linux-toradex.git/include/linux/audit.h, branch v5.1-rc3

audit: hide auditsc_get_stamp and audit_serial prototypes

2019-02-08T02:44:27+00:00

auditsc_get_stamp() and audit_serial() are internal audit functions so
move their prototypes from include/linux/audit.h to kernel/audit.h
so they are not visible to the rest of the kernel.

Signed-off-by: Richard Guy Briggs 
Signed-off-by: Paul Moore

audit: ignore fcaps on umount

2019-01-31T01:51:47+00:00

Don't fetch fcaps when umount2 is called to avoid a process hang while
it waits for the missing resource to (possibly never) re-appear.

Note the comment above user_path_mountpoint_at():
 * A umount is a special case for path walking. We're not actually interested
 * in the inode in this situation, and ESTALE errors can be a problem.  We
 * simply want track down the dentry and vfsmount attached at the mountpoint
 * and avoid revalidating the last component.

This can happen on ceph, cifs, 9p, lustre, fuse (gluster) or NFS.

Please see the github issue tracker
https://github.com/linux-audit/audit-kernel/issues/100

Signed-off-by: Richard Guy Briggs 
[PM: merge fuzz in audit_log_fcaps()]
Signed-off-by: Paul Moore

audit: move loginuid and sessionid from CONFIG_AUDITSYSCALL to CONFIG_AUDIT

2019-01-25T18:03:23+00:00

loginuid and sessionid (and audit_log_session_info) should be part of
CONFIG_AUDIT scope and not CONFIG_AUDITSYSCALL since it is used in
CONFIG_CHANGE, ANOM_LINK, FEATURE_CHANGE (and INTEGRITY_RULE), none of
which are otherwise dependent on AUDITSYSCALL.

Please see github issue
https://github.com/linux-audit/audit-kernel/issues/104

Signed-off-by: Richard Guy Briggs 
[PM: tweaked subject line for better grep'ing]
Signed-off-by: Paul Moore

audit: use current whenever possible

2018-11-26T23:41:21+00:00

There are many places, notably audit_log_task_info() and
audit_log_exit(), that take task_struct pointers but in reality they
are always working on the current task.  This patch eliminates the
task_struct arguments and uses current directly which allows a number
of cleanups as well.

Acked-by: Richard Guy Briggs 
Signed-off-by: Paul Moore

audit: localize audit_log_session_info prototype

2018-11-19T17:26:27+00:00

The audit_log_session_info() function is only used in kernel/audit*, so
move its prototype to kernel/audit.h

Signed-off-by: Richard Guy Briggs 
Signed-off-by: Paul Moore

audit: eliminate audit_enabled magic number comparison

2018-06-19T14:43:55+00:00

Remove comparison of audit_enabled to magic numbers outside of audit.

Related: https://github.com/linux-audit/audit-kernel/issues/86

Signed-off-by: Richard Guy Briggs 
Signed-off-by: Paul Moore

audit: use inline function to set audit context

2018-05-14T21:45:21+00:00

Recognizing that the audit context is an internal audit value, use an
access function to set the audit context pointer for the task
rather than reaching directly into the task struct to set it.

Signed-off-by: Richard Guy Briggs 
[PM: merge fuzz in audit.h]
Signed-off-by: Paul Moore

audit: use inline function to get audit context

2018-05-14T21:24:18+00:00

Recognizing that the audit context is an internal audit value, use an
access function to retrieve the audit context pointer for the task
rather than reaching directly into the task struct to get it.

Signed-off-by: Richard Guy Briggs 
[PM: merge fuzz in auditsc.c and selinuxfs.c, checkpatch.pl fixes]
Signed-off-by: Paul Moore

audit: convert sessionid unset to a macro

2018-05-14T19:56:35+00:00

Use a macro, "AUDIT_SID_UNSET", to replace each instance of
initialization and comparison to an audit session ID.

Signed-off-by: Richard Guy Briggs 
Signed-off-by: Paul Moore

seccomp: Don't special case audited processes when logging

2018-05-08T06:04:23+00:00

Seccomp logging for "handled" actions such as RET_TRAP, RET_TRACE, or
RET_ERRNO can be very noisy for processes that are being audited. This
patch modifies the seccomp logging behavior to treat processes that are
being inspected via the audit subsystem the same as processes that
aren't under inspection. Handled actions will no longer be logged just
because the process is being inspected. Since v4.14, applications have
the ability to request logging of handled actions by using the
SECCOMP_FILTER_FLAG_LOG flag when loading seccomp filters.

With this patch, the logic for deciding if an action will be logged is:

  if action == RET_ALLOW:
    do not log
  else if action not in actions_logged:
    do not log
  else if action == RET_KILL:
    log
  else if action == RET_LOG:
    log
  else if filter-requests-logging:
    log
  else:
    do not log

Reported-by: Steve Grubb 
Signed-off-by: Tyler Hicks 
Acked-by: Kees Cook 
Signed-off-by: Paul Moore