[PATCH] Fix audit record filtering with !CONFIG_AUDITSYSCALL

This fixes the per-user and per-message-type filtering when syscall
auditing isn't enabled.

[AV: folded followup fix from the same author]

Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 1912d8e..fbc21d6 100644 (file)
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -278,8 +278,6 @@ static inline void audit_inode_child(const char *dname,
 }
 
                                /* Private API (for audit.c only) */
-extern int  audit_receive_filter(int type, int pid, int uid, int seq,
-                                void *data, uid_t loginuid);
 extern unsigned int audit_serial(void);
 extern void auditsc_get_stamp(struct audit_context *ctx,
                              struct timespec *t, unsigned int *serial);
@@ -290,8 +288,6 @@ extern int audit_socketcall(int nargs, unsigned long *args);
 extern int audit_sockaddr(int len, void *addr);
 extern int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt);
 extern void audit_signal_info(int sig, struct task_struct *t);
-extern int audit_filter_user(struct netlink_skb_parms *cb, int type);
-extern int audit_filter_type(int type);
 extern int audit_set_macxattr(const char *name);
 #else
 #define audit_alloc(t) ({ 0; })
@@ -304,7 +300,6 @@ extern int audit_set_macxattr(const char *name);
 #define __audit_inode_child(d,i,p) do { ; } while (0)
 #define audit_inode(n,i,f) do { ; } while (0)
 #define audit_inode_child(d,i,p) do { ; } while (0)
-#define audit_receive_filter(t,p,u,s,d,l) ({ -EOPNOTSUPP; })
 #define auditsc_get_stamp(c,t,s) do { BUG(); } while (0)
 #define audit_get_loginuid(c) ({ -1; })
 #define audit_ipc_perms(q,u,g,m,i) ({ 0; })
@@ -312,7 +307,6 @@ extern int audit_set_macxattr(const char *name);
 #define audit_sockaddr(len, addr) ({ 0; })
 #define audit_avc_path(dentry, mnt) ({ 0; })
 #define audit_signal_info(s,t) do { ; } while (0)
-#define audit_filter_user(cb,t) ({ 1; })
 #define audit_set_macxattr(n) do { ; } while (0)
 #endif
 
@@ -337,13 +331,11 @@ extern void                   audit_log_d_path(struct audit_buffer *ab,
                                             const char *prefix,
                                             struct dentry *dentry,
                                             struct vfsmount *vfsmnt);
-                               /* Private API (for auditsc.c only) */
-extern void                audit_send_reply(int pid, int seq, int type,
-                                            int done, int multi,
-                                            void *payload, int size);
-extern void                audit_log_lost(const char *message);
-extern void                audit_panic(const char *message);
-extern struct semaphore audit_netlink_sem;
+                               /* Private API (for audit.c only) */
+extern int audit_filter_user(struct netlink_skb_parms *cb, int type);
+extern int audit_filter_type(int type);
+extern int  audit_receive_filter(int type, int pid, int uid, int seq,
+                                void *data, uid_t loginuid);
 #else
 #define audit_log(c,g,t,f,...) do { ; } while (0)
 #define audit_log_start(c,g,t) ({ NULL; })

diff --git a/kernel/Makefile b/kernel/Makefile
index 4ae0fbd..58cf129 100644 (file)
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -26,7 +26,7 @@ obj-$(CONFIG_COMPAT) += compat.o
 obj-$(CONFIG_CPUSETS) += cpuset.o
 obj-$(CONFIG_IKCONFIG) += configs.o
 obj-$(CONFIG_STOP_MACHINE) += stop_machine.o
-obj-$(CONFIG_AUDIT) += audit.o
+obj-$(CONFIG_AUDIT) += audit.o auditfilter.o
 obj-$(CONFIG_AUDITSYSCALL) += auditsc.o
 obj-$(CONFIG_KPROBES) += kprobes.o
 obj-$(CONFIG_SYSFS) += ksysfs.o

diff --git a/kernel/audit.c b/kernel/audit.c
index 45c123e..07c5d2b 100644 (file)
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -305,6 +305,7 @@ static int kauditd_thread(void *dummy)
                        remove_wait_queue(&kauditd_wait, &wait);
                }
        }
+       return 0;
 }
 
 /**

diff --git a/kernel/audit.h b/kernel/audit.h
new file mode 100644 (file)
index 0000000..7643e46
--- /dev/null
+++ b/kernel/audit.h
@@ -0,0 +1,70 @@
+/* audit -- definition of audit_context structure and supporting types 
+ *
+ * Copyright 2003-2004 Red Hat, Inc.
+ * Copyright 2005 Hewlett-Packard Development Company, L.P.
+ * Copyright 2005 IBM Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#include <linux/fs.h>
+#include <linux/audit.h>
+
+/* 0 = no checking
+   1 = put_count checking
+   2 = verbose put_count checking
+*/
+#define AUDIT_DEBUG 0
+
+/* At task start time, the audit_state is set in the audit_context using
+   a per-task filter.  At syscall entry, the audit_state is augmented by
+   the syscall filter. */
+enum audit_state {
+       AUDIT_DISABLED,         /* Do not create per-task audit_context.
+                                * No syscall-specific audit records can
+                                * be generated. */
+       AUDIT_SETUP_CONTEXT,    /* Create the per-task audit_context,
+                                * but don't necessarily fill it in at
+                                * syscall entry time (i.e., filter
+                                * instead). */
+       AUDIT_BUILD_CONTEXT,    /* Create the per-task audit_context,
+                                * and always fill it in at syscall
+                                * entry time.  This makes a full
+                                * syscall record available if some
+                                * other part of the kernel decides it
+                                * should be recorded. */
+       AUDIT_RECORD_CONTEXT    /* Create the per-task audit_context,
+                                * always fill it in at syscall entry
+                                * time, and always write out the audit
+                                * record at syscall exit time.  */
+};
+
+/* Rule lists */
+struct audit_entry {
+       struct list_head  list;
+       struct rcu_head   rcu;
+       struct audit_rule rule;
+};
+
+
+extern int audit_pid;
+extern int audit_comparator(const u32 left, const u32 op, const u32 right);
+
+extern void                audit_send_reply(int pid, int seq, int type,
+                                            int done, int multi,
+                                            void *payload, int size);
+extern void                audit_log_lost(const char *message);
+extern void                audit_panic(const char *message);
+extern struct semaphore audit_netlink_sem;

diff --cc kernel/auditfilter.c
Simple merge

diff --cc kernel/auditsc.c
Simple merge