linux-stable.git/kernel/audit.c, branch v6.12.91

audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV

2026-05-23T11:04:59+00:00

commit f9e1c1324b4d98d591a6f7568fdebf5cf456dfc2 upstream.

AUDIT_ADD_RULE and AUDIT_DEL_RULE correctly check for AUDIT_LOCKED
and return -EPERM, but AUDIT_TRIM and AUDIT_MAKE_EQUIV do not. This
allows a process with CAP_AUDIT_CONTROL to modify directory tree
watches and equivalence mappings even when the audit configuration
has been locked, undermining the purpose of the lock.

Add AUDIT_LOCKED checks to both commands.

Cc: stable@vger.kernel.org
Reviewed-by: Ricardo Robaina 
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Sergio Correia 
Signed-off-by: Paul Moore 
Signed-off-by: Greg Kroah-Hartman

audit: Make use of str_enabled_disabled() helper

2024-09-03T20:35:16+00:00

Use str_enabled_disabled() helper instead of open
coding the same.

Signed-off-by: Hongbo Li 
Signed-off-by: Paul Moore

audit: use task_tgid_nr() instead of task_pid_nr()

2024-08-28T20:48:28+00:00

In a few audit records, PIDs were being recorded with task_pid_nr()
instead of task_tgid_nr().

$ grep "task_pid_nr" kernel/audit*.c
audit.c:       task_pid_nr(current),
auditfilter.c: pid = task_pid_nr(current);
auditsc.c:     audit_log_format(ab, " pid=%u", task_pid_nr(current));

For single-thread applications, the process id (pid) and the thread
group id (tgid) are the same. However, on multi-thread applications,
task_pid_nr() returns the current thread id (user-space's TID), while
task_tgid_nr() returns the main thread id (user-space's PID). Since
the users are more interested in the process id (pid), rather than the
thread id (tid), this patch converts these callers to the correct method.

Link: https://github.com/linux-audit/audit-kernel/issues/126

Reviewed-by: Richard Guy Briggs 
Signed-off-by: Ricardo Robaina 
Signed-off-by: Paul Moore

audit: use KMEM_CACHE() instead of kmem_cache_create()

2024-01-25T15:12:22+00:00

Use the new KMEM_CACHE() macro instead of direct kmem_cache_create
to simplify the creation of SLAB caches.

Signed-off-by: Kunwu Chan 
[PM: subject line tweaks]
Signed-off-by: Paul Moore

audit: Send netlink ACK before setting connection in auditd_set

2023-11-13T03:33:49+00:00

When auditd_set sets the auditd_conn pointer, audit messages can
immediately be put on the socket by other kernel threads. If the backlog
is large or the rate is high, this can immediately fill the socket
buffer. If the audit daemon requested an ACK for this operation, a full
socket buffer causes the ACK to get dropped, also setting ENOBUFS on the
socket.

To avoid this race and ensure ACKs get through, fast-track the ACK in
this specific case to ensure it is sent before auditd_conn is set.

Signed-off-by: Chris Riches 
[PM: fix some tab vs space damage]
Signed-off-by: Paul Moore

audit: move trailing statements to next line

2023-08-15T22:16:14+00:00

Fixes following checkpatch.pl issue:
ERROR: trailing statements should be on next line

Signed-off-by: Atul Kumar Pant 
[PM: subject line tweak]
Signed-off-by: Paul Moore

audit: include security.h unconditionally

2023-07-20T19:06:58+00:00

The ifdef-else logic is already in the header file, so include it
unconditionally, no functional changes here.

Signed-off-by: Xiu Jianfeng 
[PM: fixed misspelling in the subject]
Signed-off-by: Paul Moore

audit: use time_after to compare time

2022-08-29T23:47:03+00:00

Using time_{*} macro to compare time is better

Signed-off-by: wuchi 
Signed-off-by: Paul Moore

audit: make is_audit_feature_set() static

2022-06-13T18:08:57+00:00

Currently nobody use is_audit_feature_set() outside this file, so make
it static.

Signed-off-by: Xiu Jianfeng 
Signed-off-by: Paul Moore

audit: remove redundant data_len check

2022-06-07T19:41:34+00:00

data_len is already getting checked if it's less than 2 earlier in this
function.

Signed-off-by: Shreenidhi Shedi 
Signed-off-by: Paul Moore