aboutsummaryrefslogtreecommitdiffstats
path: root/kernel/auditsc.c
diff options
context:
space:
mode:
Diffstat (limited to 'kernel/auditsc.c')
-rw-r--r--kernel/auditsc.c46
1 files changed, 6 insertions, 40 deletions
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 4193811d4fe1..74c2ae804ca8 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -795,36 +795,6 @@ void audit_free(struct task_struct *tsk)
795 audit_free_context(context); 795 audit_free_context(context);
796} 796}
797 797
798/* Compute a serial number for the audit record. Audit records are
799 * written to user-space as soon as they are generated, so a complete
800 * audit record may be written in several pieces. The timestamp of the
801 * record and this serial number are used by the user-space tools to
802 * determine which pieces belong to the same audit record. The
803 * (timestamp,serial) tuple is unique for each syscall and is live from
804 * syscall entry to syscall exit.
805 *
806 * Atomic values are only guaranteed to be 24-bit, so we count down.
807 *
808 * NOTE: Another possibility is to store the formatted records off the
809 * audit context (for those records that have a context), and emit them
810 * all at syscall exit. However, this could delay the reporting of
811 * significant errors until syscall exit (or never, if the system
812 * halts). */
813static inline unsigned int audit_serial(void)
814{
815 static atomic_t serial = ATOMIC_INIT(0xffffff);
816 unsigned int a, b;
817
818 do {
819 a = atomic_read(&serial);
820 if (atomic_dec_and_test(&serial))
821 atomic_set(&serial, 0xffffff);
822 b = atomic_read(&serial);
823 } while (b != a - 1);
824
825 return 0xffffff - b;
826}
827
828/* Fill in audit context at syscall entry. This only happens if the 798/* Fill in audit context at syscall entry. This only happens if the
829 * audit context was created when the task was created and the state or 799 * audit context was created when the task was created and the state or
830 * filters demand the audit context be built. If the state from the 800 * filters demand the audit context be built. If the state from the
@@ -1042,17 +1012,13 @@ void audit_inode(const char *name, const struct inode *inode)
1042 context->names[idx].rdev = inode->i_rdev; 1012 context->names[idx].rdev = inode->i_rdev;
1043} 1013}
1044 1014
1045int audit_get_stamp(struct audit_context *ctx, 1015void auditsc_get_stamp(struct audit_context *ctx,
1046 struct timespec *t, unsigned int *serial) 1016 struct timespec *t, unsigned int *serial)
1047{ 1017{
1048 if (ctx) { 1018 t->tv_sec = ctx->ctime.tv_sec;
1049 t->tv_sec = ctx->ctime.tv_sec; 1019 t->tv_nsec = ctx->ctime.tv_nsec;
1050 t->tv_nsec = ctx->ctime.tv_nsec; 1020 *serial = ctx->serial;
1051 *serial = ctx->serial; 1021 ctx->auditable = 1;
1052 ctx->auditable = 1;
1053 return 1;
1054 }
1055 return 0;
1056} 1022}
1057 1023
1058int audit_set_loginuid(struct task_struct *task, uid_t loginuid) 1024int audit_set_loginuid(struct task_struct *task, uid_t loginuid)