Commit a64e6494 authored by Al Viro's avatar Al Viro
Browse files

[PATCH] return records for fork() both to child and parent


Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent a3f07114
...@@ -391,6 +391,7 @@ extern int audit_classify_arch(int arch); ...@@ -391,6 +391,7 @@ extern int audit_classify_arch(int arch);
#ifdef CONFIG_AUDITSYSCALL #ifdef CONFIG_AUDITSYSCALL
/* These are defined in auditsc.c */ /* These are defined in auditsc.c */
/* Public API */ /* Public API */
extern void audit_finish_fork(struct task_struct *child);
extern int audit_alloc(struct task_struct *task); extern int audit_alloc(struct task_struct *task);
extern void audit_free(struct task_struct *task); extern void audit_free(struct task_struct *task);
extern void audit_syscall_entry(int arch, extern void audit_syscall_entry(int arch,
...@@ -504,6 +505,7 @@ static inline int audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat) ...@@ -504,6 +505,7 @@ static inline int audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
extern int audit_n_rules; extern int audit_n_rules;
extern int audit_signals; extern int audit_signals;
#else #else
#define audit_finish_fork(t)
#define audit_alloc(t) ({ 0; }) #define audit_alloc(t) ({ 0; })
#define audit_free(t) do { ; } while (0) #define audit_free(t) do { ; } while (0)
#define audit_syscall_entry(ta,a,b,c,d,e) do { ; } while (0) #define audit_syscall_entry(ta,a,b,c,d,e) do { ; } while (0)
......
...@@ -1548,6 +1548,23 @@ void audit_syscall_entry(int arch, int major, ...@@ -1548,6 +1548,23 @@ void audit_syscall_entry(int arch, int major,
context->ppid = 0; context->ppid = 0;
} }
void audit_finish_fork(struct task_struct *child)
{
struct audit_context *ctx = current->audit_context;
struct audit_context *p = child->audit_context;
if (!p || !ctx || !ctx->auditable)
return;
p->arch = ctx->arch;
p->major = ctx->major;
memcpy(p->argv, ctx->argv, sizeof(ctx->argv));
p->ctime = ctx->ctime;
p->dummy = ctx->dummy;
p->auditable = ctx->auditable;
p->in_syscall = ctx->in_syscall;
p->filterkey = kstrdup(ctx->filterkey, GFP_KERNEL);
p->ppid = current->pid;
}
/** /**
* audit_syscall_exit - deallocate audit context after a system call * audit_syscall_exit - deallocate audit context after a system call
* @tsk: task being audited * @tsk: task being audited
......
...@@ -1398,6 +1398,7 @@ long do_fork(unsigned long clone_flags, ...@@ -1398,6 +1398,7 @@ long do_fork(unsigned long clone_flags,
init_completion(&vfork); init_completion(&vfork);
} }
audit_finish_fork(p);
tracehook_report_clone(trace, regs, clone_flags, nr, p); tracehook_report_clone(trace, regs, clone_flags, nr, p);
/* /*
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment