aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--MAINTAINERS5
-rw-r--r--fs/namei.c2
-rw-r--r--include/linux/audit.h36
-rw-r--r--kernel/audit.c123
-rw-r--r--kernel/auditsc.c231
-rw-r--r--security/selinux/avc.c4
-rw-r--r--security/selinux/hooks.c2
-rw-r--r--security/selinux/ss/services.c4
8 files changed, 281 insertions, 126 deletions
diff --git a/MAINTAINERS b/MAINTAINERS
index 48aa6d3d3ce9..aa257301d86b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -371,7 +371,10 @@ W: http://atmelwlandriver.sourceforge.net/
371S: Maintained 371S: Maintained
372 372
373AUDIT SUBSYSTEM 373AUDIT SUBSYSTEM
374L: linux-audit@redhat.com (subscribers-only) 374P: David Woodhouse
375M: dwmw2@infradead.org
376L: linux-audit@redhat.com
377W: http://people.redhat.com/sgrubb/audit/
375S: Maintained 378S: Maintained
376 379
377AX.25 NETWORK LAYER 380AX.25 NETWORK LAYER
diff --git a/fs/namei.c b/fs/namei.c
index 02a824cd3c5c..e252b12d39be 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1043,7 +1043,7 @@ int fastcall path_lookup(const char *name, unsigned int flags, struct nameidata
1043out: 1043out:
1044 if (unlikely(current->audit_context 1044 if (unlikely(current->audit_context
1045 && nd && nd->dentry && nd->dentry->d_inode)) 1045 && nd && nd->dentry && nd->dentry->d_inode))
1046 audit_inode(name, nd->dentry->d_inode); 1046 audit_inode(name, nd->dentry->d_inode, flags);
1047 return retval; 1047 return retval;
1048} 1048}
1049 1049
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 68aba0c02e49..b2a2509bd7ea 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -51,7 +51,8 @@
51#define AUDIT_WATCH_LIST 1009 /* List all file/dir watches */ 51#define AUDIT_WATCH_LIST 1009 /* List all file/dir watches */
52#define AUDIT_SIGNAL_INFO 1010 /* Get info about sender of signal to auditd */ 52#define AUDIT_SIGNAL_INFO 1010 /* Get info about sender of signal to auditd */
53 53
54#define AUDIT_FIRST_USER_MSG 1100 /* Userspace messages uninteresting to kernel */ 54#define AUDIT_FIRST_USER_MSG 1100 /* Userspace messages mostly uninteresting to kernel */
55#define AUDIT_USER_AVC 1107 /* We filter this differently */
55#define AUDIT_LAST_USER_MSG 1199 56#define AUDIT_LAST_USER_MSG 1199
56 57
57#define AUDIT_DAEMON_START 1200 /* Daemon startup record */ 58#define AUDIT_DAEMON_START 1200 /* Daemon startup record */
@@ -75,10 +76,15 @@
75#define AUDIT_KERNEL 2000 /* Asynchronous audit record. NOT A REQUEST. */ 76#define AUDIT_KERNEL 2000 /* Asynchronous audit record. NOT A REQUEST. */
76 77
77/* Rule flags */ 78/* Rule flags */
78#define AUDIT_PER_TASK 0x01 /* Apply rule at task creation (not syscall) */ 79#define AUDIT_FILTER_USER 0x00 /* Apply rule to user-generated messages */
79#define AUDIT_AT_ENTRY 0x02 /* Apply rule at syscall entry */ 80#define AUDIT_FILTER_TASK 0x01 /* Apply rule at task creation (not syscall) */
80#define AUDIT_AT_EXIT 0x04 /* Apply rule at syscall exit */ 81#define AUDIT_FILTER_ENTRY 0x02 /* Apply rule at syscall entry */
81#define AUDIT_PREPEND 0x10 /* Prepend to front of list */ 82#define AUDIT_FILTER_WATCH 0x03 /* Apply rule to file system watches */
83#define AUDIT_FILTER_EXIT 0x04 /* Apply rule at syscall exit */
84
85#define AUDIT_NR_FILTERS 5
86
87#define AUDIT_FILTER_PREPEND 0x10 /* Prepend to front of list */
82 88
83/* Rule actions */ 89/* Rule actions */
84#define AUDIT_NEVER 0 /* Do not build context if rule matches */ 90#define AUDIT_NEVER 0 /* Do not build context if rule matches */
@@ -199,6 +205,7 @@ struct audit_sig_info {
199struct audit_buffer; 205struct audit_buffer;
200struct audit_context; 206struct audit_context;
201struct inode; 207struct inode;
208struct netlink_skb_parms;
202 209
203#define AUDITSC_INVALID 0 210#define AUDITSC_INVALID 0
204#define AUDITSC_SUCCESS 1 211#define AUDITSC_SUCCESS 1
@@ -215,7 +222,7 @@ extern void audit_syscall_entry(struct task_struct *task, int arch,
215extern void audit_syscall_exit(struct task_struct *task, int failed, long return_code); 222extern void audit_syscall_exit(struct task_struct *task, int failed, long return_code);
216extern void audit_getname(const char *name); 223extern void audit_getname(const char *name);
217extern void audit_putname(const char *name); 224extern void audit_putname(const char *name);
218extern void audit_inode(const char *name, const struct inode *inode); 225extern void audit_inode(const char *name, const struct inode *inode, unsigned flags);
219 226
220 /* Private API (for audit.c only) */ 227 /* Private API (for audit.c only) */
221extern int audit_receive_filter(int type, int pid, int uid, int seq, 228extern int audit_receive_filter(int type, int pid, int uid, int seq,
@@ -230,6 +237,7 @@ extern int audit_socketcall(int nargs, unsigned long *args);
230extern int audit_sockaddr(int len, void *addr); 237extern int audit_sockaddr(int len, void *addr);
231extern int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt); 238extern int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt);
232extern void audit_signal_info(int sig, struct task_struct *t); 239extern void audit_signal_info(int sig, struct task_struct *t);
240extern int audit_filter_user(struct netlink_skb_parms *cb, int type);
233#else 241#else
234#define audit_alloc(t) ({ 0; }) 242#define audit_alloc(t) ({ 0; })
235#define audit_free(t) do { ; } while (0) 243#define audit_free(t) do { ; } while (0)
@@ -237,7 +245,7 @@ extern void audit_signal_info(int sig, struct task_struct *t);
237#define audit_syscall_exit(t,f,r) do { ; } while (0) 245#define audit_syscall_exit(t,f,r) do { ; } while (0)
238#define audit_getname(n) do { ; } while (0) 246#define audit_getname(n) do { ; } while (0)
239#define audit_putname(n) do { ; } while (0) 247#define audit_putname(n) do { ; } while (0)
240#define audit_inode(n,i) do { ; } while (0) 248#define audit_inode(n,i,f) do { ; } while (0)
241#define audit_receive_filter(t,p,u,s,d,l) ({ -EOPNOTSUPP; }) 249#define audit_receive_filter(t,p,u,s,d,l) ({ -EOPNOTSUPP; })
242#define auditsc_get_stamp(c,t,s) do { BUG(); } while (0) 250#define auditsc_get_stamp(c,t,s) do { BUG(); } while (0)
243#define audit_get_loginuid(c) ({ -1; }) 251#define audit_get_loginuid(c) ({ -1; })
@@ -246,16 +254,17 @@ extern void audit_signal_info(int sig, struct task_struct *t);
246#define audit_sockaddr(len, addr) ({ 0; }) 254#define audit_sockaddr(len, addr) ({ 0; })
247#define audit_avc_path(dentry, mnt) ({ 0; }) 255#define audit_avc_path(dentry, mnt) ({ 0; })
248#define audit_signal_info(s,t) do { ; } while (0) 256#define audit_signal_info(s,t) do { ; } while (0)
257#define audit_filter_user(cb,t) ({ 1; })
249#endif 258#endif
250 259
251#ifdef CONFIG_AUDIT 260#ifdef CONFIG_AUDIT
252/* These are defined in audit.c */ 261/* These are defined in audit.c */
253 /* Public API */ 262 /* Public API */
254extern void audit_log(struct audit_context *ctx, int type, 263extern void audit_log(struct audit_context *ctx, int gfp_mask,
255 const char *fmt, ...) 264 int type, const char *fmt, ...)
256 __attribute__((format(printf,3,4))); 265 __attribute__((format(printf,4,5)));
257 266
258extern struct audit_buffer *audit_log_start(struct audit_context *ctx,int type); 267extern struct audit_buffer *audit_log_start(struct audit_context *ctx, int gfp_mask, int type);
259extern void audit_log_format(struct audit_buffer *ab, 268extern void audit_log_format(struct audit_buffer *ab,
260 const char *fmt, ...) 269 const char *fmt, ...)
261 __attribute__((format(printf,2,3))); 270 __attribute__((format(printf,2,3)));
@@ -274,9 +283,10 @@ extern void audit_send_reply(int pid, int seq, int type,
274 int done, int multi, 283 int done, int multi,
275 void *payload, int size); 284 void *payload, int size);
276extern void audit_log_lost(const char *message); 285extern void audit_log_lost(const char *message);
286extern struct semaphore audit_netlink_sem;
277#else 287#else
278#define audit_log(c,t,f,...) do { ; } while (0) 288#define audit_log(c,g,t,f,...) do { ; } while (0)
279#define audit_log_start(c,t) ({ NULL; }) 289#define audit_log_start(c,g,t) ({ NULL; })
280#define audit_log_vformat(b,f,a) do { ; } while (0) 290#define audit_log_vformat(b,f,a) do { ; } while (0)
281#define audit_log_format(b,f,...) do { ; } while (0) 291#define audit_log_format(b,f,...) do { ; } while (0)
282#define audit_log_end(b) do { ; } while (0) 292#define audit_log_end(b) do { ; } while (0)
diff --git a/kernel/audit.c b/kernel/audit.c
index ef35166fdc29..d321e251d32b 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -79,6 +79,8 @@ static int audit_rate_limit;
79 79
80/* Number of outstanding audit_buffers allowed. */ 80/* Number of outstanding audit_buffers allowed. */
81static int audit_backlog_limit = 64; 81static int audit_backlog_limit = 64;
82static int audit_backlog_wait_time = 60 * HZ;
83static int audit_backlog_wait_overflow = 0;
82 84
83/* The identity of the user shutting down the audit system. */ 85/* The identity of the user shutting down the audit system. */
84uid_t audit_sig_uid = -1; 86uid_t audit_sig_uid = -1;
@@ -106,18 +108,12 @@ static LIST_HEAD(audit_freelist);
106static struct sk_buff_head audit_skb_queue; 108static struct sk_buff_head audit_skb_queue;
107static struct task_struct *kauditd_task; 109static struct task_struct *kauditd_task;
108static DECLARE_WAIT_QUEUE_HEAD(kauditd_wait); 110static DECLARE_WAIT_QUEUE_HEAD(kauditd_wait);
109 111static DECLARE_WAIT_QUEUE_HEAD(audit_backlog_wait);
110/* There are three lists of rules -- one to search at task creation
111 * time, one to search at syscall entry time, and another to search at
112 * syscall exit time. */
113static LIST_HEAD(audit_tsklist);
114static LIST_HEAD(audit_entlist);
115static LIST_HEAD(audit_extlist);
116 112
117/* The netlink socket is only to be read by 1 CPU, which lets us assume 113/* The netlink socket is only to be read by 1 CPU, which lets us assume
118 * that list additions and deletions never happen simultaneously in 114 * that list additions and deletions never happen simultaneously in
119 * auditsc.c */ 115 * auditsc.c */
120static DECLARE_MUTEX(audit_netlink_sem); 116DECLARE_MUTEX(audit_netlink_sem);
121 117
122/* AUDIT_BUFSIZ is the size of the temporary buffer used for formatting 118/* AUDIT_BUFSIZ is the size of the temporary buffer used for formatting
123 * audit records. Since printk uses a 1024 byte buffer, this buffer 119 * audit records. Since printk uses a 1024 byte buffer, this buffer
@@ -137,6 +133,7 @@ struct audit_buffer {
137 struct list_head list; 133 struct list_head list;
138 struct sk_buff *skb; /* formatted skb ready to send */ 134 struct sk_buff *skb; /* formatted skb ready to send */
139 struct audit_context *ctx; /* NULL or associated context */ 135 struct audit_context *ctx; /* NULL or associated context */
136 int gfp_mask;
140}; 137};
141 138
142static void audit_set_pid(struct audit_buffer *ab, pid_t pid) 139static void audit_set_pid(struct audit_buffer *ab, pid_t pid)
@@ -233,7 +230,7 @@ static int audit_set_rate_limit(int limit, uid_t loginuid)
233{ 230{
234 int old = audit_rate_limit; 231 int old = audit_rate_limit;
235 audit_rate_limit = limit; 232 audit_rate_limit = limit;
236 audit_log(NULL, AUDIT_CONFIG_CHANGE, 233 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
237 "audit_rate_limit=%d old=%d by auid=%u", 234 "audit_rate_limit=%d old=%d by auid=%u",
238 audit_rate_limit, old, loginuid); 235 audit_rate_limit, old, loginuid);
239 return old; 236 return old;
@@ -243,7 +240,7 @@ static int audit_set_backlog_limit(int limit, uid_t loginuid)
243{ 240{
244 int old = audit_backlog_limit; 241 int old = audit_backlog_limit;
245 audit_backlog_limit = limit; 242 audit_backlog_limit = limit;
246 audit_log(NULL, AUDIT_CONFIG_CHANGE, 243 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
247 "audit_backlog_limit=%d old=%d by auid=%u", 244 "audit_backlog_limit=%d old=%d by auid=%u",
248 audit_backlog_limit, old, loginuid); 245 audit_backlog_limit, old, loginuid);
249 return old; 246 return old;
@@ -255,7 +252,7 @@ static int audit_set_enabled(int state, uid_t loginuid)
255 if (state != 0 && state != 1) 252 if (state != 0 && state != 1)
256 return -EINVAL; 253 return -EINVAL;
257 audit_enabled = state; 254 audit_enabled = state;
258 audit_log(NULL, AUDIT_CONFIG_CHANGE, 255 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
259 "audit_enabled=%d old=%d by auid=%u", 256 "audit_enabled=%d old=%d by auid=%u",
260 audit_enabled, old, loginuid); 257 audit_enabled, old, loginuid);
261 return old; 258 return old;
@@ -269,7 +266,7 @@ static int audit_set_failure(int state, uid_t loginuid)
269 && state != AUDIT_FAIL_PANIC) 266 && state != AUDIT_FAIL_PANIC)
270 return -EINVAL; 267 return -EINVAL;
271 audit_failure = state; 268 audit_failure = state;
272 audit_log(NULL, AUDIT_CONFIG_CHANGE, 269 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
273 "audit_failure=%d old=%d by auid=%u", 270 "audit_failure=%d old=%d by auid=%u",
274 audit_failure, old, loginuid); 271 audit_failure, old, loginuid);
275 return old; 272 return old;
@@ -281,6 +278,7 @@ int kauditd_thread(void *dummy)
281 278
282 while (1) { 279 while (1) {
283 skb = skb_dequeue(&audit_skb_queue); 280 skb = skb_dequeue(&audit_skb_queue);
281 wake_up(&audit_backlog_wait);
284 if (skb) { 282 if (skb) {
285 if (audit_pid) { 283 if (audit_pid) {
286 int err = netlink_unicast(audit_sock, skb, audit_pid, 0); 284 int err = netlink_unicast(audit_sock, skb, audit_pid, 0);
@@ -290,7 +288,7 @@ int kauditd_thread(void *dummy)
290 audit_pid = 0; 288 audit_pid = 0;
291 } 289 }
292 } else { 290 } else {
293 printk(KERN_ERR "%s\n", skb->data + NLMSG_SPACE(0)); 291 printk(KERN_NOTICE "%s\n", skb->data + NLMSG_SPACE(0));
294 kfree_skb(skb); 292 kfree_skb(skb);
295 } 293 }
296 } else { 294 } else {
@@ -423,7 +421,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
423 if (status_get->mask & AUDIT_STATUS_PID) { 421 if (status_get->mask & AUDIT_STATUS_PID) {
424 int old = audit_pid; 422 int old = audit_pid;
425 audit_pid = status_get->pid; 423 audit_pid = status_get->pid;
426 audit_log(NULL, AUDIT_CONFIG_CHANGE, 424 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
427 "audit_pid=%d old=%d by auid=%u", 425 "audit_pid=%d old=%d by auid=%u",
428 audit_pid, old, loginuid); 426 audit_pid, old, loginuid);
429 } 427 }
@@ -435,15 +433,21 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
435 break; 433 break;
436 case AUDIT_USER: 434 case AUDIT_USER:
437 case AUDIT_FIRST_USER_MSG...AUDIT_LAST_USER_MSG: 435 case AUDIT_FIRST_USER_MSG...AUDIT_LAST_USER_MSG:
438 ab = audit_log_start(NULL, msg_type); 436 if (!audit_enabled && msg_type != AUDIT_USER_AVC)
439 if (!ab) 437 return 0;
440 break; /* audit_panic has been called */ 438
441 audit_log_format(ab, 439 err = audit_filter_user(&NETLINK_CB(skb), msg_type);
442 "user pid=%d uid=%u auid=%u" 440 if (err == 1) {
443 " msg='%.1024s'", 441 err = 0;
444 pid, uid, loginuid, (char *)data); 442 ab = audit_log_start(NULL, GFP_KERNEL, msg_type);
445 audit_set_pid(ab, pid); 443 if (ab) {
446 audit_log_end(ab); 444 audit_log_format(ab,
445 "user pid=%d uid=%u auid=%u msg='%.1024s'",
446 pid, uid, loginuid, (char *)data);
447 audit_set_pid(ab, pid);
448 audit_log_end(ab);
449 }
450 }
447 break; 451 break;
448 case AUDIT_ADD: 452 case AUDIT_ADD:
449 case AUDIT_DEL: 453 case AUDIT_DEL:
@@ -522,7 +526,7 @@ static int __init audit_init(void)
522 skb_queue_head_init(&audit_skb_queue); 526 skb_queue_head_init(&audit_skb_queue);
523 audit_initialized = 1; 527 audit_initialized = 1;
524 audit_enabled = audit_default; 528 audit_enabled = audit_default;
525 audit_log(NULL, AUDIT_KERNEL, "initialized"); 529 audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized");
526 return 0; 530 return 0;
527} 531}
528__initcall(audit_init); 532__initcall(audit_init);
@@ -560,7 +564,7 @@ static void audit_buffer_free(struct audit_buffer *ab)
560} 564}
561 565
562static struct audit_buffer * audit_buffer_alloc(struct audit_context *ctx, 566static struct audit_buffer * audit_buffer_alloc(struct audit_context *ctx,
563 int gfp_mask, int type) 567 unsigned int __nocast gfp_mask, int type)
564{ 568{
565 unsigned long flags; 569 unsigned long flags;
566 struct audit_buffer *ab = NULL; 570 struct audit_buffer *ab = NULL;
@@ -586,6 +590,7 @@ static struct audit_buffer * audit_buffer_alloc(struct audit_context *ctx,
586 goto err; 590 goto err;
587 591
588 ab->ctx = ctx; 592 ab->ctx = ctx;
593 ab->gfp_mask = gfp_mask;
589 nlh = (struct nlmsghdr *)skb_put(ab->skb, NLMSG_SPACE(0)); 594 nlh = (struct nlmsghdr *)skb_put(ab->skb, NLMSG_SPACE(0));
590 nlh->nlmsg_type = type; 595 nlh->nlmsg_type = type;
591 nlh->nlmsg_flags = 0; 596 nlh->nlmsg_flags = 0;
@@ -605,26 +610,27 @@ err:
605 * (timestamp,serial) tuple is unique for each syscall and is live from 610 * (timestamp,serial) tuple is unique for each syscall and is live from
606 * syscall entry to syscall exit. 611 * syscall entry to syscall exit.
607 * 612 *
608 * Atomic values are only guaranteed to be 24-bit, so we count down.
609 *
610 * NOTE: Another possibility is to store the formatted records off the 613 * NOTE: Another possibility is to store the formatted records off the
611 * audit context (for those records that have a context), and emit them 614 * audit context (for those records that have a context), and emit them
612 * all at syscall exit. However, this could delay the reporting of 615 * all at syscall exit. However, this could delay the reporting of
613 * significant errors until syscall exit (or never, if the system 616 * significant errors until syscall exit (or never, if the system
614 * halts). */ 617 * halts). */
618
615unsigned int audit_serial(void) 619unsigned int audit_serial(void)
616{ 620{
617 static atomic_t serial = ATOMIC_INIT(0xffffff); 621 static spinlock_t serial_lock = SPIN_LOCK_UNLOCKED;
618 unsigned int a, b; 622 static unsigned int serial = 0;
619 623
624 unsigned long flags;
625 unsigned int ret;
626
627 spin_lock_irqsave(&serial_lock, flags);
620 do { 628 do {
621 a = atomic_read(&serial); 629 ret = ++serial;
622 if (atomic_dec_and_test(&serial)) 630 } while (unlikely(!ret));
623 atomic_set(&serial, 0xffffff); 631 spin_unlock_irqrestore(&serial_lock, flags);
624 b = atomic_read(&serial);
625 } while (b != a - 1);
626 632
627 return 0xffffff - b; 633 return ret;
628} 634}
629 635
630static inline void audit_get_stamp(struct audit_context *ctx, 636static inline void audit_get_stamp(struct audit_context *ctx,
@@ -644,17 +650,43 @@ static inline void audit_get_stamp(struct audit_context *ctx,
644 * syscall, then the syscall is marked as auditable and an audit record 650 * syscall, then the syscall is marked as auditable and an audit record
645 * will be written at syscall exit. If there is no associated task, tsk 651 * will be written at syscall exit. If there is no associated task, tsk
646 * should be NULL. */ 652 * should be NULL. */
647struct audit_buffer *audit_log_start(struct audit_context *ctx, int type) 653
654struct audit_buffer *audit_log_start(struct audit_context *ctx, int gfp_mask,
655 int type)
648{ 656{
649 struct audit_buffer *ab = NULL; 657 struct audit_buffer *ab = NULL;
650 struct timespec t; 658 struct timespec t;
651 unsigned int serial; 659 unsigned int serial;
660 int reserve;
661 unsigned long timeout_start = jiffies;
652 662
653 if (!audit_initialized) 663 if (!audit_initialized)
654 return NULL; 664 return NULL;
655 665
656 if (audit_backlog_limit 666 if (gfp_mask & __GFP_WAIT)
657 && skb_queue_len(&audit_skb_queue) > audit_backlog_limit) { 667 reserve = 0;
668 else
669 reserve = 5; /* Allow atomic callers to go up to five
670 entries over the normal backlog limit */
671
672 while (audit_backlog_limit
673 && skb_queue_len(&audit_skb_queue) > audit_backlog_limit + reserve) {
674 if (gfp_mask & __GFP_WAIT && audit_backlog_wait_time
675 && time_before(jiffies, timeout_start + audit_backlog_wait_time)) {
676
677 /* Wait for auditd to drain the queue a little */
678 DECLARE_WAITQUEUE(wait, current);
679 set_current_state(TASK_INTERRUPTIBLE);
680 add_wait_queue(&audit_backlog_wait, &wait);
681
682 if (audit_backlog_limit &&
683 skb_queue_len(&audit_skb_queue) > audit_backlog_limit)
684 schedule_timeout(timeout_start + audit_backlog_wait_time - jiffies);
685
686 __set_current_state(TASK_RUNNING);
687 remove_wait_queue(&audit_backlog_wait, &wait);
688 continue;
689 }
658 if (audit_rate_check()) 690 if (audit_rate_check())
659 printk(KERN_WARNING 691 printk(KERN_WARNING
660 "audit: audit_backlog=%d > " 692 "audit: audit_backlog=%d > "
@@ -662,10 +694,12 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, int type)
662 skb_queue_len(&audit_skb_queue), 694 skb_queue_len(&audit_skb_queue),
663 audit_backlog_limit); 695 audit_backlog_limit);
664 audit_log_lost("backlog limit exceeded"); 696 audit_log_lost("backlog limit exceeded");
697 audit_backlog_wait_time = audit_backlog_wait_overflow;
698 wake_up(&audit_backlog_wait);
665 return NULL; 699 return NULL;
666 } 700 }
667 701
668 ab = audit_buffer_alloc(ctx, GFP_ATOMIC, type); 702 ab = audit_buffer_alloc(ctx, gfp_mask, type);
669 if (!ab) { 703 if (!ab) {
670 audit_log_lost("out of memory in audit_log_start"); 704 audit_log_lost("out of memory in audit_log_start");
671 return NULL; 705 return NULL;
@@ -689,7 +723,7 @@ static inline int audit_expand(struct audit_buffer *ab, int extra)
689{ 723{
690 struct sk_buff *skb = ab->skb; 724 struct sk_buff *skb = ab->skb;
691 int ret = pskb_expand_head(skb, skb_headroom(skb), extra, 725 int ret = pskb_expand_head(skb, skb_headroom(skb), extra,
692 GFP_ATOMIC); 726 ab->gfp_mask);
693 if (ret < 0) { 727 if (ret < 0) {
694 audit_log_lost("out of memory in audit_expand"); 728 audit_log_lost("out of memory in audit_expand");
695 return 0; 729 return 0;
@@ -808,7 +842,7 @@ void audit_log_d_path(struct audit_buffer *ab, const char *prefix,
808 audit_log_format(ab, " %s", prefix); 842 audit_log_format(ab, " %s", prefix);
809 843
810 /* We will allow 11 spaces for ' (deleted)' to be appended */ 844 /* We will allow 11 spaces for ' (deleted)' to be appended */
811 path = kmalloc(PATH_MAX+11, GFP_KERNEL); 845 path = kmalloc(PATH_MAX+11, ab->gfp_mask);
812 if (!path) { 846 if (!path) {
813 audit_log_format(ab, "<no memory>"); 847 audit_log_format(ab, "<no memory>");
814 return; 848 return;
@@ -840,7 +874,7 @@ void audit_log_end(struct audit_buffer *ab)
840 ab->skb = NULL; 874 ab->skb = NULL;
841 wake_up_interruptible(&kauditd_wait); 875 wake_up_interruptible(&kauditd_wait);
842 } else { 876 } else {
843 printk("%s\n", ab->skb->data + NLMSG_SPACE(0)); 877 printk(KERN_NOTICE "%s\n", ab->skb->data + NLMSG_SPACE(0));
844 } 878 }
845 } 879 }
846 audit_buffer_free(ab); 880 audit_buffer_free(ab);
@@ -849,12 +883,13 @@ void audit_log_end(struct audit_buffer *ab)
849/* Log an audit record. This is a convenience function that calls 883/* Log an audit record. This is a convenience function that calls
850 * audit_log_start, audit_log_vformat, and audit_log_end. It may be 884 * audit_log_start, audit_log_vformat, and audit_log_end. It may be
851 * called in any context. */ 885 * called in any context. */
852void audit_log(struct audit_context *ctx, int type, const char *fmt, ...) 886void audit_log(struct audit_context *ctx, int gfp_mask, int type,
887 const char *fmt, ...)
853{ 888{
854 struct audit_buffer *ab; 889 struct audit_buffer *ab;
855 va_list args; 890 va_list args;
856 891
857 ab = audit_log_start(ctx, type); 892 ab = audit_log_start(ctx, gfp_mask, type);
858 if (ab) { 893 if (ab) {
859 va_start(args, fmt); 894 va_start(args, fmt);
860 audit_log_vformat(ab, fmt, args); 895 audit_log_vformat(ab, fmt, args);
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index e75f84e1a1a0..46b45abceb9a 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -39,6 +39,9 @@
39#include <linux/audit.h> 39#include <linux/audit.h>
40#include <linux/personality.h> 40#include <linux/personality.h>
41#include <linux/time.h> 41#include <linux/time.h>
42#include <linux/kthread.h>
43#include <linux/netlink.h>
44#include <linux/compiler.h>
42#include <asm/unistd.h> 45#include <asm/unistd.h>
43 46
44/* 0 = no checking 47/* 0 = no checking
@@ -95,6 +98,7 @@ struct audit_names {
95 uid_t uid; 98 uid_t uid;
96 gid_t gid; 99 gid_t gid;
97 dev_t rdev; 100 dev_t rdev;
101 unsigned flags;
98}; 102};
99 103
100struct audit_aux_data { 104struct audit_aux_data {
@@ -167,9 +171,16 @@ struct audit_context {
167/* There are three lists of rules -- one to search at task creation 171/* There are three lists of rules -- one to search at task creation
168 * time, one to search at syscall entry time, and another to search at 172 * time, one to search at syscall entry time, and another to search at
169 * syscall exit time. */ 173 * syscall exit time. */
170static LIST_HEAD(audit_tsklist); 174static struct list_head audit_filter_list[AUDIT_NR_FILTERS] = {
171static LIST_HEAD(audit_entlist); 175 LIST_HEAD_INIT(audit_filter_list[0]),
172static LIST_HEAD(audit_extlist); 176 LIST_HEAD_INIT(audit_filter_list[1]),
177 LIST_HEAD_INIT(audit_filter_list[2]),
178 LIST_HEAD_INIT(audit_filter_list[3]),
179 LIST_HEAD_INIT(audit_filter_list[4]),
180#if AUDIT_NR_FILTERS != 5
181#error Fix audit_filter_list initialiser
182#endif
183};
173 184
174struct audit_entry { 185struct audit_entry {
175 struct list_head list; 186 struct list_head list;
@@ -210,16 +221,15 @@ static int audit_compare_rule(struct audit_rule *a, struct audit_rule *b)
210/* Note that audit_add_rule and audit_del_rule are called via 221/* Note that audit_add_rule and audit_del_rule are called via
211 * audit_receive() in audit.c, and are protected by 222 * audit_receive() in audit.c, and are protected by
212 * audit_netlink_sem. */ 223 * audit_netlink_sem. */
213static inline int audit_add_rule(struct audit_entry *entry, 224static inline void audit_add_rule(struct audit_entry *entry,
214 struct list_head *list) 225 struct list_head *list)
215{ 226{
216 if (entry->rule.flags & AUDIT_PREPEND) { 227 if (entry->rule.flags & AUDIT_FILTER_PREPEND) {
217 entry->rule.flags &= ~AUDIT_PREPEND; 228 entry->rule.flags &= ~AUDIT_FILTER_PREPEND;
218 list_add_rcu(&entry->list, list); 229 list_add_rcu(&entry->list, list);
219 } else { 230 } else {
220 list_add_tail_rcu(&entry->list, list); 231 list_add_tail_rcu(&entry->list, list);
221 } 232 }
222 return 0;
223} 233}
224 234
225static void audit_free_rule(struct rcu_head *head) 235static void audit_free_rule(struct rcu_head *head)
@@ -245,7 +255,7 @@ static inline int audit_del_rule(struct audit_rule *rule,
245 return 0; 255 return 0;
246 } 256 }
247 } 257 }
248 return -EFAULT; /* No matching rule */ 258 return -ENOENT; /* No matching rule */
249} 259}
250 260
251/* Copy rule from user-space to kernel-space. Called during 261/* Copy rule from user-space to kernel-space. Called during
@@ -260,6 +270,8 @@ static int audit_copy_rule(struct audit_rule *d, struct audit_rule *s)
260 return -1; 270 return -1;
261 if (s->field_count < 0 || s->field_count > AUDIT_MAX_FIELDS) 271 if (s->field_count < 0 || s->field_count > AUDIT_MAX_FIELDS)
262 return -1; 272 return -1;
273 if ((s->flags & ~AUDIT_FILTER_PREPEND) >= AUDIT_NR_FILTERS)
274 return -1;
263 275
264 d->flags = s->flags; 276 d->flags = s->flags;
265 d->action = s->action; 277 d->action = s->action;
@@ -272,27 +284,60 @@ static int audit_copy_rule(struct audit_rule *d, struct audit_rule *s)
272 return 0; 284 return 0;
273} 285}
274 286
287static int audit_list_rules(void *_dest)
288{
289 int pid, seq;
290 int *dest = _dest;
291 struct audit_entry *entry;
292 int i;
293
294 pid = dest[0];
295 seq = dest[1];
296 kfree(dest);
297
298 down(&audit_netlink_sem);
299
300 /* The *_rcu iterators not needed here because we are
301 always called with audit_netlink_sem held. */
302 for (i=0; i<AUDIT_NR_FILTERS; i++) {
303 list_for_each_entry(entry, &audit_filter_list[i], list)
304 audit_send_reply(pid, seq, AUDIT_LIST, 0, 1,
305 &entry->rule, sizeof(entry->rule));
306 }
307 audit_send_reply(pid, seq, AUDIT_LIST, 1, 1, NULL, 0);
308
309 up(&audit_netlink_sem);
310 return 0;
311}
312
275int audit_receive_filter(int type, int pid, int uid, int seq, void *data, 313int audit_receive_filter(int type, int pid, int uid, int seq, void *data,
276 uid_t loginuid) 314 uid_t loginuid)
277{ 315{
278 u32 flags;
279 struct audit_entry *entry; 316 struct audit_entry *entry;
317 struct task_struct *tsk;
318 int *dest;
280 int err = 0; 319 int err = 0;
320 unsigned listnr;
281 321
282 switch (type) { 322 switch (type) {
283 case AUDIT_LIST: 323 case AUDIT_LIST:
284 /* The *_rcu iterators not needed here because we are 324 /* We can't just spew out the rules here because we might fill
285 always called with audit_netlink_sem held. */ 325 * the available socket buffer space and deadlock waiting for
286 list_for_each_entry(entry, &audit_tsklist, list) 326 * auditctl to read from it... which isn't ever going to
287 audit_send_reply(pid, seq, AUDIT_LIST, 0, 1, 327 * happen if we're actually running in the context of auditctl
288 &entry->rule, sizeof(entry->rule)); 328 * trying to _send_ the stuff */
289 list_for_each_entry(entry, &audit_entlist, list) 329
290 audit_send_reply(pid, seq, AUDIT_LIST, 0, 1, 330 dest = kmalloc(2 * sizeof(int), GFP_KERNEL);
291 &entry->rule, sizeof(entry->rule)); 331 if (!dest)
292 list_for_each_entry(entry, &audit_extlist, list) 332 return -ENOMEM;
293 audit_send_reply(pid, seq, AUDIT_LIST, 0, 1, 333 dest[0] = pid;
294 &entry->rule, sizeof(entry->rule)); 334 dest[1] = seq;
295 audit_send_reply(pid, seq, AUDIT_LIST, 1, 1, NULL, 0); 335
336 tsk = kthread_run(audit_list_rules, dest, "audit_list_rules");
337 if (IS_ERR(tsk)) {
338 kfree(dest);
339 err = PTR_ERR(tsk);
340 }
296 break; 341 break;
297 case AUDIT_ADD: 342 case AUDIT_ADD:
298 if (!(entry = kmalloc(sizeof(*entry), GFP_KERNEL))) 343 if (!(entry = kmalloc(sizeof(*entry), GFP_KERNEL)))
@@ -301,26 +346,20 @@ int audit_receive_filter(int type, int pid, int uid, int seq, void *data,
301 kfree(entry); 346 kfree(entry);
302 return -EINVAL; 347 return -EINVAL;
303 } 348 }
304 flags = entry->rule.flags; 349 listnr = entry->rule.flags & ~AUDIT_FILTER_PREPEND;
305 if (!err && (flags & AUDIT_PER_TASK)) 350 audit_add_rule(entry, &audit_filter_list[listnr]);
306 err = audit_add_rule(entry, &audit_tsklist); 351 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
307 if (!err && (flags & AUDIT_AT_ENTRY))
308 err = audit_add_rule(entry, &audit_entlist);
309 if (!err && (flags & AUDIT_AT_EXIT))
310 err = audit_add_rule(entry, &audit_extlist);
311 audit_log(NULL, AUDIT_CONFIG_CHANGE,
312 "auid=%u added an audit rule\n", loginuid); 352 "auid=%u added an audit rule\n", loginuid);
313 break; 353 break;
314 case AUDIT_DEL: 354 case AUDIT_DEL:
315 flags =((struct audit_rule *)data)->flags; 355 listnr =((struct audit_rule *)data)->flags & ~AUDIT_FILTER_PREPEND;
316 if (!err && (flags & AUDIT_PER_TASK)) 356 if (listnr >= AUDIT_NR_FILTERS)
317 err = audit_del_rule(data, &audit_tsklist); 357 return -EINVAL;
318 if (!err && (flags & AUDIT_AT_ENTRY)) 358
319 err = audit_del_rule(data, &audit_entlist); 359 err = audit_del_rule(data, &audit_filter_list[listnr]);
320 if (!err && (flags & AUDIT_AT_EXIT)) 360 if (!err)
321 err = audit_del_rule(data, &audit_extlist); 361 audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
322 audit_log(NULL, AUDIT_CONFIG_CHANGE, 362 "auid=%u removed an audit rule\n", loginuid);
323 "auid=%u removed an audit rule\n", loginuid);
324 break; 363 break;
325 default: 364 default:
326 return -EINVAL; 365 return -EINVAL;
@@ -454,7 +493,7 @@ static enum audit_state audit_filter_task(struct task_struct *tsk)
454 enum audit_state state; 493 enum audit_state state;
455 494
456 rcu_read_lock(); 495 rcu_read_lock();
457 list_for_each_entry_rcu(e, &audit_tsklist, list) { 496 list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TASK], list) {
458 if (audit_filter_rules(tsk, &e->rule, NULL, &state)) { 497 if (audit_filter_rules(tsk, &e->rule, NULL, &state)) {
459 rcu_read_unlock(); 498 rcu_read_unlock();
460 return state; 499 return state;
@@ -478,6 +517,9 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk,
478 int word = AUDIT_WORD(ctx->major); 517 int word = AUDIT_WORD(ctx->major);
479 int bit = AUDIT_BIT(ctx->major); 518 int bit = AUDIT_BIT(ctx->major);
480 519
520 if (audit_pid && tsk->tgid == audit_pid)
521 return AUDIT_DISABLED;
522
481 rcu_read_lock(); 523 rcu_read_lock();
482 list_for_each_entry_rcu(e, list, list) { 524 list_for_each_entry_rcu(e, list, list) {
483 if ((e->rule.mask[word] & bit) == bit 525 if ((e->rule.mask[word] & bit) == bit
@@ -490,6 +532,64 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk,
490 return AUDIT_BUILD_CONTEXT; 532 return AUDIT_BUILD_CONTEXT;
491} 533}
492 534
535static int audit_filter_user_rules(struct netlink_skb_parms *cb,
536 struct audit_rule *rule,
537 enum audit_state *state)
538{
539 int i;
540
541 for (i = 0; i < rule->field_count; i++) {
542 u32 field = rule->fields[i] & ~AUDIT_NEGATE;
543 u32 value = rule->values[i];
544 int result = 0;
545
546 switch (field) {
547 case AUDIT_PID:
548 result = (cb->creds.pid == value);
549 break;
550 case AUDIT_UID:
551 result = (cb->creds.uid == value);
552 break;
553 case AUDIT_GID:
554 result = (cb->creds.gid == value);
555 break;
556 case AUDIT_LOGINUID:
557 result = (cb->loginuid == value);
558 break;
559 }
560
561 if (rule->fields[i] & AUDIT_NEGATE)
562 result = !result;
563 if (!result)
564 return 0;
565 }
566 switch (rule->action) {
567 case AUDIT_NEVER: *state = AUDIT_DISABLED; break;
568 case AUDIT_POSSIBLE: *state = AUDIT_BUILD_CONTEXT; break;
569 case AUDIT_ALWAYS: *state = AUDIT_RECORD_CONTEXT; break;
570 }
571 return 1;
572}
573
574int audit_filter_user(struct netlink_skb_parms *cb, int type)
575{
576 struct audit_entry *e;
577 enum audit_state state;
578 int ret = 1;
579
580 rcu_read_lock();
581 list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_USER], list) {
582 if (audit_filter_user_rules(cb, &e->rule, &state)) {
583 if (state == AUDIT_DISABLED)
584 ret = 0;
585 break;
586 }
587 }
588 rcu_read_unlock();
589
590 return ret; /* Audit by default */
591}
592
493/* This should be called with task_lock() held. */ 593/* This should be called with task_lock() held. */
494static inline struct audit_context *audit_get_context(struct task_struct *tsk, 594static inline struct audit_context *audit_get_context(struct task_struct *tsk,
495 int return_valid, 595 int return_valid,
@@ -504,7 +604,7 @@ static inline struct audit_context *audit_get_context(struct task_struct *tsk,
504 604
505 if (context->in_syscall && !context->auditable) { 605 if (context->in_syscall && !context->auditable) {
506 enum audit_state state; 606 enum audit_state state;
507 state = audit_filter_syscall(tsk, context, &audit_extlist); 607 state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_EXIT]);
508 if (state == AUDIT_RECORD_CONTEXT) 608 if (state == AUDIT_RECORD_CONTEXT)
509 context->auditable = 1; 609 context->auditable = 1;
510 } 610 }
@@ -679,13 +779,13 @@ static void audit_log_task_info(struct audit_buffer *ab)
679 up_read(&mm->mmap_sem); 779 up_read(&mm->mmap_sem);
680} 780}
681 781
682static void audit_log_exit(struct audit_context *context) 782static void audit_log_exit(struct audit_context *context, unsigned int gfp_mask)
683{ 783{
684 int i; 784 int i;
685 struct audit_buffer *ab; 785 struct audit_buffer *ab;
686 struct audit_aux_data *aux; 786 struct audit_aux_data *aux;
687 787
688 ab = audit_log_start(context, AUDIT_SYSCALL); 788 ab = audit_log_start(context, gfp_mask, AUDIT_SYSCALL);
689 if (!ab) 789 if (!ab)
690 return; /* audit_panic has been called */ 790 return; /* audit_panic has been called */
691 audit_log_format(ab, "arch=%x syscall=%d", 791 audit_log_format(ab, "arch=%x syscall=%d",
@@ -717,7 +817,7 @@ static void audit_log_exit(struct audit_context *context)
717 817
718 for (aux = context->aux; aux; aux = aux->next) { 818 for (aux = context->aux; aux; aux = aux->next) {
719 819
720 ab = audit_log_start(context, aux->type); 820 ab = audit_log_start(context, GFP_KERNEL, aux->type);
721 if (!ab) 821 if (!ab)
722 continue; /* audit_panic has been called */ 822 continue; /* audit_panic has been called */
723 823
@@ -754,14 +854,14 @@ static void audit_log_exit(struct audit_context *context)
754 } 854 }
755 855
756 if (context->pwd && context->pwdmnt) { 856 if (context->pwd && context->pwdmnt) {
757 ab = audit_log_start(context, AUDIT_CWD); 857 ab = audit_log_start(context, GFP_KERNEL, AUDIT_CWD);
758 if (ab) { 858 if (ab) {
759 audit_log_d_path(ab, "cwd=", context->pwd, context->pwdmnt); 859 audit_log_d_path(ab, "cwd=", context->pwd, context->pwdmnt);
760 audit_log_end(ab); 860 audit_log_end(ab);
761 } 861 }
762 } 862 }
763 for (i = 0; i < context->name_count; i++) { 863 for (i = 0; i < context->name_count; i++) {
764 ab = audit_log_start(context, AUDIT_PATH); 864 ab = audit_log_start(context, GFP_KERNEL, AUDIT_PATH);
765 if (!ab) 865 if (!ab)
766 continue; /* audit_panic has been called */ 866 continue; /* audit_panic has been called */
767 867
@@ -770,6 +870,8 @@ static void audit_log_exit(struct audit_context *context)
770 audit_log_format(ab, " name="); 870 audit_log_format(ab, " name=");
771 audit_log_untrustedstring(ab, context->names[i].name); 871 audit_log_untrustedstring(ab, context->names[i].name);
772 } 872 }
873 audit_log_format(ab, " flags=%x\n", context->names[i].flags);
874
773 if (context->names[i].ino != (unsigned long)-1) 875 if (context->names[i].ino != (unsigned long)-1)
774 audit_log_format(ab, " inode=%lu dev=%02x:%02x mode=%#o" 876 audit_log_format(ab, " inode=%lu dev=%02x:%02x mode=%#o"
775 " ouid=%u ogid=%u rdev=%02x:%02x", 877 " ouid=%u ogid=%u rdev=%02x:%02x",
@@ -799,9 +901,11 @@ void audit_free(struct task_struct *tsk)
799 return; 901 return;
800 902
801 /* Check for system calls that do not go through the exit 903 /* Check for system calls that do not go through the exit
802 * function (e.g., exit_group), then free context block. */ 904 * function (e.g., exit_group), then free context block.
803 if (context->in_syscall && context->auditable && context->pid != audit_pid) 905 * We use GFP_ATOMIC here because we might be doing this
804 audit_log_exit(context); 906 * in the context of the idle thread */
907 if (context->in_syscall && context->auditable)
908 audit_log_exit(context, GFP_ATOMIC);
805 909
806 audit_free_context(context); 910 audit_free_context(context);
807} 911}
@@ -876,11 +980,11 @@ void audit_syscall_entry(struct task_struct *tsk, int arch, int major,
876 980
877 state = context->state; 981 state = context->state;
878 if (state == AUDIT_SETUP_CONTEXT || state == AUDIT_BUILD_CONTEXT) 982 if (state == AUDIT_SETUP_CONTEXT || state == AUDIT_BUILD_CONTEXT)
879 state = audit_filter_syscall(tsk, context, &audit_entlist); 983 state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_ENTRY]);
880 if (likely(state == AUDIT_DISABLED)) 984 if (likely(state == AUDIT_DISABLED))
881 return; 985 return;
882 986
883 context->serial = audit_serial(); 987 context->serial = 0;
884 context->ctime = CURRENT_TIME; 988 context->ctime = CURRENT_TIME;
885 context->in_syscall = 1; 989 context->in_syscall = 1;
886 context->auditable = !!(state == AUDIT_RECORD_CONTEXT); 990 context->auditable = !!(state == AUDIT_RECORD_CONTEXT);
@@ -905,8 +1009,8 @@ void audit_syscall_exit(struct task_struct *tsk, int valid, long return_code)
905 if (likely(!context)) 1009 if (likely(!context))
906 return; 1010 return;
907 1011
908 if (context->in_syscall && context->auditable && context->pid != audit_pid) 1012 if (context->in_syscall && context->auditable)
909 audit_log_exit(context); 1013 audit_log_exit(context, GFP_KERNEL);
910 1014
911 context->in_syscall = 0; 1015 context->in_syscall = 0;
912 context->auditable = 0; 1016 context->auditable = 0;
@@ -996,7 +1100,7 @@ void audit_putname(const char *name)
996 1100
997/* Store the inode and device from a lookup. Called from 1101/* Store the inode and device from a lookup. Called from
998 * fs/namei.c:path_lookup(). */ 1102 * fs/namei.c:path_lookup(). */
999void audit_inode(const char *name, const struct inode *inode) 1103void audit_inode(const char *name, const struct inode *inode, unsigned flags)
1000{ 1104{
1001 int idx; 1105 int idx;
1002 struct audit_context *context = current->audit_context; 1106 struct audit_context *context = current->audit_context;
@@ -1022,17 +1126,20 @@ void audit_inode(const char *name, const struct inode *inode)
1022 ++context->ino_count; 1126 ++context->ino_count;
1023#endif 1127#endif
1024 } 1128 }
1025 context->names[idx].ino = inode->i_ino; 1129 context->names[idx].flags = flags;
1026 context->names[idx].dev = inode->i_sb->s_dev; 1130 context->names[idx].ino = inode->i_ino;
1027 context->names[idx].mode = inode->i_mode; 1131 context->names[idx].dev = inode->i_sb->s_dev;
1028 context->names[idx].uid = inode->i_uid; 1132 context->names[idx].mode = inode->i_mode;
1029 context->names[idx].gid = inode->i_gid; 1133 context->names[idx].uid = inode->i_uid;
1030 context->names[idx].rdev = inode->i_rdev; 1134 context->names[idx].gid = inode->i_gid;
1135 context->names[idx].rdev = inode->i_rdev;
1031} 1136}
1032 1137
1033void auditsc_get_stamp(struct audit_context *ctx, 1138void auditsc_get_stamp(struct audit_context *ctx,
1034 struct timespec *t, unsigned int *serial) 1139 struct timespec *t, unsigned int *serial)
1035{ 1140{
1141 if (!ctx->serial)
1142 ctx->serial = audit_serial();
1036 t->tv_sec = ctx->ctime.tv_sec; 1143 t->tv_sec = ctx->ctime.tv_sec;
1037 t->tv_nsec = ctx->ctime.tv_nsec; 1144 t->tv_nsec = ctx->ctime.tv_nsec;
1038 *serial = ctx->serial; 1145 *serial = ctx->serial;
@@ -1044,7 +1151,7 @@ int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
1044 if (task->audit_context) { 1151 if (task->audit_context) {
1045 struct audit_buffer *ab; 1152 struct audit_buffer *ab;
1046 1153
1047 ab = audit_log_start(NULL, AUDIT_LOGIN); 1154 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_LOGIN);
1048 if (ab) { 1155 if (ab) {
1049 audit_log_format(ab, "login pid=%d uid=%u " 1156 audit_log_format(ab, "login pid=%d uid=%u "
1050 "old auid=%u new auid=%u", 1157 "old auid=%u new auid=%u",
@@ -1153,7 +1260,7 @@ void audit_signal_info(int sig, struct task_struct *t)
1153 extern pid_t audit_sig_pid; 1260 extern pid_t audit_sig_pid;
1154 extern uid_t audit_sig_uid; 1261 extern uid_t audit_sig_uid;
1155 1262
1156 if (unlikely(audit_pid && t->pid == audit_pid)) { 1263 if (unlikely(audit_pid && t->tgid == audit_pid)) {
1157 if (sig == SIGTERM || sig == SIGHUP) { 1264 if (sig == SIGTERM || sig == SIGHUP) {
1158 struct audit_context *ctx = current->audit_context; 1265 struct audit_context *ctx = current->audit_context;
1159 audit_sig_pid = current->pid; 1266 audit_sig_pid = current->pid;
diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index 451502467a9b..2d088bb65ee8 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -242,7 +242,7 @@ void __init avc_init(void)
242 avc_node_cachep = kmem_cache_create("avc_node", sizeof(struct avc_node), 242 avc_node_cachep = kmem_cache_create("avc_node", sizeof(struct avc_node),
243 0, SLAB_PANIC, NULL, NULL); 243 0, SLAB_PANIC, NULL, NULL);
244 244
245 audit_log(current->audit_context, AUDIT_KERNEL, "AVC INITIALIZED\n"); 245 audit_log(current->audit_context, GFP_KERNEL, AUDIT_KERNEL, "AVC INITIALIZED\n");
246} 246}
247 247
248int avc_get_hash_stats(char *page) 248int avc_get_hash_stats(char *page)
@@ -550,7 +550,7 @@ void avc_audit(u32 ssid, u32 tsid,
550 return; 550 return;
551 } 551 }
552 552
553 ab = audit_log_start(current->audit_context, AUDIT_AVC); 553 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_AVC);
554 if (!ab) 554 if (!ab)
555 return; /* audit_panic has been called */ 555 return; /* audit_panic has been called */
556 audit_log_format(ab, "avc: %s ", denied ? "denied" : "granted"); 556 audit_log_format(ab, "avc: %s ", denied ? "denied" : "granted");
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 6be273851144..5e755a3f4cae 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3441,7 +3441,7 @@ static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3441 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm); 3441 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3442 if (err) { 3442 if (err) {
3443 if (err == -EINVAL) { 3443 if (err == -EINVAL) {
3444 audit_log(current->audit_context, AUDIT_SELINUX_ERR, 3444 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3445 "SELinux: unrecognized netlink message" 3445 "SELinux: unrecognized netlink message"
3446 " type=%hu for sclass=%hu\n", 3446 " type=%hu for sclass=%hu\n",
3447 nlh->nlmsg_type, isec->sclass); 3447 nlh->nlmsg_type, isec->sclass);
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 922bb45054aa..bfa5a7dd6cf5 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -365,7 +365,7 @@ static int security_validtrans_handle_fail(struct context *ocontext,
365 goto out; 365 goto out;
366 if (context_struct_to_string(tcontext, &t, &tlen) < 0) 366 if (context_struct_to_string(tcontext, &t, &tlen) < 0)
367 goto out; 367 goto out;
368 audit_log(current->audit_context, AUDIT_SELINUX_ERR, 368 audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
369 "security_validate_transition: denied for" 369 "security_validate_transition: denied for"
370 " oldcontext=%s newcontext=%s taskcontext=%s tclass=%s", 370 " oldcontext=%s newcontext=%s taskcontext=%s tclass=%s",
371 o, n, t, policydb.p_class_val_to_name[tclass-1]); 371 o, n, t, policydb.p_class_val_to_name[tclass-1]);
@@ -742,7 +742,7 @@ static int compute_sid_handle_invalid_context(
742 goto out; 742 goto out;
743 if (context_struct_to_string(newcontext, &n, &nlen) < 0) 743 if (context_struct_to_string(newcontext, &n, &nlen) < 0)
744 goto out; 744 goto out;
745 audit_log(current->audit_context, AUDIT_SELINUX_ERR, 745 audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
746 "security_compute_sid: invalid context %s" 746 "security_compute_sid: invalid context %s"
747 " for scontext=%s" 747 " for scontext=%s"
748 " tcontext=%s" 748 " tcontext=%s"
generated by cgit v1.2.2 (git 2.25.0) at 2025-11-07 18:36:50 -0500