linux-stable.git/include/linux/audit.h, branch v3.9.4

audit: Make testing for a valid loginuid explicit.

2013-05-19T18:38:47+00:00

commit 780a7654cee8d61819512385e778e4827db4bfbc upstream.

audit rule additions containing "-F auid!=4294967295" were failing
with EINVAL because of a regression caused by e1760bd.

Apparently some userland audit rule sets want to know if loginuid uid
has been set and are using a test for auid != 4294967295 to determine
that.

In practice that is a horrible way to ask if a value has been set,
because it relies on subtle implementation details and will break
every time the uid implementation in the kernel changes.

So add a clean way to test if the audit loginuid has been set, and
silently convert the old idiom to the cleaner and more comprehensible
new idiom.

RGB notes: In upstream, audit_rule_to_entry has been refactored out.
This is patch is already upstream in functionally the same form in
commit 780a7654cee8d61819512385e778e4827db4bfbc .  The decimal constant
was cast to unsigned to quiet GCC 4.6 32-bit architecture warnings.

Reported-By: Steve Grubb 
Signed-off-by: "Eric W. Biederman" 
Tested-by: Richard Guy Briggs 
Signed-off-by: Eric Paris 
Backported-by: Richard Guy Briggs 
Signed-off-by: Greg Kroah-Hartman

audit: Syscall rules are not applied to existing processes on non-x86

2013-05-19T18:38:24+00:00

commit cdee3904b4ce7c03d1013ed6dd704b43ae7fc2e9 upstream.

Commit b05d8447e782 (audit: inline audit_syscall_entry to reduce
burden on archs) changed audit_syscall_entry to check for a dummy
context before calling __audit_syscall_entry. Unfortunately the dummy
context state is maintained in __audit_syscall_entry so once set it
never gets cleared, even if the audit rules change.

As a result, if there are no auditing rules when a process starts
then it will never be subject to any rules added later. x86 doesn't
see this because it has an assembly fast path that calls directly into
__audit_syscall_entry.

I noticed this issue when working on audit performance optimisations.
I wrote a set of simple test cases available at:

http://ozlabs.org/~anton/junkcode/audit_tests.tar.gz

02_new_rule.py fails without the patch and passes with it. The
test case clears all rules, starts a process, adds a rule then
verifies the process produces a syscall audit record.

Signed-off-by: Anton Blanchard 
Signed-off-by: Eric Paris 
Signed-off-by: Greg Kroah-Hartman

linux/audit.h: move ptrace.h include to kernel header

2013-01-11T22:54:56+00:00

While the kernel internals want pt_regs (and so it includes
linux/ptrace.h), the user version of audit.h does not need it.  So move
the include out of the uapi version.

This avoids issues where people want the audit defines and userland
ptrace api.  Including both the kernel ptrace and the userland ptrace
headers can easily lead to failure.

Signed-off-by: Mike Frysinger 
Cc: Eric Paris 
Cc: Al Viro 
Reviewed-by: Kees Cook 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

audit: create explicit AUDIT_SECCOMP event type

2013-01-11T22:54:55+00:00

The seccomp path was using AUDIT_ANOM_ABEND from when seccomp mode 1
could only kill a process.  While we still want to make sure an audit
record is forced on a kill, this should use a separate record type since
seccomp mode 2 introduces other behaviors.

In the case of "handled" behaviors (process wasn't killed), only emit a
record if the process is under inspection.  This change also fixes
userspace examination of seccomp audit events, since it was considered
malformed due to missing fields of the AUDIT_ANOM_ABEND event type.

Signed-off-by: Kees Cook 
Cc: Al Viro 
Cc: Eric Paris 
Cc: Jeff Layton 
Cc: "Eric W. Biederman" 
Cc: Julien Tinnes 
Acked-by: Will Drewry 
Acked-by: Steve Grubb 
Cc: Andrea Arcangeli 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

UAPI: (Scripted) Disintegrate include/linux

2012-10-13T09:46:48+00:00

Signed-off-by: David Howells 
Acked-by: Arnd Bergmann 
Acked-by: Thomas Gleixner 
Acked-by: Michael Kerrisk 
Acked-by: Paul E. McKenney 
Acked-by: Dave Jones

Merge tag 'for-3.7' of git://openrisc.net/jonas/linux

2012-10-13T02:25:41+00:00

Pull OpenRISC updates from Jonas Bonn:
 "Fixups for some corner cases, build issues, and some obvious bugs in
  IRQ handling.  No major changes."

* tag 'for-3.7' of git://openrisc.net/jonas/linux:
  openrisc: mask interrupts in irq_mask_ack function
  openrisc: fix typos in comments and warnings
  openrisc: PIC should act on domain-local irqs
  openrisc: Make cpu_relax() invoke barrier()
  audit: define AUDIT_ARCH_OPENRISC
  openrisc: delay: fix handling of counter overflow
  openrisc: delay: fix loops calculation for __const_udelay

audit: make audit_inode take struct filename

2012-10-13T00:15:09+00:00

Keep a pointer to the audit_names "slot" in struct filename.

Have all of the audit_inode callers pass a struct filename ponter to
audit_inode instead of a string pointer. If the aname field is already
populated, then we can skip walking the list altogether and just use it
directly.

Signed-off-by: Jeff Layton 
Signed-off-by: Al Viro

audit: allow audit code to satisfy getname requests from its names_list

2012-10-13T00:15:08+00:00

Currently, if we call getname() on a userland string more than once,
we'll get multiple copies of the string and multiple audit_names
records.

Add a function that will allow the audit_names code to satisfy getname
requests using info from the audit_names list, avoiding a new allocation
and audit_names records.

Signed-off-by: Jeff Layton 
Signed-off-by: Al Viro

vfs: define struct filename and have getname() return it

2012-10-13T00:14:55+00:00

getname() is intended to copy pathname strings from userspace into a
kernel buffer. The result is just a string in kernel space. It would
however be quite helpful to be able to attach some ancillary info to
the string.

For instance, we could attach some audit-related info to reduce the
amount of audit-related processing needed. When auditing is enabled,
we could also call getname() on the string more than once and not
need to recopy it from userspace.

This patchset converts the getname()/putname() interfaces to return
a struct instead of a string. For now, the struct just tracks the
string in kernel space and the original userland pointer for it.

Later, we'll add other information to the struct as it becomes
convenient.

Signed-off-by: Jeff Layton 
Signed-off-by: Al Viro

audit: overhaul __audit_inode_child to accomodate retrying

2012-10-12T04:32:03+00:00

In order to accomodate retrying path-based syscalls, we need to add a
new "type" argument to audit_inode_child. This will tell us whether
we're looking for a child entry that represents a create or a delete.

If we find a parent, don't automatically assume that we need to create a
new entry. Instead, use the information we have to try to find an
existing entry first. Update it if one is found and create a new one if
not.

Signed-off-by: Jeff Layton 
Signed-off-by: Al Viro