Skip to content
  1. May 08, 2013
    • Eric Paris's avatar
      audit: fix message spacing printing auid · 2a0b4be6
      Eric Paris authored 
      

The helper function didn't include a leading space, so it was jammed
against the previous text in the audit record.

Signed-off-by: default avatarEric Paris <eparis@redhat.com>
      2a0b4be6
    • Eric Paris's avatar
      Revert "audit: move kaudit thread start from auditd registration to kaudit init" · 82d8da0d
      Eric Paris authored 
      This reverts commit 6ff5e459

.

Conflicts:
	kernel/audit.c

This patch was starting a kthread for all the time.  Since the follow on
patches that required it didn't get finished in 3.10 time, we shouldn't
ship this change in 3.10.

Signed-off-by: default avatarEric Paris <eparis@redhat.com>
      82d8da0d
    • Jeff Layton's avatar
      audit: vfs: fix audit_inode call in O_CREAT case of do_last · 33e2208a
      Jeff Layton authored 
      Jiri reported a regression in auditing of open(..., O_CREAT) syscalls.
In older kernels, creating a file with open(..., O_CREAT) created
audit_name records that looked like this:

type=PATH msg=audit(1360255720.628:64): item=1 name="/abc/foo" inode=138810 dev=fd:00 mode=0100640 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:default_t:s0
type=PATH msg=audit(1360255720.628:64): item=0 name="/abc/" inode=138635 dev=fd:00 mode=040750 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:default_t:s0

...in recent kernels though, they look like this:

type=PATH msg=audit(1360255402.886:12574): item=2 name=(null) inode=264599 dev=fd:00 mode=0100640 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:default_t:s0
type=PATH msg=audit(1360255402.886:12574): item=1 name=(null) inode=264598 dev=fd:00 mode=040750 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:default_t:s0
type=PATH msg=audit(1360255402.886:12574): item=0 name="/abc/foo" inode=264598 dev=fd:00 mode=040750 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:default_t:s0

Richard bisected to determine that the problems started with commit
bfcec708

, but the log messages have changed with some later
audit-related patches.

The problem is that this audit_inode call is passing in the parent of
the dentry being opened, but audit_inode is being called with the parent
flag false. This causes later audit_inode and audit_inode_child calls to
match the wrong entry in the audit_names list.

This patch simply sets the flag to properly indicate that this inode
represents the parent. With this, the audit_names entries are back to
looking like they did before.

Cc: <stable@vger.kernel.org> # v3.7+
Reported-by: default avatarJiri Jaburek <jjaburek@redhat.com>
Signed-off-by: default avatarJeff Layton <jlayton@redhat.com>
Test By: Richard Guy Briggs <rbriggs@redhat.com>
Signed-off-by: default avatarEric Paris <eparis@redhat.com>
      33e2208a
    • Eric W. Biederman's avatar
      audit: Make testing for a valid loginuid explicit. · 780a7654
      Eric W. Biederman authored 
      audit rule additions containing "-F auid!=4294967295" were failing
with EINVAL because of a regression caused by e1760bd5

.

Apparently some userland audit rule sets want to know if loginuid uid
has been set and are using a test for auid != 4294967295 to determine
that.

In practice that is a horrible way to ask if a value has been set,
because it relies on subtle implementation details and will break
every time the uid implementation in the kernel changes.

So add a clean way to test if the audit loginuid has been set, and
silently convert the old idiom to the cleaner and more comprehensible
new idiom.

Cc: <stable@vger.kernel.org> # 3.7
Reported-By: default avatarRichard Guy Briggs <rgb@redhat.com>
Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
Tested-by: default avatarRichard Guy Briggs <rgb@redhat.com>
Signed-off-by: default avatarEric Paris <eparis@redhat.com>
      780a7654
  3. May 01, 2013
  5. Apr 17, 2013
    • Eric Paris's avatar
      audit: allow checking the type of audit message in the user filter · 62062cf8
      Eric Paris authored 
      

When userspace sends messages to the audit system it includes a type.
We want to be able to filter messages based on that type without have to
do the all or nothing option currently available on the
AUDIT_FILTER_TYPE filter list.  Instead we should be able to use the
AUDIT_FILTER_USER filter list and just use the message type as one part
of the matching decision.

Signed-off-by: default avatarEric Paris <eparis@redhat.com>
      62062cf8
  7. Apr 16, 2013
  9. Apr 12, 2013
    • Gao feng's avatar
      audit: remove duplicate export of audit_enabled · 72199caa
      Gao feng authored 
      

audit_enabled has already been exported in
include/linux/audit.h. and kernel/audit.h
includes include/linux/audit.h, no need to
export aduit_enabled again in kernel/audit.h

Signed-off-by: default avatarGao feng <gaofeng@cn.fujitsu.com>
Signed-off-by: default avatarEric Paris <eparis@redhat.com>
      72199caa
    • Eric Paris's avatar
      Audit: do not print error when LSMs disabled · ad395abe
      Eric Paris authored 
      

RHBZ: 785936

If the audit system collects a record about one process sending a signal
to another process it includes in that collection the 'secid' or 'an int
used to represet an LSM label.'  If there is no LSM enabled it will
collect a 0.  The problem is that when we attempt to print that record
we ask the LSM to convert the secid back to a string.  Since there is no
LSM it returns EOPNOTSUPP.

Most code in the audit system checks if the secid is 0 and does not
print LSM info in that case.  The signal information code however forgot
that check.  Thus users will see a message in syslog indicating that
converting the sid to string failed.  Add the right check.

Signed-off-by: default avatarEric Paris <eparis@redhat.com>
      ad395abe
  11. Apr 11, 2013
  13. Apr 09, 2013
  15. Feb 19, 2013
  17. Feb 16, 2013