linux.git/drivers/char/tty_audit.c, branch v2.6.32

tty: remove buffer special casing

2009-06-11T15:51:02+00:00

Long long ago a 4K kmalloc allocated two pages so the tty layer used the
page allocator, except on some machines where the page size was huge. This was
removed from the core tty layer with the tty buffer re-implementation but not
from tty_audit or the n_tty ldisc.

Signed-off-by: Alan Cox 
Signed-off-by: Linus Torvalds

Trim includes of fdtable.h

2009-04-01T03:00:28+00:00

Signed-off-by: Al Viro

Audit: Log TIOCSTI

2008-12-09T09:32:06+00:00

AUDIT_TTY records currently log all data read by processes marked for
TTY input auditing, even if the data was "pushed back" using the TIOCSTI
ioctl, not typed by the user.

This patch records all TIOCSTI calls to disambiguate the input.  It
generates one audit message per character pushed back; considering
TIOCSTI is used very rarely, this simple solution is probably good
enough.  (The only program I could find that uses TIOCSTI is mailx/nail
in "header editing" mode, e.g. using the ~h escape.  mailx is used very
rarely, and the escapes are used even rarer.)

Signed-Off-By: Miloslav Trmac 
Signed-off-by: Al Viro 
Signed-off-by: James Morris

CRED: Wrap task credential accesses in the tty driver

2008-11-13T23:38:41+00:00

Wrap access to task credentials so that they can be separated more easily from
the task_struct during the introduction of COW creds.

Change most current->(|e|s|fs)[ug]id to current_(|e|s|fs)[ug]id().

Change some task->e?[ug]id to task_e?[ug]id().  In some places it makes more
sense to use RCU directly rather than a convenient wrapper; these will be
addressed by later patches.

Signed-off-by: David Howells 
Reviewed-by: James Morris 
Acked-by: Serge Hallyn 
Cc: Alan Cox 
Signed-off-by: James Morris

audit: Handle embedded NUL in TTY input auditing

2008-10-13T16:51:39+00:00

Data read from a TTY can contain an embedded NUL byte (e.g. after
pressing Ctrl-2, or sent to a PTY).  After the previous patch, the data
would be logged only up to the first NUL.

This patch modifies the AUDIT_TTY record to always use the hexadecimal
format, which does not terminate at the first NUL byte.  The vast
majority of recorded TTY input data will contain either ' ' or '\n', so
the hexadecimal format would have been used anyway.

Signed-off-by: Miloslav Trmac 
Signed-off-by: Alan Cox 
Signed-off-by: Linus Torvalds

[PATCH] split linux/file.h

2008-05-01T17:08:16+00:00

Initial splitoff of the low-level stuff; taken to fdtable.h

Signed-off-by: Al Viro

[patch 1/2] audit: let userspace fully control TTY input auditing

2008-04-28T10:28:24+00:00

Remove the code that automatically disables TTY input auditing in processes
that open TTYs when they have no other TTY open; this heuristic was
intended to automatically handle daemons, but it has false positives (e.g.
with sshd) that make it impossible to control TTY input auditing from a PAM
module.  With this patch, TTY input auditing is controlled from user-space
only.

On the other hand, not even for daemons does it make sense to audit "input"
from PTY masters; this data was produced by a program writing to the PTY
slave, and does not represent data entered by the user.

Signed-off-by: Miloslav Trmac 
Cc: Al Viro 
Cc: David Woodhouse 
Signed-off-by: Andrew Morton 
Signed-off-by: Al Viro

Audit: standardize string audit interfaces

2008-04-28T10:19:22+00:00

This patch standardized the string auditing interfaces.  No userspace
changes will be visible and this is all just cleanup and consistancy
work.  We have the following string audit interfaces to use:

void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf, size_t len);

void audit_log_n_string(struct audit_buffer *ab, const char *buf, size_t n);
void audit_log_string(struct audit_buffer *ab, const char *buf);

void audit_log_n_untrustedstring(struct audit_buffer *ab, const char *string, size_t n);
void audit_log_untrustedstring(struct audit_buffer *ab, const char *string);

This may be the first step to possibly fixing some of the issues that
people have with the string output from the kernel audit system.  But we
still don't have an agreed upon solution to that problem.

Signed-off-by: Eric Paris 
Signed-off-by: Al Viro

Audit: collect sessionid in netlink messages

2008-04-28T10:18:03+00:00

Previously I added sessionid output to all audit messages where it was
available but we still didn't know the sessionid of the sender of
netlink messages.  This patch adds that information to netlink messages
so we can audit who sent netlink messages.

Signed-off-by: Eric Paris 
Signed-off-by: Al Viro

tty_audit: fix checkpatch complaint

2008-02-08T17:22:25+00:00

Signed-off-by: Alan Cox 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds