Skip to content

Commit

Permalink
audit: stop pushing loginid, uid, sessionid as arguments
Browse files Browse the repository at this point in the history 
We always use current.  Stop pulling this when the skb comes in and
pushing it around as arguments.  Just get it at the end when you need
it.

Signed-off-by: Eric Paris <[email protected]>
  • Loading branch information
@eparis
eparis committed Apr 30, 2013
1 parent 1890090 commit dc9eb69
Show file tree
Hide file tree
Showing 5 changed files with 52 additions and 83 deletions.
4 changes: 3 additions & 1 deletion drivers/tty/tty_audit.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -202,10 +202,12 @@ void tty_audit_tiocsti(struct tty_struct *tty, char ch)
* reference to the tty audit buffer if available.
* Flush the buffer or return an appropriate error code.
*/
int tty_audit_push_task(struct task_struct *tsk, kuid_t loginuid, u32 sessionid)
int tty_audit_push_task(struct task_struct *tsk)
{
struct tty_audit_buf *buf = ERR_PTR(-EPERM);
unsigned long flags;
kuid_t loginuid = audit_get_loginuid(tsk);
u32 sessionid = audit_get_sessionid(tsk);

if (!lock_task_sighand(tsk, &flags))
return -ESRCH;
Expand Down
3 changes: 1 addition & 2 deletions include/linux/audit.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -441,8 +441,7 @@ extern int audit_update_lsm_rules(void);
extern int audit_filter_user(int type);
extern int audit_filter_type(int type);
extern int audit_receive_filter(int type, int pid, int seq,
void *data, size_t datasz, kuid_t loginuid,
u32 sessionid, u32 sid);
void *data, size_t datasz);
extern int audit_enabled;
#else /* CONFIG_AUDIT */
static inline __printf(4, 5)
Expand Down
6 changes: 2 additions & 4 deletions include/linux/tty.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -517,8 +517,7 @@ extern void tty_audit_exit(void);
extern void tty_audit_fork(struct signal_struct *sig);
extern void tty_audit_tiocsti(struct tty_struct *tty, char ch);
extern void tty_audit_push(struct tty_struct *tty);
extern int tty_audit_push_task(struct task_struct *tsk,
kuid_t loginuid, u32 sessionid);
extern int tty_audit_push_task(struct task_struct *tsk);
#else
static inline void tty_audit_add_data(struct tty_struct *tty,
unsigned char *data, size_t size, unsigned icanon)
Expand All @@ -536,8 +535,7 @@ static inline void tty_audit_fork(struct signal_struct *sig)
static inline void tty_audit_push(struct tty_struct *tty)
{
}
static inline int tty_audit_push_task(struct task_struct *tsk,
kuid_t loginuid, u32 sessionid)
static inline int tty_audit_push_task(struct task_struct *tsk)
{
return 0;
}
Expand Down
100 changes: 37 additions & 63 deletions kernel/audit.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -265,17 +265,22 @@ void audit_log_lost(const char *message)
}

static int audit_log_config_change(char *function_name, int new, int old,
kuid_t loginuid, u32 sessionid, u32 sid,
int allow_changes)
{
struct audit_buffer *ab;
int rc = 0;
u32 sessionid = audit_get_sessionid(current);
uid_t auid = from_kuid(&init_user_ns, audit_get_loginuid(current));
u32 sid;


ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
if (unlikely(!ab))
return rc;
audit_log_format(ab, "%s=%d old=%d auid=%u ses=%u", function_name, new,
old, from_kuid(&init_user_ns, loginuid), sessionid);
old, auid, sessionid);

security_task_getsecid(current, &sid);
if (sid) {
char *ctx = NULL;
u32 len;
Expand All @@ -294,9 +299,7 @@ static int audit_log_config_change(char *function_name, int new, int old,
return rc;
}

static int audit_do_config_change(char *function_name, int *to_change,
int new, kuid_t loginuid, u32 sessionid,
u32 sid)
static int audit_do_config_change(char *function_name, int *to_change, int new)
{
int allow_changes, rc = 0, old = *to_change;

Expand All @@ -307,8 +310,7 @@ static int audit_do_config_change(char *function_name, int *to_change,
allow_changes = 1;

if (audit_enabled != AUDIT_OFF) {
rc = audit_log_config_change(function_name, new, old, loginuid,
sessionid, sid, allow_changes);
rc = audit_log_config_change(function_name, new, old, allow_changes);
if (rc)
allow_changes = 0;
}
Expand All @@ -322,44 +324,37 @@ static int audit_do_config_change(char *function_name, int *to_change,
return rc;
}

static int audit_set_rate_limit(int limit, kuid_t loginuid, u32 sessionid,
u32 sid)
static int audit_set_rate_limit(int limit)
{
return audit_do_config_change("audit_rate_limit", &audit_rate_limit,
limit, loginuid, sessionid, sid);
return audit_do_config_change("audit_rate_limit", &audit_rate_limit, limit);
}

static int audit_set_backlog_limit(int limit, kuid_t loginuid, u32 sessionid,
u32 sid)
static int audit_set_backlog_limit(int limit)
{
return audit_do_config_change("audit_backlog_limit", &audit_backlog_limit,
limit, loginuid, sessionid, sid);
return audit_do_config_change("audit_backlog_limit", &audit_backlog_limit, limit);
}

static int audit_set_enabled(int state, kuid_t loginuid, u32 sessionid, u32 sid)
static int audit_set_enabled(int state)
{
int rc;
if (state < AUDIT_OFF || state > AUDIT_LOCKED)
return -EINVAL;

rc = audit_do_config_change("audit_enabled", &audit_enabled, state,
loginuid, sessionid, sid);

rc = audit_do_config_change("audit_enabled", &audit_enabled, state);
if (!rc)
audit_ever_enabled |= !!state;

return rc;
}

static int audit_set_failure(int state, kuid_t loginuid, u32 sessionid, u32 sid)
static int audit_set_failure(int state)
{
if (state != AUDIT_FAIL_SILENT
&& state != AUDIT_FAIL_PRINTK
&& state != AUDIT_FAIL_PANIC)
return -EINVAL;

return audit_do_config_change("audit_failure", &audit_failure, state,
loginuid, sessionid, sid);
return audit_do_config_change("audit_failure", &audit_failure, state);
}

/*
Expand Down Expand Up @@ -627,12 +622,15 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
return err;
}

static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type,
kuid_t auid, u32 ses, u32 sid)
static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type)
{
int rc = 0;
char *ctx = NULL;
u32 len;
u32 sessionid = audit_get_sessionid(current);
uid_t uid = from_kuid(&init_user_ns, current_uid());
uid_t auid = from_kuid(&init_user_ns, audit_get_loginuid(current));
u32 sid;

if (!audit_enabled) {
*ab = NULL;
Expand All @@ -643,9 +641,8 @@ static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type,
if (unlikely(!*ab))
return rc;
audit_log_format(*ab, "pid=%d uid=%u auid=%u ses=%u",
task_tgid_vnr(current),
from_kuid(&init_user_ns, current_uid()),
from_kuid(&init_user_ns, auid), ses);
task_tgid_vnr(current), uid, auid, sessionid);
security_task_getsecid(current, &sid);
if (sid) {
rc = security_secid_to_secctx(sid, &ctx, &len);
if (rc)
Expand All @@ -661,14 +658,12 @@ static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type,

static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
{
u32 seq, sid;
u32 seq;
void *data;
struct audit_status *status_get, status_set;
int err;
struct audit_buffer *ab;
u16 msg_type = nlh->nlmsg_type;
kuid_t loginuid; /* loginuid of sender */
u32 sessionid;
struct audit_sig_info *sig_data;
char *ctx = NULL;
u32 len;
Expand All @@ -677,9 +672,6 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
if (err)
return err;

loginuid = audit_get_loginuid(current);
sessionid = audit_get_sessionid(current);
security_task_getsecid(current, &sid);
seq = nlh->nlmsg_seq;
data = nlmsg_data(nlh);

Expand All @@ -700,37 +692,30 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
return -EINVAL;
status_get = (struct audit_status *)data;
if (status_get->mask & AUDIT_STATUS_ENABLED) {
err = audit_set_enabled(status_get->enabled,
loginuid, sessionid, sid);
err = audit_set_enabled(status_get->enabled);
if (err < 0)
return err;
}
if (status_get->mask & AUDIT_STATUS_FAILURE) {
err = audit_set_failure(status_get->failure,
loginuid, sessionid, sid);
err = audit_set_failure(status_get->failure);
if (err < 0)
return err;
}
if (status_get->mask & AUDIT_STATUS_PID) {
int new_pid = status_get->pid;

if (audit_enabled != AUDIT_OFF)
audit_log_config_change("audit_pid", new_pid,
audit_pid, loginuid,
sessionid, sid, 1);

audit_log_config_change("audit_pid", new_pid, audit_pid, 1);
audit_pid = new_pid;
audit_nlk_portid = NETLINK_CB(skb).portid;
}
if (status_get->mask & AUDIT_STATUS_RATE_LIMIT) {
err = audit_set_rate_limit(status_get->rate_limit,
loginuid, sessionid, sid);
err = audit_set_rate_limit(status_get->rate_limit);
if (err < 0)
return err;
}
if (status_get->mask & AUDIT_STATUS_BACKLOG_LIMIT)
err = audit_set_backlog_limit(status_get->backlog_limit,
loginuid, sessionid, sid);
err = audit_set_backlog_limit(status_get->backlog_limit);
break;
case AUDIT_USER:
case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
Expand All @@ -742,14 +727,11 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
if (err == 1) {
err = 0;
if (msg_type == AUDIT_USER_TTY) {
err = tty_audit_push_task(current, loginuid,
sessionid);
err = tty_audit_push_task(current);
if (err)
break;
}
audit_log_common_recv_msg(&ab, msg_type,
loginuid, sessionid, sid);

audit_log_common_recv_msg(&ab, msg_type);
if (msg_type != AUDIT_USER_TTY)
audit_log_format(ab, " msg='%.1024s'",
(char *)data);
Expand All @@ -772,26 +754,19 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
if (nlmsg_len(nlh) < sizeof(struct audit_rule_data))
return -EINVAL;
if (audit_enabled == AUDIT_LOCKED) {
audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE,
loginuid, sessionid, sid);

audit_log_format(ab, " audit_enabled=%d res=0",
audit_enabled);
audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE);
audit_log_format(ab, " audit_enabled=%d res=0", audit_enabled);
audit_log_end(ab);
return -EPERM;
}
/* fallthrough */
case AUDIT_LIST_RULES:
err = audit_receive_filter(msg_type, NETLINK_CB(skb).portid,
seq, data, nlmsg_len(nlh),
loginuid, sessionid, sid);
seq, data, nlmsg_len(nlh));
break;
case AUDIT_TRIM:
audit_trim_trees();

audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE,
loginuid, sessionid, sid);

audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE);
audit_log_format(ab, " op=trim res=1");
audit_log_end(ab);
break;
Expand Down Expand Up @@ -821,8 +796,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
/* OK, here comes... */
err = audit_tag_tree(old, new);

audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE,
loginuid, sessionid, sid);
audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE);

audit_log_format(ab, " op=make_equiv old=");
audit_log_untrustedstring(ab, old);
Expand Down
22 changes: 9 additions & 13 deletions kernel/auditfilter.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -980,20 +980,21 @@ static void audit_list_rules(int pid, int seq, struct sk_buff_head *q)
}

/* Log rule additions and removals */
static void audit_log_rule_change(kuid_t loginuid, u32 sessionid, u32 sid,
char *action, struct audit_krule *rule,
int res)
static void audit_log_rule_change(char *action, struct audit_krule *rule, int res)
{
struct audit_buffer *ab;
uid_t loginuid = from_kuid(&init_user_ns, audit_get_loginuid(current));
u32 sessionid = audit_get_sessionid(current);
u32 sid;

if (!audit_enabled)
return;

ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
if (!ab)
return;
audit_log_format(ab, "auid=%u ses=%u",
from_kuid(&init_user_ns, loginuid), sessionid);
audit_log_format(ab, "auid=%u ses=%u" ,loginuid, sessionid);
security_task_getsecid(current, &sid);
if (sid) {
char *ctx = NULL;
u32 len;
Expand Down Expand Up @@ -1022,8 +1023,7 @@ static void audit_log_rule_change(kuid_t loginuid, u32 sessionid, u32 sid,
* @sessionid: sessionid for netlink audit message
* @sid: SE Linux Security ID of sender
*/
int audit_receive_filter(int type, int pid, int seq, void *data,
size_t datasz, kuid_t loginuid, u32 sessionid, u32 sid)
int audit_receive_filter(int type, int pid, int seq, void *data, size_t datasz)
{
struct task_struct *tsk;
struct audit_netlink_list *dest;
Expand Down Expand Up @@ -1061,9 +1061,7 @@ int audit_receive_filter(int type, int pid, int seq, void *data,
return PTR_ERR(entry);

err = audit_add_rule(entry);
audit_log_rule_change(loginuid, sessionid, sid, "add rule",
&entry->rule, !err);

audit_log_rule_change("add rule", &entry->rule, !err);
if (err)
audit_free_rule(entry);
break;
Expand All @@ -1073,9 +1071,7 @@ int audit_receive_filter(int type, int pid, int seq, void *data,
return PTR_ERR(entry);

err = audit_del_rule(entry);
audit_log_rule_change(loginuid, sessionid, sid, "remove rule",
&entry->rule, !err);

audit_log_rule_change("remove rule", &entry->rule, !err);
audit_free_rule(entry);
break;
default:
Expand Down

0 comments on commit dc9eb69

Please sign in to comment.