diff options
| -rw-r--r-- | include/linux/audit.h | 2 | ||||
| -rw-r--r-- | kernel/auditsc.c | 47 | ||||
| -rw-r--r-- | security/selinux/avc.c | 15 |
3 files changed, 8 insertions, 56 deletions
diff --git a/include/linux/audit.h b/include/linux/audit.h index a35859ab2fdb..4bbd8601b8f0 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h | |||
| @@ -411,7 +411,6 @@ extern int audit_bprm(struct linux_binprm *bprm); | |||
| 411 | extern int audit_socketcall(int nargs, unsigned long *args); | 411 | extern int audit_socketcall(int nargs, unsigned long *args); |
| 412 | extern int audit_sockaddr(int len, void *addr); | 412 | extern int audit_sockaddr(int len, void *addr); |
| 413 | extern int __audit_fd_pair(int fd1, int fd2); | 413 | extern int __audit_fd_pair(int fd1, int fd2); |
| 414 | extern int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt); | ||
| 415 | extern int audit_set_macxattr(const char *name); | 414 | extern int audit_set_macxattr(const char *name); |
| 416 | extern int __audit_mq_open(int oflag, mode_t mode, struct mq_attr __user *u_attr); | 415 | extern int __audit_mq_open(int oflag, mode_t mode, struct mq_attr __user *u_attr); |
| 417 | extern int __audit_mq_timedsend(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec __user *u_abs_timeout); | 416 | extern int __audit_mq_timedsend(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec __user *u_abs_timeout); |
| @@ -491,7 +490,6 @@ extern int audit_signals; | |||
| 491 | #define audit_socketcall(n,a) ({ 0; }) | 490 | #define audit_socketcall(n,a) ({ 0; }) |
| 492 | #define audit_fd_pair(n,a) ({ 0; }) | 491 | #define audit_fd_pair(n,a) ({ 0; }) |
| 493 | #define audit_sockaddr(len, addr) ({ 0; }) | 492 | #define audit_sockaddr(len, addr) ({ 0; }) |
| 494 | #define audit_avc_path(dentry, mnt) ({ 0; }) | ||
| 495 | #define audit_set_macxattr(n) do { ; } while (0) | 493 | #define audit_set_macxattr(n) do { ; } while (0) |
| 496 | #define audit_mq_open(o,m,a) ({ 0; }) | 494 | #define audit_mq_open(o,m,a) ({ 0; }) |
| 497 | #define audit_mq_timedsend(d,l,p,t) ({ 0; }) | 495 | #define audit_mq_timedsend(d,l,p,t) ({ 0; }) |
diff --git a/kernel/auditsc.c b/kernel/auditsc.c index f5e917e60ac2..bde1124d5908 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c | |||
| @@ -173,12 +173,6 @@ struct audit_aux_data_fd_pair { | |||
| 173 | int fd[2]; | 173 | int fd[2]; |
| 174 | }; | 174 | }; |
| 175 | 175 | ||
| 176 | struct audit_aux_data_path { | ||
| 177 | struct audit_aux_data d; | ||
| 178 | struct dentry *dentry; | ||
| 179 | struct vfsmount *mnt; | ||
| 180 | }; | ||
| 181 | |||
| 182 | struct audit_aux_data_pids { | 176 | struct audit_aux_data_pids { |
| 183 | struct audit_aux_data d; | 177 | struct audit_aux_data d; |
| 184 | pid_t target_pid[AUDIT_AUX_PIDS]; | 178 | pid_t target_pid[AUDIT_AUX_PIDS]; |
| @@ -654,12 +648,6 @@ static inline void audit_free_aux(struct audit_context *context) | |||
| 654 | struct audit_aux_data *aux; | 648 | struct audit_aux_data *aux; |
| 655 | 649 | ||
| 656 | while ((aux = context->aux)) { | 650 | while ((aux = context->aux)) { |
| 657 | if (aux->type == AUDIT_AVC_PATH) { | ||
| 658 | struct audit_aux_data_path *axi = (void *)aux; | ||
| 659 | dput(axi->dentry); | ||
| 660 | mntput(axi->mnt); | ||
| 661 | } | ||
| 662 | |||
| 663 | context->aux = aux->next; | 651 | context->aux = aux->next; |
| 664 | kfree(aux); | 652 | kfree(aux); |
| 665 | } | 653 | } |
| @@ -1038,11 +1026,6 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts | |||
| 1038 | audit_log_hex(ab, axs->a, axs->len); | 1026 | audit_log_hex(ab, axs->a, axs->len); |
| 1039 | break; } | 1027 | break; } |
| 1040 | 1028 | ||
| 1041 | case AUDIT_AVC_PATH: { | ||
| 1042 | struct audit_aux_data_path *axi = (void *)aux; | ||
| 1043 | audit_log_d_path(ab, "path=", axi->dentry, axi->mnt); | ||
| 1044 | break; } | ||
| 1045 | |||
| 1046 | case AUDIT_FD_PAIR: { | 1029 | case AUDIT_FD_PAIR: { |
| 1047 | struct audit_aux_data_fd_pair *axs = (void *)aux; | 1030 | struct audit_aux_data_fd_pair *axs = (void *)aux; |
| 1048 | audit_log_format(ab, "fd0=%d fd1=%d", axs->fd[0], axs->fd[1]); | 1031 | audit_log_format(ab, "fd0=%d fd1=%d", axs->fd[0], axs->fd[1]); |
| @@ -1991,36 +1974,6 @@ void __audit_ptrace(struct task_struct *t) | |||
| 1991 | } | 1974 | } |
| 1992 | 1975 | ||
| 1993 | /** | 1976 | /** |
| 1994 | * audit_avc_path - record the granting or denial of permissions | ||
| 1995 | * @dentry: dentry to record | ||
| 1996 | * @mnt: mnt to record | ||
| 1997 | * | ||
| 1998 | * Returns 0 for success or NULL context or < 0 on error. | ||
| 1999 | * | ||
| 2000 | * Called from security/selinux/avc.c::avc_audit() | ||
| 2001 | */ | ||
| 2002 | int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt) | ||
| 2003 | { | ||
| 2004 | struct audit_aux_data_path *ax; | ||
| 2005 | struct audit_context *context = current->audit_context; | ||
| 2006 | |||
| 2007 | if (likely(!context)) | ||
| 2008 | return 0; | ||
| 2009 | |||
| 2010 | ax = kmalloc(sizeof(*ax), GFP_ATOMIC); | ||
| 2011 | if (!ax) | ||
| 2012 | return -ENOMEM; | ||
| 2013 | |||
| 2014 | ax->dentry = dget(dentry); | ||
| 2015 | ax->mnt = mntget(mnt); | ||
| 2016 | |||
| 2017 | ax->d.type = AUDIT_AVC_PATH; | ||
| 2018 | ax->d.next = context->aux; | ||
| 2019 | context->aux = (void *)ax; | ||
| 2020 | return 0; | ||
| 2021 | } | ||
| 2022 | |||
| 2023 | /** | ||
| 2024 | * audit_signal_info - record signal info for shutting down audit subsystem | 1977 | * audit_signal_info - record signal info for shutting down audit subsystem |
| 2025 | * @sig: signal value | 1978 | * @sig: signal value |
| 2026 | * @t: task being signaled | 1979 | * @t: task being signaled |
diff --git a/security/selinux/avc.c b/security/selinux/avc.c index ecd067384531..0e69adf63bdb 100644 --- a/security/selinux/avc.c +++ b/security/selinux/avc.c | |||
| @@ -570,10 +570,12 @@ void avc_audit(u32 ssid, u32 tsid, | |||
| 570 | case AVC_AUDIT_DATA_FS: | 570 | case AVC_AUDIT_DATA_FS: |
| 571 | if (a->u.fs.dentry) { | 571 | if (a->u.fs.dentry) { |
| 572 | struct dentry *dentry = a->u.fs.dentry; | 572 | struct dentry *dentry = a->u.fs.dentry; |
| 573 | if (a->u.fs.mnt) | 573 | if (a->u.fs.mnt) { |
| 574 | audit_avc_path(dentry, a->u.fs.mnt); | 574 | audit_log_d_path(ab, "path=", dentry, a->u.fs.mnt); |
| 575 | audit_log_format(ab, " name="); | 575 | } else { |
| 576 | audit_log_untrustedstring(ab, dentry->d_name.name); | 576 | audit_log_format(ab, " name="); |
| 577 | audit_log_untrustedstring(ab, dentry->d_name.name); | ||
| 578 | } | ||
| 577 | inode = dentry->d_inode; | 579 | inode = dentry->d_inode; |
| 578 | } else if (a->u.fs.inode) { | 580 | } else if (a->u.fs.inode) { |
| 579 | struct dentry *dentry; | 581 | struct dentry *dentry; |
| @@ -624,9 +626,8 @@ void avc_audit(u32 ssid, u32 tsid, | |||
| 624 | case AF_UNIX: | 626 | case AF_UNIX: |
| 625 | u = unix_sk(sk); | 627 | u = unix_sk(sk); |
| 626 | if (u->dentry) { | 628 | if (u->dentry) { |
| 627 | audit_avc_path(u->dentry, u->mnt); | 629 | audit_log_d_path(ab, "path=", |
| 628 | audit_log_format(ab, " name="); | 630 | u->dentry, u->mnt); |
| 629 | audit_log_untrustedstring(ab, u->dentry->d_name.name); | ||
| 630 | break; | 631 | break; |
| 631 | } | 632 | } |
| 632 | if (!u->addr) | 633 | if (!u->addr) |
