1. 24 Jun, 2009 6 commits
  2. 05 Apr, 2009 3 commits
    • Eric Paris's avatar
      Audit: remove spaces from audit_log_d_path · def57543
      Eric Paris authored
      
      
      audit_log_d_path had spaces in the strings which would be emitted on the
      error paths.  This patch simply replaces those spaces with an _ or removes
      the needless spaces entirely.
      Signed-off-by: default avatarEric Paris <eparis@redhat.com>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      def57543
    • Miloslav Trmac's avatar
      audit: ignore terminating NUL in AUDIT_USER_TTY messages · 55ad2f8d
      Miloslav Trmac authored
      
      
      AUDIT_USER_TTY, like all other messages sent from user-space, is sent
      NUL-terminated.  Unlike other user-space audit messages, which come only
      from trusted sources, AUDIT_USER_TTY messages are processed using
      audit_log_n_untrustedstring().
      
      This patch modifies AUDIT_USER_TTY handling to ignore the trailing NUL
      and use the "quoted_string" representation of the message if possible.
      Signed-off-by: default avatarMiloslav Trmac <mitr@redhat.com>
      Cc: Eric Paris <eparis@redhat.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: Steve Grubb <sgrubb@redhat.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      55ad2f8d
    • Miloslav Trmac's avatar
      Audit: fix handling of 'strings' with NULL characters · b3897f56
      Miloslav Trmac authored
      
      
      currently audit_log_n_untrustedstring() uses audit_string_contains_control()
      to check if the 'string' has any control characters.  If the 'string' has an
      embedded NULL audit_string_contains_control() will return that the data has
      no control characters and will then pass the string to audit_log_n_string
      with the total length, not the length up to the first NULL.
      audit_log_n_string() does a memcpy of the entire length and so the actual
      audit record emitted may then contain a NULL and then whatever random memory
      is after the NULL.
      
      Since we want to log the entire octet stream (if we can't trust the data
      to be a string we can't trust that a NULL isn't actually a part of it)
      we should just consider NULL as a control character.  If the caller is
      certain they want to stop at the first NULL they should be using
      audit_log_untrustedstring.
      Signed-off-by: default avatarEric Paris <eparis@redhat.com>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      b3897f56
  3. 09 Dec, 2008 2 commits
  4. 01 Aug, 2008 2 commits
  5. 25 Jun, 2008 2 commits
  6. 17 May, 2008 1 commit
  7. 28 Apr, 2008 6 commits
    • Pavel Emelyanov's avatar
      [patch 2/2] Use find_task_by_vpid in audit code · 4a761b8c
      Pavel Emelyanov authored
      
      
      The pid to lookup a task by is passed inside audit code via netlink message.
      
      Thanks to Denis Lunev, netlink packets are now (since 2.6.24) _always_
      processed in the context of the sending task.  So this is correct to lookup
      the task with find_task_by_vpid() here.
      Signed-off-by: default avatarPavel Emelyanov <xemul@openvz.org>
      Cc: "Eric W. Biederman" <ebiederm@xmission.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      4a761b8c
    • Harvey Harrison's avatar
      [PATCH 2/2] audit: fix sparse shadowed variable warnings · 7719e437
      Harvey Harrison authored
      
      
      Use msglen as the identifier.
      kernel/audit.c:724:10: warning: symbol 'len' shadows an earlier one
      kernel/audit.c:575:8: originally declared here
      
      Don't use ino_f to check the inode field at the end of the functions.
      kernel/auditfilter.c:429:22: warning: symbol 'f' shadows an earlier one
      kernel/auditfilter.c:420:21: originally declared here
      kernel/auditfilter.c:542:22: warning: symbol 'f' shadows an earlier one
      kernel/auditfilter.c:529:21: originally declared here
      
      i always used as a counter for a for loop and initialized to zero before
      use.  Eliminate the inner i variables.
      kernel/auditsc.c:1295:8: warning: symbol 'i' shadows an earlier one
      kernel/auditsc.c:1152:6: originally declared here
      kernel/auditsc.c:1320:7: warning: symbol 'i' shadows an earlier one
      kernel/auditsc.c:1152:6: originally declared here
      Signed-off-by: default avatarHarvey Harrison <harvey.harrison@gmail.com>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      7719e437
    • Eric Paris's avatar
      Audit: standardize string audit interfaces · b556f8ad
      Eric Paris authored
      
      
      This patch standardized the string auditing interfaces.  No userspace
      changes will be visible and this is all just cleanup and consistancy
      work.  We have the following string audit interfaces to use:
      
      void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf, size_t len);
      
      void audit_log_n_string(struct audit_buffer *ab, const char *buf, size_t n);
      void audit_log_string(struct audit_buffer *ab, const char *buf);
      
      void audit_log_n_untrustedstring(struct audit_buffer *ab, const char *string, size_t n);
      void audit_log_untrustedstring(struct audit_buffer *ab, const char *string);
      
      This may be the first step to possibly fixing some of the issues that
      people have with the string output from the kernel audit system.  But we
      still don't have an agreed upon solution to that problem.
      Signed-off-by: default avatarEric Paris <eparis@redhat.com>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      b556f8ad
    • Eric Paris's avatar
      Audit: stop deadlock from signals under load · f09ac9db
      Eric Paris authored
      
      
      A deadlock is possible between kauditd and auditd under load if auditd
      receives a signal.  When auditd receives a signal it sends a netlink
      message to the kernel asking for information about the sender of the
      signal.  In that same context the audit system will attempt to send a
      netlink message back to the userspace auditd.  If kauditd has already
      filled the socket buffer (see netlink_attachskb()) auditd will now put
      itself to sleep waiting for room to send the message.  Since auditd is
      responsible for draining that socket we have a deadlock.  The fix, since
      the response from the kernel does not need to be synchronous is to send
      the signal information back to auditd in a separate thread.  And thus
      auditd can continue to drain the audit queue normally.
      Signed-off-by: default avatarEric Paris <eparis@redhat.com>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      f09ac9db
    • Eric Paris's avatar
      Audit: save audit_backlog_limit audit messages in case auditd comes back · f3d357b0
      Eric Paris authored
      
      
      This patch causes the kernel audit subsystem to store up to
      audit_backlog_limit messages for use by auditd if it ever appears
      sometime in the future in userspace.  This is useful to collect audit
      messages during bootup and even when auditd is stopped.  This is NOT a
      reliable mechanism, it does not ever call audit_panic, nor should it.
      audit_log_lost()/audit_panic() are called during the normal delivery
      mechanism.  The messages are still sent to printk/syslog as usual and if
      too many messages appear to be queued they will be silently discarded.
      
      I liked doing it by default, but this patch only uses the queue in
      question if it was booted with audit=1 or if the kernel was built
      enabling audit by default.
      Signed-off-by: default avatarEric Paris <eparis@redhat.com>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      f3d357b0
    • Eric Paris's avatar
      Audit: collect sessionid in netlink messages · 2532386f
      Eric Paris authored
      
      
      Previously I added sessionid output to all audit messages where it was
      available but we still didn't know the sessionid of the sender of
      netlink messages.  This patch adds that information to netlink messages
      so we can audit who sent netlink messages.
      Signed-off-by: default avatarEric Paris <eparis@redhat.com>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      2532386f
  8. 18 Apr, 2008 2 commits
  9. 28 Mar, 2008 1 commit
  10. 20 Mar, 2008 1 commit
    • Pavel Emelyanov's avatar
      audit: netlink socket can be auto-bound to pid other than current->pid (v2) · 75c0371a
      Pavel Emelyanov authored
      
      
      From:	Pavel Emelyanov <xemul@openvz.org>
      
      This patch is based on the one from Thomas.
      
      The kauditd_thread() calls the netlink_unicast() and passes 
      the audit_pid to it. The audit_pid, in turn, is received from 
      the user space and the tool (I've checked the audit v1.6.9) 
      uses getpid() to pass one in the kernel. Besides, this tool 
      doesn't bind the netlink socket to this id, but simply creates 
      it allowing the kernel to auto-bind one.
      
      That's the preamble.
      
      The problem is that netlink_autobind() _does_not_ guarantees
      that the socket will be auto-bound to the current pid. Instead
      it uses the current pid as a hint to start looking for a free
      id. So, in case of conflict, the audit messages can be sent
      to a wrong socket. This can happen (it's unlikely, but can be)
      in case some task opens more than one netlink sockets and then
      the audit one starts - in this case the audit's pid can be busy
      and its socket will be bound to another id.
      
      The proposal is to introduce an audit_nlk_pid in audit subsys,
      that will point to the netlink socket to send packets to. It
      will most often be equal to audit_pid. The socket id can be 
      got from the skb's netlink CB right in the audit_receive_msg.
      The audit_nlk_pid reset to 0 is not required, since all the
      decisions are taken based on audit_pid value only.
      
      Later, if the audit tools will bind the socket themselves, the
      kernel will have to provide a way to setup the audit_nlk_pid
      as well.
      
      A good side effect of this patch is that audit_pid can later 
      be converted to struct pid, as it is not longer safe to use 
      pid_t-s in the presence of pid namespaces. But audit code still 
      uses the tgid from task_struct in the audit_signal_info and in
      the audit_filter_syscall.
      Signed-off-by: default avatarThomas Graf <tgraf@suug.ch>
      Signed-off-by: default avatarPavel Emelyanov <xemul@openvz.org>
      Acked-by: default avatarEric Paris <eparis@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      75c0371a
  11. 01 Mar, 2008 2 commits
    • Steve Grubb's avatar
      [PATCH] drop EOE records from printk · 8d07a67c
      Steve Grubb authored
      
      
      Hi,
      
      While we are looking at the printk issue, I see that its printk'ing the EOE
      (end of event) records which is really not something that we need in syslog.
      Its really intended for the realtime audit event stream handled by the audit
      daemon. So, lets avoid printk'ing that record type.
      Signed-off-by: default avatarSteve Grubb <sgrubb@redhat.com>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      8d07a67c
    • Eric Paris's avatar
      [RFC] AUDIT: do not panic when printk loses messages · b29ee87e
      Eric Paris authored
      
      
      On the latest kernels if one was to load about 15 rules, set the failure
      state to panic, and then run service auditd stop the kernel will panic.
      This is because auditd stops, then the script deletes all of the rules.
      These deletions are sent as audit messages out of the printk kernel
      interface which is already known to be lossy.  These will overun the
      default kernel rate limiting (10 really fast messages) and will call
      audit_panic().  The same effect can happen if a slew of avc's come
      through while auditd is stopped.
      
      This can be fixed a number of ways but this patch fixes the problem by
      just not panicing if auditd is not running.  We know printk is lossy and
      if the user chooses to set the failure mode to panic and tries to use
      printk we can't make any promises no matter how hard we try, so why try?
      At least in this way we continue to get lost message accounting and will
      eventually know that things went bad.
      
      The other change is to add a new call to audit_log_lost() if auditd
      disappears.  We already pulled the skb off the queue and couldn't send
      it so that message is lost.  At least this way we will account for the
      last message and panic if the machine is configured to panic.  This code
      path should only be run if auditd dies for unforeseen reasons.  If
      auditd closes correctly audit_pid will get set to 0 and we won't walk
      this code path.
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      b29ee87e
  12. 15 Feb, 2008 2 commits
  13. 01 Feb, 2008 9 commits
  14. 21 Oct, 2007 1 commit
    • Al Viro's avatar
      [PATCH] audit: watching subtrees · 74c3cbe3
      Al Viro authored
      
      
      New kind of audit rule predicates: "object is visible in given subtree".
      The part that can be sanely implemented, that is.  Limitations:
      	* if you have hardlink from outside of tree, you'd better watch
      it too (or just watch the object itself, obviously)
      	* if you mount something under a watched tree, tell audit
      that new chunk should be added to watched subtrees
      	* if you umount something in a watched tree and it's still mounted
      elsewhere, you will get matches on events happening there.  New command
      tells audit to recalculate the trees, trimming such sources of false
      positives.
      
      Note that it's _not_ about path - if something mounted in several places
      (multiple mount, bindings, different namespaces, etc.), the match does
      _not_ depend on which one we are using for access.
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      74c3cbe3