linux-toradex.git/kernel/auditsc.c, branch v3.10.2

audit: Make testing for a valid loginuid explicit.

2013-05-08T02:27:15+00:00

audit rule additions containing "-F auid!=4294967295" were failing
with EINVAL because of a regression caused by e1760bd.

Apparently some userland audit rule sets want to know if loginuid uid
has been set and are using a test for auid != 4294967295 to determine
that.

In practice that is a horrible way to ask if a value has been set,
because it relies on subtle implementation details and will break
every time the uid implementation in the kernel changes.

So add a clean way to test if the audit loginuid has been set, and
silently convert the old idiom to the cleaner and more comprehensible
new idiom.

Cc:  # 3.7
Reported-By: Richard Guy Briggs 
Signed-off-by: "Eric W. Biederman" 
Tested-by: Richard Guy Briggs 
Signed-off-by: Eric Paris

audit: fix event coverage of AUDIT_ANOM_LINK

2013-04-30T19:31:28+00:00

The userspace audit tools didn't like the existing formatting of the
AUDIT_ANOM_LINK event. It needed to be expanded to emit an AUDIT_PATH
event as well, so this implements the change. The bulk of the patch is
moving code out of auditsc.c into audit.c and audit.h for general use.
It expands audit_log_name to include an optional "struct path" argument
for the simple case of just needing to report a pathname. This also
makes
audit_log_task_info available when syscall auditing is not enabled,
since
it is needed in either case for process details.

Signed-off-by: Kees Cook 
Reported-by: Steve Grubb

audit: use a consistent audit helper to log lsm information

2013-04-30T19:31:28+00:00

We have a number of places we were reimplementing the same code to write
out lsm labels.  Just do it one darn place.

Signed-off-by: Eric Paris

audit: fix build break when AUDIT_DEBUG == 2

2013-04-16T14:17:02+00:00

Looks like this one has been around since 5195d8e21:

	kernel/auditsc.c: In function ‘audit_free_names’:
	kernel/auditsc.c:998: error: ‘i’ undeclared (first use in this function)

...and this warning:

	kernel/auditsc.c: In function ‘audit_putname’:
	kernel/auditsc.c:2045: warning: ‘i’ may be used uninitialized in this function

Signed-off-by: Jeff Layton 
Signed-off-by: Eric Paris

Audit: do not print error when LSMs disabled

2013-04-11T19:39:10+00:00

RHBZ: 785936

If the audit system collects a record about one process sending a signal
to another process it includes in that collection the 'secid' or 'an int
used to represet an LSM label.'  If there is no LSM enabled it will
collect a 0.  The problem is that when we attempt to print that record
we ask the LSM to convert the secid back to a string.  Since there is no
LSM it returns EOPNOTSUPP.

Most code in the audit system checks if the secid is 0 and does not
print LSM info in that case.  The signal information code however forgot
that check.  Thus users will see a message in syslog indicating that
converting the sid to string failed.  Add the right check.

Signed-off-by: Eric Paris

auditsc: remove audit_set_context() altogether - fold it into its caller

2013-04-10T19:18:50+00:00

>   In function audit_alloc_context(), use kzalloc, instead of kmalloc+memset. Patch also renames audit_zero_context() to
> audit_set_context(), to represent it's inner workings properly.

Fair enough.  I'd go futher...

Cc: Al Viro 
Cc: Eric Paris 
Cc: Rakib Mullick 
Signed-off-by: Andrew Morton 
Signed-off-by: Eric Paris

auditsc: Use kzalloc instead of kmalloc+memset.

2013-04-10T19:18:24+00:00

  In function audit_alloc_context(), use kzalloc, instead of kmalloc+memset. Patch also renames audit_zero_context() to
audit_set_context(), to represent it's inner workings properly.

Signed-off-by: Rakib Mullick 
Signed-off-by: Eric Paris

kernel: audit: beautify code, for extern function, better to check its parameters by itself

2013-04-10T17:31:12+00:00

  __audit_socketcall is an extern function.
  better to check its parameters by itself.

    also can return error code, when fail (find invalid parameters).
    also use macro instead of real hard code number
    also give related comments for it.

Signed-off-by: Chen Gang 
[eparis: fix the return value when !CONFIG_AUDIT]
Signed-off-by: Eric Paris

audit: destroy long filenames correctly

2013-04-10T17:21:52+00:00

filename should be destroyed via final_putname() instead of __putname()
Otherwise this result in following BUGON() in case of long names:
  kernel BUG at mm/slab.c:3006!
  Call Trace:
  kmem_cache_free+0x1c1/0x850
  audit_putname+0x88/0x90
  putname+0x73/0x80
  sys_symlinkat+0x120/0x150
  sys_symlink+0x16/0x20
  system_call_fastpath+0x16/0x1b

Introduced-in: 7950e3852

Signed-off-by: Dmitry Monakhov 
Reviewed-by: Jeff Layton 
Signed-off-by: Eric Paris

audit: improve GID/EGID comparation logic

2013-04-08T20:19:15+00:00

It is useful to extend GID/EGID comparation logic to be able to
match not only the exact EID/EGID values but the group/egroup also.

Signed-off-by: Matvejchikov Ilya 
Signed-off-by: Eric Paris