forked from Minki/linux
Merge branch 'audit.b39' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current
* 'audit.b39' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current: [PATCH] get rid of AVC_PATH postponed treatment [PATCH] allow audit filtering on bit & operations [PATCH] audit: fix broken class-based syscall audit [PATCH] Make IPC mode consistent
This commit is contained in:
Linus Torvalds
commit
dd6ccfe64d
@ -161,7 +161,7 @@
|
||||
* are currently used in an audit field constant understood by the kernel.
|
||||
* If you are adding a new #define AUDIT_<whatever>, please ensure that
|
||||
* AUDIT_UNUSED_BITS is updated if need be. */
|
||||
#define AUDIT_UNUSED_BITS 0x0FFFFC00
|
||||
#define AUDIT_UNUSED_BITS 0x07FFFC00
|
||||
|
||||
|
||||
/* Rule fields */
|
||||
@ -213,25 +213,29 @@
|
||||
#define AUDIT_NEGATE 0x80000000
|
||||
|
||||
/* These are the supported operators.
|
||||
* 4 2 1
|
||||
* = > <
|
||||
* -------
|
||||
* 0 0 0 0 nonsense
|
||||
* 0 0 1 1 <
|
||||
* 0 1 0 2 >
|
||||
* 0 1 1 3 !=
|
||||
* 1 0 0 4 =
|
||||
* 1 0 1 5 <=
|
||||
* 1 1 0 6 >=
|
||||
* 1 1 1 7 all operators
|
||||
* 4 2 1 8
|
||||
* = > < ?
|
||||
* ----------
|
||||
* 0 0 0 0 00 nonsense
|
||||
* 0 0 0 1 08 & bit mask
|
||||
* 0 0 1 0 10 <
|
||||
* 0 1 0 0 20 >
|
||||
* 0 1 1 0 30 !=
|
||||
* 1 0 0 0 40 =
|
||||
* 1 0 0 1 48 &= bit test
|
||||
* 1 0 1 0 50 <=
|
||||
* 1 1 0 0 60 >=
|
||||
* 1 1 1 1 78 all operators
|
||||
*/
|
||||
#define AUDIT_BIT_MASK 0x08000000
|
||||
#define AUDIT_LESS_THAN 0x10000000
|
||||
#define AUDIT_GREATER_THAN 0x20000000
|
||||
#define AUDIT_NOT_EQUAL 0x30000000
|
||||
#define AUDIT_EQUAL 0x40000000
|
||||
#define AUDIT_BIT_TEST (AUDIT_BIT_MASK|AUDIT_EQUAL)
|
||||
#define AUDIT_LESS_THAN_OR_EQUAL (AUDIT_LESS_THAN|AUDIT_EQUAL)
|
||||
#define AUDIT_GREATER_THAN_OR_EQUAL (AUDIT_GREATER_THAN|AUDIT_EQUAL)
|
||||
#define AUDIT_OPERATORS (AUDIT_EQUAL|AUDIT_NOT_EQUAL)
|
||||
#define AUDIT_OPERATORS (AUDIT_EQUAL|AUDIT_NOT_EQUAL|AUDIT_BIT_MASK)
|
||||
|
||||
/* Status symbols */
|
||||
/* Mask values */
|
||||
@ -407,7 +411,6 @@ extern int audit_bprm(struct linux_binprm *bprm);
|
||||
extern int audit_socketcall(int nargs, unsigned long *args);
|
||||
extern int audit_sockaddr(int len, void *addr);
|
||||
extern int __audit_fd_pair(int fd1, int fd2);
|
||||
extern int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt);
|
||||
extern int audit_set_macxattr(const char *name);
|
||||
extern int __audit_mq_open(int oflag, mode_t mode, struct mq_attr __user *u_attr);
|
||||
extern int __audit_mq_timedsend(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec __user *u_abs_timeout);
|
||||
@ -487,7 +490,6 @@ extern int audit_signals;
|
||||
#define audit_socketcall(n,a) ({ 0; })
|
||||
#define audit_fd_pair(n,a) ({ 0; })
|
||||
#define audit_sockaddr(len, addr) ({ 0; })
|
||||
#define audit_avc_path(dentry, mnt) ({ 0; })
|
||||
#define audit_set_macxattr(n) do { ; } while (0)
|
||||
#define audit_mq_open(o,m,a) ({ 0; })
|
||||
#define audit_mq_timedsend(d,l,p,t) ({ 0; })
|
||||
|
||||
@ -304,7 +304,7 @@ int __init audit_register_class(int class, unsigned *list)
|
||||
|
||||
int audit_match_class(int class, unsigned syscall)
|
||||
{
|
||||
if (unlikely(syscall >= AUDIT_BITMASK_SIZE * sizeof(__u32)))
|
||||
if (unlikely(syscall >= AUDIT_BITMASK_SIZE * 32))
|
||||
return 0;
|
||||
if (unlikely(class >= AUDIT_SYSCALL_CLASSES || !classes[class]))
|
||||
return 0;
|
||||
@ -456,6 +456,13 @@ static struct audit_entry *audit_rule_to_entry(struct audit_rule *rule)
|
||||
case AUDIT_DEVMINOR:
|
||||
case AUDIT_EXIT:
|
||||
case AUDIT_SUCCESS:
|
||||
/* bit ops are only useful on syscall args */
|
||||
if (f->op == AUDIT_BIT_MASK ||
|
||||
f->op == AUDIT_BIT_TEST) {
|
||||
err = -EINVAL;
|
||||
goto exit_free;
|
||||
}
|
||||
break;
|
||||
case AUDIT_ARG0:
|
||||
case AUDIT_ARG1:
|
||||
case AUDIT_ARG2:
|
||||
@ -1566,6 +1573,10 @@ int audit_comparator(const u32 left, const u32 op, const u32 right)
|
||||
return (left > right);
|
||||
case AUDIT_GREATER_THAN_OR_EQUAL:
|
||||
return (left >= right);
|
||||
case AUDIT_BIT_MASK:
|
||||
return (left & right);
|
||||
case AUDIT_BIT_TEST:
|
||||
return ((left & right) == right);
|
||||
}
|
||||
BUG();
|
||||
return 0;
|
||||
|
||||
@ -173,12 +173,6 @@ struct audit_aux_data_fd_pair {
|
||||
int fd[2];
|
||||
};
|
||||
|
||||
struct audit_aux_data_path {
|
||||
struct audit_aux_data d;
|
||||
struct dentry *dentry;
|
||||
struct vfsmount *mnt;
|
||||
};
|
||||
|
||||
struct audit_aux_data_pids {
|
||||
struct audit_aux_data d;
|
||||
pid_t target_pid[AUDIT_AUX_PIDS];
|
||||
@ -654,12 +648,6 @@ static inline void audit_free_aux(struct audit_context *context)
|
||||
struct audit_aux_data *aux;
|
||||
|
||||
while ((aux = context->aux)) {
|
||||
if (aux->type == AUDIT_AVC_PATH) {
|
||||
struct audit_aux_data_path *axi = (void *)aux;
|
||||
dput(axi->dentry);
|
||||
mntput(axi->mnt);
|
||||
}
|
||||
|
||||
context->aux = aux->next;
|
||||
kfree(aux);
|
||||
}
|
||||
@ -995,7 +983,7 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
|
||||
case AUDIT_IPC: {
|
||||
struct audit_aux_data_ipcctl *axi = (void *)aux;
|
||||
audit_log_format(ab,
|
||||
"ouid=%u ogid=%u mode=%x",
|
||||
"ouid=%u ogid=%u mode=%#o",
|
||||
axi->uid, axi->gid, axi->mode);
|
||||
if (axi->osid != 0) {
|
||||
char *ctx = NULL;
|
||||
@ -1014,7 +1002,7 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
|
||||
case AUDIT_IPC_SET_PERM: {
|
||||
struct audit_aux_data_ipcctl *axi = (void *)aux;
|
||||
audit_log_format(ab,
|
||||
"qbytes=%lx ouid=%u ogid=%u mode=%x",
|
||||
"qbytes=%lx ouid=%u ogid=%u mode=%#o",
|
||||
axi->qbytes, axi->uid, axi->gid, axi->mode);
|
||||
break; }
|
||||
|
||||
@ -1038,11 +1026,6 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
|
||||
audit_log_hex(ab, axs->a, axs->len);
|
||||
break; }
|
||||
|
||||
case AUDIT_AVC_PATH: {
|
||||
struct audit_aux_data_path *axi = (void *)aux;
|
||||
audit_log_d_path(ab, "path=", axi->dentry, axi->mnt);
|
||||
break; }
|
||||
|
||||
case AUDIT_FD_PAIR: {
|
||||
struct audit_aux_data_fd_pair *axs = (void *)aux;
|
||||
audit_log_format(ab, "fd0=%d fd1=%d", axs->fd[0], axs->fd[1]);
|
||||
@ -1990,36 +1973,6 @@ void __audit_ptrace(struct task_struct *t)
|
||||
selinux_get_task_sid(t, &context->target_sid);
|
||||
}
|
||||
|
||||
/**
|
||||
* audit_avc_path - record the granting or denial of permissions
|
||||
* @dentry: dentry to record
|
||||
* @mnt: mnt to record
|
||||
*
|
||||
* Returns 0 for success or NULL context or < 0 on error.
|
||||
*
|
||||
* Called from security/selinux/avc.c::avc_audit()
|
||||
*/
|
||||
int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt)
|
||||
{
|
||||
struct audit_aux_data_path *ax;
|
||||
struct audit_context *context = current->audit_context;
|
||||
|
||||
if (likely(!context))
|
||||
return 0;
|
||||
|
||||
ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
|
||||
if (!ax)
|
||||
return -ENOMEM;
|
||||
|
||||
ax->dentry = dget(dentry);
|
||||
ax->mnt = mntget(mnt);
|
||||
|
||||
ax->d.type = AUDIT_AVC_PATH;
|
||||
ax->d.next = context->aux;
|
||||
context->aux = (void *)ax;
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* audit_signal_info - record signal info for shutting down audit subsystem
|
||||
* @sig: signal value
|
||||
|
||||
@ -570,10 +570,12 @@ void avc_audit(u32 ssid, u32 tsid,
|
||||
case AVC_AUDIT_DATA_FS:
|
||||
if (a->u.fs.dentry) {
|
||||
struct dentry *dentry = a->u.fs.dentry;
|
||||
if (a->u.fs.mnt)
|
||||
audit_avc_path(dentry, a->u.fs.mnt);
|
||||
audit_log_format(ab, " name=");
|
||||
audit_log_untrustedstring(ab, dentry->d_name.name);
|
||||
if (a->u.fs.mnt) {
|
||||
audit_log_d_path(ab, "path=", dentry, a->u.fs.mnt);
|
||||
} else {
|
||||
audit_log_format(ab, " name=");
|
||||
audit_log_untrustedstring(ab, dentry->d_name.name);
|
||||
}
|
||||
inode = dentry->d_inode;
|
||||
} else if (a->u.fs.inode) {
|
||||
struct dentry *dentry;
|
||||
@ -624,9 +626,8 @@ void avc_audit(u32 ssid, u32 tsid,
|
||||
case AF_UNIX:
|
||||
u = unix_sk(sk);
|
||||
if (u->dentry) {
|
||||
audit_avc_path(u->dentry, u->mnt);
|
||||
audit_log_format(ab, " name=");
|
||||
audit_log_untrustedstring(ab, u->dentry->d_name.name);
|
||||
audit_log_d_path(ab, "path=",
|
||||
u->dentry, u->mnt);
|
||||
break;
|
||||
}
|
||||
if (!u->addr)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user