linux-stable.git/include/linux/audit.h, branch v3.14.78

audit: restore AUDIT_LOGINUID unset ABI

2015-01-08T18:00:50+00:00

commit 041d7b98ffe59c59fdd639931dea7d74f9aa9a59 upstream.

A regression was caused by commit 780a7654cee8:
	 audit: Make testing for a valid loginuid explicit.
(which in turn attempted to fix a regression caused by e1760bd)

When audit_krule_to_data() fills in the rules to get a listing, there was a
missing clause to convert back from AUDIT_LOGINUID_SET to AUDIT_LOGINUID.

This broke userspace by not returning the same information that was sent and
expected.

The rule:
	auditctl -a exit,never -F auid=-1
gives:
	auditctl -l
		LIST_RULES: exit,never f24=0 syscall=all
when it should give:
		LIST_RULES: exit,never auid=-1 (0xffffffff) syscall=all

Tag it so that it is reported the same way it was set.  Create a new
private flags audit_krule field (pflags) to store it that won't interact with
the public one from the API.

Signed-off-by: Richard Guy Briggs 
Signed-off-by: Paul Moore 
Signed-off-by: Greg Kroah-Hartman

audit: Send replies in the proper network namespace.

2014-03-01T03:44:55+00:00

In perverse cases of file descriptor passing the current network
namespace of a process and the network namespace of a socket used by
that socket may differ.  Therefore use the network namespace of the
appropiate socket to ensure replies always go to the appropiate
socket.

Signed-off-by: "Eric W. Biederman"

audit: Convert int limit uses to u32

2014-01-14T19:54:00+00:00

The equivalent uapi struct uses __u32 so make the kernel
uses u32 too.

This can prevent some oddities where the limit is
logged/emitted as a negative value.

Convert kstrtol to kstrtouint to disallow negative values.

Signed-off-by: Joe Perches 
[eparis: do not remove static from audit_default declaration]

audit: correct a type mismatch in audit_syscall_exit()

2014-01-14T03:38:19+00:00

audit_syscall_exit() saves a result of regs_return_value() in intermediate
"int" variable and passes it to __audit_syscall_exit(), which expects its
second argument as a "long" value.  This will result in truncating the
value returned by a system call and making a wrong audit record.

I don't know why gcc compiler doesn't complain about this, but anyway it
causes a problem at runtime on arm64 (and probably most 64-bit archs).

Signed-off-by: AKASHI Takahiro 
Cc: Al Viro 
Cc: Eric Paris 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Eric Paris

audit: refactor audit_receive_msg() to clarify AUDIT__RULE cases

2014-01-14T03:31:22+00:00

audit_receive_msg() needlessly contained a fallthrough case that called
audit_receive_filter(), containing no common code between the cases.  Separate
them to make the logic clearer.  Refactor AUDIT_LIST_RULES, AUDIT_ADD_RULE,
AUDIT_DEL_RULE cases to create audit_rule_change(), audit_list_rules_send()
functions.  This should not functionally change the logic.

Signed-off-by: Richard Guy Briggs 
Signed-off-by: Eric Paris

audit: fix incorrect type of sessionid

2014-01-14T03:30:32+00:00

The type of task->sessionid is unsigned int, the return
type of audit_get_sessionid should be consistent with it.

Signed-off-by: Gao feng 
Signed-off-by: Richard Guy Briggs 
Signed-off-by: Eric Paris

audit: fix netlink portid naming and types

2014-01-14T03:26:52+00:00

Normally, netlink ports use the PID of the userspace process as the port ID.
If the PID is already in use by a port, the kernel will allocate another port
ID to avoid conflict.  Re-name all references to netlink ports from pid to
portid to reflect this reality and avoid confusion with actual PIDs.  Ports
use the __u32 type, so re-type all portids accordingly.

(This patch is very similar to ebiederman's 5deadd69)

Signed-off-by: Richard Guy Briggs 
Signed-off-by: Gao feng 
Signed-off-by: Eric Paris

audit: Simplify and correct audit_log_capset

2014-01-14T03:26:48+00:00

- Always report the current process as capset now always only works on
  the current process.  This prevents reporting 0 or a random pid in
  a random pid namespace.

- Don't bother to pass the pid as is available.

Signed-off-by: "Eric W. Biederman" 
(cherry picked from commit bcc85f0af31af123e32858069eb2ad8f39f90e67)
(cherry picked from commit f911cac4556a7a23e0b3ea850233d13b32328692)

Signed-off-by: Richard Guy Briggs 
[eparis: fix build error when audit disabled]
Signed-off-by: Eric Paris

audit: call audit_bprm() only once to add AUDIT_EXECVE information

2013-11-05T16:15:03+00:00

Move the audit_bprm() call from search_binary_handler() to exec_binprm().  This
allows us to get rid of the mm member of struct audit_aux_data_execve since
bprm->mm will equal current->mm.

This also mitigates the issue that ->argc could be modified by the
load_binary() call in search_binary_handler().

audit_bprm() was being called to add an AUDIT_EXECVE record to the audit
context every time search_binary_handler() was recursively called.  Only one
reference is necessary.

Reported-by: Oleg Nesterov 
Cc: Eric Paris 
Signed-off-by: Richard Guy Briggs 
Signed-off-by: Eric Paris 
---
This patch is against 3.11, but was developed on Oleg's post-3.11 patches that
introduce exec_binprm().

audit: move audit_aux_data_execve contents into audit_context union

2013-11-05T16:09:36+00:00

audit_bprm() was being called to add an AUDIT_EXECVE record to the audit
context every time search_binary_handler() was recursively called.  Only one
reference is necessary, so just update it.  Move the the contents of
audit_aux_data_execve into the union in audit_context, removing dependence on a
kmalloc along the way.

Reported-by: Oleg Nesterov 
Cc: Eric Paris 
Signed-off-by: Richard Guy Briggs 
Signed-off-by: Eric Paris