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -68,7 +68,7 @@ static int	audit_failure = AUDIT_FAIL_PRINTK;
 
 /* If audit records are to be written to the netlink socket, audit_pid
  * contains the (non-zero) pid. */
-static int      audit_pid;
+int             audit_pid;
 
 /* If audit_limit is non-zero, limit the rate of sending audit records
  * to that number per second.  This prevents DoS attacks, but results in
@@ -79,6 +79,10 @@ static int	audit_rate_limit;
 static int      audit_backlog_limit = 64;
 static atomic_t audit_backlog       = ATOMIC_INIT(0);
 
+/* The identity of the user shutting down the audit system. */
+uid_t           audit_sig_uid = -1;
+pid_t           audit_sig_pid = -1;
+
 /* Records can be lost in several ways:
    0) [suppressed in audit_alloc]
    1) out of memory in audit_log_start [kmalloc of struct audit_buffer]
@@ -321,6 +325,7 @@ static int audit_netlink_ok(kernel_cap_t eff_cap, u16 msg_type)
         case AUDIT_SET:
         case AUDIT_ADD:
         case AUDIT_DEL:
+        case AUDIT_SIGNAL_INFO:
                 if (!cap_raised(eff_cap, CAP_AUDIT_CONTROL))
                         err = -EPERM;
                 break;
@@ -344,6 +349,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
         struct audit_buffer     *ab;
         u16                     msg_type = nlh->nlmsg_type;
         uid_t                   loginuid; /* loginuid of sender */
+        struct audit_sig_info   sig_data;
 
         err = audit_netlink_ok(NETLINK_CB(skb).eff_cap, msg_type);
         if (err)
@@ -419,6 +425,12 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 err = -EOPNOTSUPP;
 #endif
                 break;
+        case AUDIT_SIGNAL_INFO:
+                sig_data.uid = audit_sig_uid;
+                sig_data.pid = audit_sig_pid;
+                audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_SIGNAL_INFO, 
+                                0, 0, &sig_data, sizeof(sig_data));
+                break;
         default:
                 err = -EINVAL;
                 break;
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 37b3ac94bc47..f1bf66510cd3 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1056,3 +1056,22 @@ int audit_ipc_perms(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode)
         context->aux = (void *)ax;
         return 0;
 }
+
+void audit_signal_info(int sig, struct task_struct *t)
+{
+        extern pid_t audit_sig_pid;
+        extern uid_t audit_sig_uid;
+        extern int audit_pid;
+
+        if (unlikely(audit_pid && t->pid == audit_pid)) {
+                if (sig == SIGTERM || sig == SIGHUP) {
+                        struct audit_context *ctx = current->audit_context;
+                        audit_sig_pid = current->pid;
+                        if (ctx)
+                                audit_sig_uid = ctx->loginuid;
+                        else
+                                audit_sig_uid = current->uid;
+                }
+        }
+}
+
diff --git a/kernel/signal.c b/kernel/signal.c
index 8f3debc77c5b..293e189d8bc3 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -24,6 +24,7 @@
 #include <linux/ptrace.h>
 #include <linux/posix-timers.h>
 #include <linux/signal.h>
+#include <linux/audit.h>
 #include <asm/param.h>
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
@@ -658,7 +659,11 @@ static int check_kill_permission(int sig, struct siginfo *info,
             && (current->uid ^ t->suid) && (current->uid ^ t->uid)
             && !capable(CAP_KILL))
                 return error;
-        return security_task_kill(t, info, sig);
+
+        error = security_task_kill(t, info, sig);
+        if (!error)
+                audit_signal_info(sig, t); /* Let audit system see the signal */
+        return error;
 }
 
 /* forward decl */
diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
index b3adb481bc25..deac14367d43 100644
--- a/security/selinux/nlmsgtab.c
+++ b/security/selinux/nlmsgtab.c
@@ -97,6 +97,7 @@ static struct nlmsg_perm nlmsg_audit_perms[] =
         { AUDIT_ADD,            NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
         { AUDIT_DEL,            NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
         { AUDIT_USER,           NETLINK_AUDIT_SOCKET__NLMSG_RELAY    },
+        { AUDIT_SIGNAL_INFO,    NETLINK_AUDIT_SOCKET__NLMSG_READ     },
 };