linux-toradex.git/kernel/auditsc.c, branch v2.6.17.8

[PATCH] Audit Filter Performance

2006-05-01T10:10:07+00:00

While testing the watch performance, I noticed that selinux_task_ctxid()
was creeping into the results more than it should. Investigation showed
that the function call was being called whether it was needed or not. The
below patch fixes this.

Signed-off-by: Steve Grubb 
Signed-off-by: Al Viro

[PATCH] Rework of IPC auditing

2006-05-01T10:10:04+00:00

1) The audit_ipc_perms() function has been split into two different
functions:
        - audit_ipc_obj()
        - audit_ipc_set_perm()

There's a key shift here...  The audit_ipc_obj() collects the uid, gid,
mode, and SElinux context label of the current ipc object.  This
audit_ipc_obj() hook is now found in several places.  Most notably, it
is hooked in ipcperms(), which is called in various places around the
ipc code permforming a MAC check.  Additionally there are several places
where *checkid() is used to validate that an operation is being
performed on a valid object while not necessarily having a nearby
ipcperms() call.  In these locations, audit_ipc_obj() is called to
ensure that the information is captured by the audit system.

The audit_set_new_perm() function is called any time the permissions on
the ipc object changes.  In this case, the NEW permissions are recorded
(and note that an audit_ipc_obj() call exists just a few lines before
each instance).

2) Support for an AUDIT_IPC_SET_PERM audit message type.  This allows
for separate auxiliary audit records for normal operations on an IPC
object and permissions changes.  Note that the same struct
audit_aux_data_ipcctl is used and populated, however there are separate
audit_log_format statements based on the type of the message.  Finally,
the AUDIT_IPC block of code in audit_free_aux() was extended to handle
aux messages of this new type.  No more mem leaks I hope ;-)

Signed-off-by: Al Viro

[PATCH] More user space subject labels

2006-05-01T10:10:01+00:00

Hi,

The patch below builds upon the patch sent earlier and adds subject label to
all audit events generated via the netlink interface. It also cleans up a few
other minor things.

Signed-off-by: Steve Grubb 

Signed-off-by: Al Viro

[PATCH] change lspp ipc auditing

2006-05-01T10:09:56+00:00

Hi,

The patch below converts IPC auditing to collect sid's and convert to context
string only if it needs to output an audit record. This patch depends on the
inode audit change patch already being applied.

Signed-off-by: Steve Grubb 

Signed-off-by: Al Viro

[PATCH] audit inode patch

2006-05-01T10:09:53+00:00

Previously, we were gathering the context instead of the sid. Now in this patch,
we gather just the sid and convert to context only if an audit event is being
output.

This patch brings the performance hit from 146% down to 23%

Signed-off-by: Al Viro

[PATCH] support for context based audit filtering, part 2

2006-05-01T10:09:36+00:00

This patch provides the ability to filter audit messages based on the
elements of the process' SELinux context (user, role, type, mls sensitivity,
and mls clearance).  It uses the new interfaces from selinux to opaquely
store information related to the selinux context and to filter based on that
information.  It also uses the callback mechanism provided by selinux to
refresh the information when a new policy is loaded.

Signed-off-by: Al Viro

[PATCH] no need to wank with task_lock() and pinning task down in audit_syscall_exit()

2006-05-01T10:06:21+00:00

Signed-off-by: Al Viro

[PATCH] drop task argument of audit_syscall_{entry,exit}

2006-05-01T10:06:18+00:00

... it's always current, and that's a good thing - allows simpler locking.

Signed-off-by: Al Viro

[PATCH] drop gfp_mask in audit_log_exit()

2006-05-01T10:06:16+00:00

now we can do that - all callers are process-synchronous and do not hold
any locks.

Signed-off-by: Al Viro

[PATCH] move call of audit_free() into do_exit()

2006-05-01T10:06:13+00:00

Signed-off-by: Al Viro