1 files changed, 16 insertions, 3 deletions

diff --git a/ipc/shm.c b/ipc/shm.c
index 1c2faf62bc73..809896851902 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -13,6 +13,8 @@
  * Shared /dev/zero support, Kanoj Sarcar <kanoj@sgi.com>
  * Move the mm functionality over to mm/shmem.c, Christoph Rohland <cr@sap.com>
  *
+ * support for audit of ipc object properties and permission changes
+ * Dustin Kirkland <dustin.kirkland@us.ibm.com>
  */
 
 #include <linux/config.h>
@@ -542,6 +544,10 @@ asmlinkage long sys_shmctl (int shmid, int cmd, struct shmid_ds __user *buf)
                 if(err)
                         goto out_unlock;
 
+                err = audit_ipc_obj(&(shp->shm_perm));
+                if (err)
+                        goto out_unlock;
+
                 if (!capable(CAP_IPC_LOCK)) {
                         err = -EPERM;
                         if (current->euid != shp->shm_perm.uid &&
@@ -594,6 +600,10 @@ asmlinkage long sys_shmctl (int shmid, int cmd, struct shmid_ds __user *buf)
                 if(err)
                         goto out_unlock_up;
 
+                err = audit_ipc_obj(&(shp->shm_perm));
+                if (err)
+                        goto out_unlock_up;
+
                 if (current->euid != shp->shm_perm.uid &&
                     current->euid != shp->shm_perm.cuid && 
                     !capable(CAP_SYS_ADMIN)) {
@@ -627,12 +637,15 @@ asmlinkage long sys_shmctl (int shmid, int cmd, struct shmid_ds __user *buf)
                 err=-EINVAL;
                 if(shp==NULL)
                         goto out_up;
-                if ((err = audit_ipc_perms(0, setbuf.uid, setbuf.gid,
-                                        setbuf.mode, &(shp->shm_perm))))
-                        goto out_unlock_up;
                 err = shm_checkid(shp,shmid);
                 if(err)
                         goto out_unlock_up;
+                err = audit_ipc_obj(&(shp->shm_perm));
+                if (err)
+                        goto out_unlock_up;
+                err = audit_ipc_set_perm(0, setbuf.uid, setbuf.gid, setbuf.mode, &(shp->shm_perm));
+                if (err)
+                        goto out_unlock_up;
                 err=-EPERM;
                 if (current->euid != shp->shm_perm.uid &&
                     current->euid != shp->shm_perm.cuid &&