linux-toradex.git/kernel/auditsc.c, branch v2.6.16.17

[PATCH] make vm86 call audit_syscall_exit

2006-05-01T19:03:42+00:00

hi,

The motivation behind the patch below was to address messages in
/var/log/messages such as:

Jan 31 10:54:15 mets kernel: audit(:0): major=252 name_count=0: freeing
multiple contexts (1)
Jan 31 10:54:15 mets kernel: audit(:0): major=113 name_count=0: freeing
multiple contexts (2)

I can reproduce by running 'get-edid' from:
http://john.fremlin.de/programs/linux/read-edid/.

These messages come about in the log b/c the vm86 calls do not exit via
the normal system call exit paths and thus do not call
'audit_syscall_exit'. The next system call will then free the context for
itself and for the vm86 context, thus generating the above messages. This
patch addresses the issue by simply adding a call to 'audit_syscall_exit'
from the vm86 code.

Besides fixing the above error messages the patch also now allows vm86
system calls to become auditable. This is useful since strace does not
appear to properly record the return values from sys_vm86.

I think this patch is also a step in the right direction in terms of
cleaning up some core auditing code. If we can correct any other paths
that do not properly call the audit exit and entries points, then we can
also eliminate the notion of context chaining.

I've tested this patch by verifying that the log messages no longer
appear, and that the audit records for sys_vm86 appear to be correct.
Also, 'read_edid' produces itentical output.

thanks,

-Jason

Signed-off-by: Jason Baron 
Signed-off-by: Al Viro 
Signed-off-by: Greg Kroah-Hartman

[PATCH] GFP_KERNEL allocations in atomic (auditsc)

2006-02-18T20:41:50+00:00

audit_log_exit() is called from atomic contexts and gets explicit
gfp_mask argument; it should use it for all allocations rather
than doing some with gfp_mask and some with GFP_KERNEL.

Signed-off-by: Al Viro

[PATCH] EDAC: atomic scrub operations

2006-01-19T03:20:30+00:00

EDAC requires a way to scrub memory if an ECC error is found and the chipset
does not do the work automatically.  That means rewriting memory locations
atomically with respect to all CPUs _and_ bus masters.  That means we can't
use atomic_add(foo, 0) as it gets optimised for non-SMP

This adds a function to include/asm-foo/atomic.h for the platforms currently
supported which implements a scrub of a mapped block.

It also adjusts a few other files include order where atomic.h is included
before types.h as this now causes an error as atomic_scrub uses u32.

Signed-off-by: Alan Cox 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] gfp_t: kernel/*

2005-10-28T15:16:49+00:00

Signed-off-by: Al Viro 
Signed-off-by: Linus Torvalds

[AUDIT] Allow filtering on system call success _or_ failure

2005-08-27T09:25:43+00:00

Signed-off-by: David Woodhouse

AUDIT: Prevent duplicate syscall rules

2005-08-17T15:05:35+00:00

The following patch against audit.81 prevents duplicate syscall rules in
a given filter list by walking the list on each rule add.

I also removed the unused struct audit_entry in audit.c and made the
static inlines in auditsc.c consistent.

Signed-off-by: Amy Griffis 
Signed-off-by: David Woodhouse

AUDIT: Speed up audit_filter_syscall() for the non-auditable case.

2005-08-17T13:49:57+00:00

It was showing up fairly high on profiles even when no rules were set.
Make sure the common path stays as fast as possible.

Signed-off-by: David Woodhouse

AUDIT: Fix task refcount leak in audit_filter_syscall()

2005-08-17T13:45:55+00:00

Signed-off-by: David Woodhouse

AUDIT: Reduce contention in audit_serial()

2005-07-18T18:24:46+00:00

... by generating serial numbers only if an audit context is actually
_used_, rather than doing so at syscall entry even when the context
isn't necessarily marked auditable.

Signed-off-by: David Woodhouse

AUDIT: Fix compile error in audit_filter_syscall

2005-07-14T13:40:06+00:00

We didn't rename it to audit_tgid after all. Except once... Doh.

Signed-off-by: David Woodhouse