linux-toradex.git/kernel/auditfilter.c, branch v2.6.20.21

[PATCH] audit: fix oops removing watch if audit disabled

2007-08-15T08:02:32+00:00

Removing a watched file will oops if audit is disabled (auditctl -e 0).

To reproduce:
- auditctl -e 1
- touch /tmp/foo
- auditctl -w /tmp/foo
- auditctl -e 0
- rm /tmp/foo (or mv)

Signed-off-by: Tony Jones 
Cc: Al Viro 
Signed-off-by: Andrew Morton 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] audit: fix kstrdup() error check

2006-12-22T16:55:49+00:00

kstrdup() returns NULL on error.

Cc: David Woodhouse 
Signed-off-by: Akinobu Mita 
Cc: Al Viro 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] kernel core: replace kmalloc+memset with kzalloc

2006-12-07T16:39:41+00:00

Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] arch filter lists with < or > should not be accepted

2006-10-04T12:31:16+00:00

Currently the kernel audit system represents arch's as numbers and will
gladly accept comparisons between archs using >, <, >=, <= when the only
thing that makes sense is = or !=.  I'm told that the next revision of
auditctl will do this checking but this will provide enforcement in the
kernel even for old userspace.  A simple command to show the issue would
be to run

auditctl -d entry,always -F arch>i686 -S chmod

with this patch the kernel will reject this with -EINVAL

Please comment/ack/nak as soon as possible.

-Eric

 kernel/auditfilter.c |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

Signed-off-by: Al Viro

[PATCH] selinux: rename selinux_ctxid_to_string

2006-09-26T15:48:52+00:00

Rename selinux_ctxid_to_string to selinux_sid_to_string to be
consistent with other interfaces.

Signed-off-by: Stephen Smalley 
Acked-by: James Morris 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] audit: AUDIT_PERM support

2006-09-11T17:32:30+00:00

add support for AUDIT_PERM predicate

Signed-off-by: Al Viro

[PATCH] update audit rule change messages

2006-09-11T17:32:17+00:00

Make the audit message for implicit rule removal more informative.
Make the rule update message consistent with other messages.

Signed-off-by: Amy Griffis 
Signed-off-by: Al Viro

[PATCH] fix ppid bug in 2.6.18 kernel

2006-09-11T17:32:04+00:00

Hello,

During some troubleshooting, I found that ppid was accidentally omitted from
the legacy rule section. This resulted in EINVAL for any rule with ppid sent
with AUDIT_ADD.

Signed-off-by: Steve Grubb 
Signed-off-by: Al Viro

[PATCH] introduce audit rules counter

2006-08-03T14:55:18+00:00

Signed-off-by: Al Viro

[PATCH] fix audit oops with invalid operator

2006-08-03T14:54:43+00:00

Michael C Thompson wrote:  [Tue Aug 01 2006, 02:36:36PM EDT]
> The trigger for this oops is:
> # auditctl -a exit,always -S pread64 -F 'inode<1'

Setting the err value will fix it.

Signed-off-by: Amy Griffis 
Signed-off-by: Al Viro