Commit 17b28d42 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'audit-pr-20220826' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit 

Pull audit fix from Paul Moore:
 "Another small audit patch, this time to fix a bug where the return
  codes were not properly set before the audit filters were run,
  potentially resulting in missed audit records"

* tag 'audit-pr-20220826' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
  audit: move audit_return_fixup before the filters
parents 89b749d8 d4fefa48

kernel/auditsc.c

+2 −2
Original line number Diff line number Diff line
@@ -1940,6 +1940,7 @@ void __audit_uring_exit(int success, long code) 
		goto out;

	}



	audit_return_fixup(ctx, success, code);

	if (ctx->context == AUDIT_CTX_SYSCALL) {

		/*

		 * NOTE: See the note in __audit_uring_entry() about the case
@@ -1981,7 +1982,6 @@ void __audit_uring_exit(int success, long code) 
	audit_filter_inodes(current, ctx);

	if (ctx->current_state != AUDIT_STATE_RECORD)

		goto out;

	audit_return_fixup(ctx, success, code);

	audit_log_exit();



out:
@@ -2065,13 +2065,13 @@ void __audit_syscall_exit(int success, long return_code) 
	if (!list_empty(&context->killed_trees))

		audit_kill_trees(context);



	audit_return_fixup(context, success, return_code);

	/* run through both filters to ensure we set the filterkey properly */

	audit_filter_syscall(current, context);

	audit_filter_inodes(current, context);

	if (context->current_state < AUDIT_STATE_RECORD)

		goto out;



	audit_return_fixup(context, success, return_code);

	audit_log_exit();



out: