linux-toradex.git/kernel/auditfilter.c, branch v2.6.22

audit: fix oops removing watch if audit disabled

2007-06-24T15:59:12+00:00

Removing a watched file will oops if audit is disabled (auditctl -e 0).

To reproduce:
- auditctl -e 1
- touch /tmp/foo
- auditctl -w /tmp/foo
- auditctl -e 0
- rm /tmp/foo (or mv)

Signed-off-by: Tony Jones 
Cc: Al Viro 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

audit_match_signal() and friends are used only if CONFIG_AUDITSYSCALL is set

2007-05-16T01:56:37+00:00

Signed-off-by: Al Viro 
Signed-off-by: Linus Torvalds

[PATCH] audit signal recipients

2007-05-11T09:38:25+00:00

When auditing syscalls that send signals, log the pid and security
context for each target process. Optimize the data collection by
adding a counter for signal-related rules, and avoiding allocating an
aux struct unless we have more than one target process. For process
groups, collect pid/context data in blocks of 16. Move the
audit_signal_info() hook up in check_kill_permission() so we audit
attempts where permission is denied.

Signed-off-by: Amy Griffis 
Signed-off-by: Al Viro

[PATCH] minor update to rule add/delete messages (ver 2)

2007-02-18T02:30:09+00:00

I was looking at parsing some of these messages and found that I wanted what
it was doing next to an op= for the parser to key on. Also missing was the list
number and results.

Signed-off-by: Steve Grubb 
Signed-off-by: Al Viro

[PATCH] audit: fix audit_filter_user_rules() initialization bug

2007-02-11T18:51:34+00:00

gcc emits this warning:

 kernel/auditfilter.c: In function 'audit_filter_user':
 kernel/auditfilter.c:1611: warning: 'state' is used uninitialized in this function

I tend to agree with gcc - there are a couple of plausible exit paths from
audit_filter_user_rules() where it does not set 'state', keeping the
variable uninitialized.  For example if a filter rule has an AUDIT_POSSIBLE
action.  Initialize to 'wont audit'.  Fix whitespace damage too.

Signed-off-by: Ingo Molnar 
Cc: Al Viro 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] audit: fix kstrdup() error check

2006-12-22T16:55:49+00:00

kstrdup() returns NULL on error.

Cc: David Woodhouse 
Signed-off-by: Akinobu Mita 
Cc: Al Viro 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] kernel core: replace kmalloc+memset with kzalloc

2006-12-07T16:39:41+00:00

Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] arch filter lists with < or > should not be accepted

2006-10-04T12:31:16+00:00

Currently the kernel audit system represents arch's as numbers and will
gladly accept comparisons between archs using >, <, >=, <= when the only
thing that makes sense is = or !=.  I'm told that the next revision of
auditctl will do this checking but this will provide enforcement in the
kernel even for old userspace.  A simple command to show the issue would
be to run

auditctl -d entry,always -F arch>i686 -S chmod

with this patch the kernel will reject this with -EINVAL

Please comment/ack/nak as soon as possible.

-Eric

 kernel/auditfilter.c |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

Signed-off-by: Al Viro

[PATCH] selinux: rename selinux_ctxid_to_string

2006-09-26T15:48:52+00:00

Rename selinux_ctxid_to_string to selinux_sid_to_string to be
consistent with other interfaces.

Signed-off-by: Stephen Smalley 
Acked-by: James Morris 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] audit: AUDIT_PERM support

2006-09-11T17:32:30+00:00

add support for AUDIT_PERM predicate

Signed-off-by: Al Viro