1 files changed, 88 insertions, 8 deletions

diff --git a/kernel/audit.c b/kernel/audit.c
index d13276d41410..5ce8851facf7 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -58,6 +58,7 @@
 #include <linux/selinux.h>
 #include <linux/inotify.h>
 #include <linux/freezer.h>
+#include <linux/tty.h>
 
 #include "audit.h"
 
@@ -423,6 +424,31 @@ static int kauditd_thread(void *dummy)
         return 0;
 }
 
+static int audit_prepare_user_tty(pid_t pid, uid_t loginuid)
+{
+        struct task_struct *tsk;
+        int err;
+
+        read_lock(&tasklist_lock);
+        tsk = find_task_by_pid(pid);
+        err = -ESRCH;
+        if (!tsk)
+                goto out;
+        err = 0;
+
+        spin_lock_irq(&tsk->sighand->siglock);
+        if (!tsk->signal->audit_tty)
+                err = -EPERM;
+        spin_unlock_irq(&tsk->sighand->siglock);
+        if (err)
+                goto out;
+
+        tty_audit_push_task(tsk, loginuid);
+out:
+        read_unlock(&tasklist_lock);
+        return err;
+}
+
 int audit_send_list(void *_dest)
 {
         struct audit_netlink_list *dest = _dest;
@@ -511,6 +537,8 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
         case AUDIT_DEL:
         case AUDIT_DEL_RULE:
         case AUDIT_SIGNAL_INFO:
+        case AUDIT_TTY_GET:
+        case AUDIT_TTY_SET:
                 if (security_netlink_recv(skb, CAP_AUDIT_CONTROL))
                         err = -EPERM;
                 break;
@@ -622,6 +650,11 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 err = audit_filter_user(&NETLINK_CB(skb), msg_type);
                 if (err == 1) {
                         err = 0;
+                        if (msg_type == AUDIT_USER_TTY) {
+                                err = audit_prepare_user_tty(pid, loginuid);
+                                if (err)
+                                        break;
+                        }
                         ab = audit_log_start(NULL, GFP_KERNEL, msg_type);
                         if (ab) {
                                 audit_log_format(ab,
@@ -638,8 +671,17 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                                                         " subj=%s", ctx);
                                         kfree(ctx);
                                 }
-                                audit_log_format(ab, " msg='%.1024s'",
-                                         (char *)data);
+                                if (msg_type != AUDIT_USER_TTY)
+                                        audit_log_format(ab, " msg='%.1024s'",
+                                                         (char *)data);
+                                else {
+                                        int size;
+
+                                        audit_log_format(ab, " msg=");
+                                        size = nlmsg_len(nlh);
+                                        audit_log_n_untrustedstring(ab, size,
+                                                                    data);
+                                }
                                 audit_set_pid(ab, pid);
                                 audit_log_end(ab);
                         }
@@ -730,6 +772,45 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                                 0, 0, sig_data, sizeof(*sig_data) + len);
                 kfree(sig_data);
                 break;
+        case AUDIT_TTY_GET: {
+                struct audit_tty_status s;
+                struct task_struct *tsk;
+
+                read_lock(&tasklist_lock);
+                tsk = find_task_by_pid(pid);
+                if (!tsk)
+                        err = -ESRCH;
+                else {
+                        spin_lock_irq(&tsk->sighand->siglock);
+                        s.enabled = tsk->signal->audit_tty != 0;
+                        spin_unlock_irq(&tsk->sighand->siglock);
+                }
+                read_unlock(&tasklist_lock);
+                audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_TTY_GET, 0, 0,
+                                 &s, sizeof(s));
+                break;
+        }
+        case AUDIT_TTY_SET: {
+                struct audit_tty_status *s;
+                struct task_struct *tsk;
+
+                if (nlh->nlmsg_len < sizeof(struct audit_tty_status))
+                        return -EINVAL;
+                s = data;
+                if (s->enabled != 0 && s->enabled != 1)
+                        return -EINVAL;
+                read_lock(&tasklist_lock);
+                tsk = find_task_by_pid(pid);
+                if (!tsk)
+                        err = -ESRCH;
+                else {
+                        spin_lock_irq(&tsk->sighand->siglock);
+                        tsk->signal->audit_tty = s->enabled != 0;
+                        spin_unlock_irq(&tsk->sighand->siglock);
+                }
+                read_unlock(&tasklist_lock);
+                break;
+        }
         default:
                 err = -EINVAL;
                 break;
@@ -1185,7 +1266,7 @@ static void audit_log_n_string(struct audit_buffer *ab, size_t slen,
 }
 
 /**
- * audit_log_n_unstrustedstring - log a string that may contain random characters
+ * audit_log_n_untrustedstring - log a string that may contain random characters
  * @ab: audit_buffer
  * @len: lenth of string (not including trailing null)
  * @string: string to be logged
@@ -1201,25 +1282,24 @@ static void audit_log_n_string(struct audit_buffer *ab, size_t slen,
 const char *audit_log_n_untrustedstring(struct audit_buffer *ab, size_t len,
                                         const char *string)
 {
-        const unsigned char *p = string;
+        const unsigned char *p;
 
-        while (*p) {
+        for (p = string; p < (const unsigned char *)string + len && *p; p++) {
                 if (*p == '"' || *p < 0x21 || *p > 0x7f) {
                         audit_log_hex(ab, string, len);
                         return string + len + 1;
                 }
-                p++;
         }
         audit_log_n_string(ab, len, string);
         return p + 1;
 }
 
 /**
- * audit_log_unstrustedstring - log a string that may contain random characters
+ * audit_log_untrustedstring - log a string that may contain random characters
  * @ab: audit_buffer
  * @string: string to be logged
  *
- * Same as audit_log_n_unstrustedstring(), except that strlen is used to
+ * Same as audit_log_n_untrustedstring(), except that strlen is used to
  * determine string length.
  */
 const char *audit_log_untrustedstring(struct audit_buffer *ab, const char *string)