linux-stable.git/kernel/auditsc.c, branch v6.1.2

Merge tag 'audit-pr-20221003' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit

2022-10-04T18:05:43+00:00

Pull audit updates from Paul Moore:
 "Six audit patches for v6.1, most are pretty trivial, but a quick list
  of the highlights are below:

   - Only free the audit proctitle information on task exit. This allows
     us to cache the information and improve performance slightly.

   - Use the time_after() macro to do time comparisons instead of doing
     it directly and potentially causing ourselves problems when the
     timer wraps.

   - Convert an audit_context state comparison from a relative enum
     comparison, e.g. (x < y), to a not-equal comparison to ensure that
     we are not caught out at some unknown point in the future by an
     enum shuffle.

   - A handful of small cleanups such as tidying up comments and
     removing unused declarations"

* tag 'audit-pr-20221003' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
  audit: remove selinux_audit_rule_update() declaration
  audit: use time_after to compare time
  audit: free audit_proctitle only on task exit
  audit: explicitly check audit_context->context enum value
  audit: audit_context pid unused, context enum comment fix
  audit: fix repeated words in comments

audit: free audit_proctitle only on task exit

2022-08-26T21:18:54+00:00

Since audit_proctitle is generated at syscall exit time, its value is
used immediately and cached for the next syscall.  Since this is the
case, then only clear it at task exit time.  Otherwise, there is no
point in caching the value OR bearing the overhead of regenerating it.

Fixes: 12c5e81d3fd0 ("audit: prepare audit_context for use in calling contexts beyond syscalls")
Signed-off-by: Richard Guy Briggs 
Signed-off-by: Paul Moore

audit: explicitly check audit_context->context enum value

2022-08-26T21:17:11+00:00

Be explicit in checking the struct audit_context "context" member enum
value rather than assuming the order of context enum values.

Fixes: 12c5e81d3fd0 ("audit: prepare audit_context for use in calling contexts beyond syscalls")
Signed-off-by: Richard Guy Briggs 
Signed-off-by: Paul Moore

audit: audit_context pid unused, context enum comment fix

2022-08-26T21:06:00+00:00

The pid member of struct audit_context is never used.  Remove it.

The audit_reset_context() comment about unconditionally resetting
"ctx->state" should read "ctx->context".

Signed-off-by: Richard Guy Briggs 
Signed-off-by: Paul Moore

audit: move audit_return_fixup before the filters

2022-08-25T21:25:08+00:00

The success and return_code are needed by the filters.  Move
audit_return_fixup() before the filters.  This was causing syscall
auditing events to be missed.

Link: https://github.com/linux-audit/audit-kernel/issues/138
Cc: stable@vger.kernel.org
Fixes: 12c5e81d3fd0 ("audit: prepare audit_context for use in calling contexts beyond syscalls")
Signed-off-by: Richard Guy Briggs 
[PM: manual merge required]
Signed-off-by: Paul Moore

audit: fix repeated words in comments

2022-08-16T02:46:09+00:00

Delete the redundant word 'doesn't'.

Signed-off-by: Jilin Yuan 
[PM: subject line tweak]
Signed-off-by: Paul Moore

audit, io_uring, io-wq: Fix memory leak in io_sq_thread() and io_wqe_worker()

2022-08-04T14:33:54+00:00

Currently @audit_context is allocated twice for io_uring workers:

  1. copy_process() calls audit_alloc();
  2. io_sq_thread() or io_wqe_worker() calls audit_alloc_kernel() (which
     is effectively audit_alloc()) and overwrites @audit_context,
     causing:

  BUG: memory leak
  unreferenced object 0xffff888144547400 (size 1024):
<...>
    hex dump (first 32 bytes):
      00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00  ................
      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    backtrace:
      [] audit_alloc+0x133/0x210
      [] copy_process+0xcd3/0x2340
      [] create_io_thread+0x63/0x90
      [] create_io_worker+0xb4/0x230
      [] io_wqe_enqueue+0x248/0x3b0
      [] io_queue_iowq+0xba/0x200
      [] io_queue_async+0x113/0x180
      [] io_req_task_submit+0x18f/0x1a0
      [] io_apoll_task_func+0xdd/0x120
      [] tctx_task_work+0x11f/0x570
      [] task_work_run+0x7e/0xc0
      [] get_signal+0xc18/0xf10
      [] arch_do_signal_or_restart+0x2b/0x730
      [] exit_to_user_mode_prepare+0x5e/0x180
      [] syscall_exit_to_user_mode+0x12/0x20
      [] do_syscall_64+0x40/0x80

Then,

  3. io_sq_thread() or io_wqe_worker() frees @audit_context using
     audit_free();
  4. do_exit() eventually calls audit_free() again, which is okay
     because audit_free() does a NULL check.

As suggested by Paul Moore, fix it by deleting audit_alloc_kernel() and
redundant audit_free() calls.

Fixes: 5bd2182d58e9 ("audit,io_uring,io-wq: add some basic audit support to io_uring")
Suggested-by: Paul Moore 
Cc: stable@vger.kernel.org
Signed-off-by: Peilin Ye 
Acked-by: Paul Moore 
Link: https://lore.kernel.org/r/20220803222343.31673-1-yepeilin.cs@gmail.com
Signed-off-by: Jens Axboe

audit: free module name

2022-06-15T23:28:44+00:00

Reset the type of the record last as the helper `audit_free_module()`
depends on it.

    unreferenced object 0xffff888153b707f0 (size 16):
      comm "modprobe", pid 1319, jiffies 4295110033 (age 1083.016s)
      hex dump (first 16 bytes):
        62 69 6e 66 6d 74 5f 6d 69 73 63 00 6b 6b 6b a5  binfmt_misc.kkk.
      backtrace:
        [] kstrdup+0x2b/0x50
        [] __audit_log_kern_module+0x4d/0xf0
        [] load_module+0x9d4/0x2e10
        [] __do_sys_finit_module+0x114/0x1b0
        [] do_syscall_64+0x34/0x80
        [] entry_SYSCALL_64_after_hwframe+0x46/0xb0

Cc: stable@vger.kernel.org
Fixes: 12c5e81d3fd0 ("audit: prepare audit_context for use in calling contexts beyond syscalls")
Signed-off-by: Christian Göttsche 
Signed-off-by: Paul Moore

audit,io_uring,io-wq: call __audit_uring_exit for dummy contexts

2022-05-17T19:03:36+00:00

Not calling the function for dummy contexts will cause the context to
not be reset. During the next syscall, this will cause an error in
__audit_syscall_entry:

	WARN_ON(context->context != AUDIT_CTX_UNUSED);
	WARN_ON(context->name_count);
	if (context->context != AUDIT_CTX_UNUSED || context->name_count) {
		audit_panic("unrecoverable error in audit_syscall_entry()");
		return;
	}

These problematic dummy contexts are created via the following call
chain:

       exit_to_user_mode_prepare
    -> arch_do_signal_or_restart
    -> get_signal
    -> task_work_run
    -> tctx_task_work
    -> io_req_task_submit
    -> io_issue_sqe
    -> audit_uring_entry

Cc: stable@vger.kernel.org
Fixes: 5bd2182d58e9 ("audit,io_uring,io-wq: add some basic audit support to io_uring")
Signed-off-by: Julian Orth 
[PM: subject line tweaks]
Signed-off-by: Paul Moore

Merge tag 'audit-pr-20220321' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit

2022-03-22T03:53:11+00:00

Pull audit update from Paul Moore:
 "Just one audit patch queued for v5.18:

   - Change the AUDIT_TIME_* record generation so that they are
     generated at syscall exit time and subject to all of the normal
     syscall exit filtering.

     This should help reduce noise and ensure those records which are
     most relevant to the admin's audit configuration are recorded in
     the audit log"

* tag 'audit-pr-20220321' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
  audit: log AUDIT_TIME_* records only from rules