From 0c11b9428f619ab377c92eff2f160a834a6585dd Mon Sep 17 00:00:00 2001 From: Al Viro Date: Thu, 10 Jan 2008 04:20:52 -0500 Subject: [PATCH] switch audit_get_loginuid() to task_struct * all callers pass something->audit_context Signed-off-by: Al Viro --- include/linux/audit.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/audit.h b/include/linux/audit.h index bdd6f5de5fc..f63117fab30 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -409,7 +409,7 @@ extern unsigned int audit_serial(void); extern void auditsc_get_stamp(struct audit_context *ctx, struct timespec *t, unsigned int *serial); extern int audit_set_loginuid(struct task_struct *task, uid_t loginuid); -extern uid_t audit_get_loginuid(struct audit_context *ctx); +extern uid_t audit_get_loginuid(struct task_struct *task); extern void audit_log_task_context(struct audit_buffer *ab); extern int __audit_ipc_obj(struct kern_ipc_perm *ipcp); extern int __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode); @@ -488,7 +488,7 @@ extern int audit_signals; #define audit_inode_child(d,i,p) do { ; } while (0) #define audit_core_dumps(i) do { ; } while (0) #define auditsc_get_stamp(c,t,s) do { BUG(); } while (0) -#define audit_get_loginuid(c) ({ -1; }) +#define audit_get_loginuid(t) (-1) #define audit_log_task_context(b) do { ; } while (0) #define audit_ipc_obj(i) ({ 0; }) #define audit_ipc_set_perm(q,u,g,m) ({ 0; }) -- cgit v1.2.3 From bfef93a5d1fb5654fe2025276c55e202d10b5255 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Thu, 10 Jan 2008 04:53:18 -0500 Subject: [PATCH] get rid of loginuid races Keeping loginuid in audit_context is racy and results in messier code. Taken to task_struct, out of the way of ->audit_context changes. Signed-off-by: Al Viro --- include/linux/audit.h | 2 +- include/linux/init_task.h | 7 +++++++ include/linux/sched.h | 3 +++ 3 files changed, 11 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/audit.h b/include/linux/audit.h index f63117fab30..d7c6a12f4d1 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -409,7 +409,7 @@ extern unsigned int audit_serial(void); extern void auditsc_get_stamp(struct audit_context *ctx, struct timespec *t, unsigned int *serial); extern int audit_set_loginuid(struct task_struct *task, uid_t loginuid); -extern uid_t audit_get_loginuid(struct task_struct *task); +#define audit_get_loginuid(t) ((t)->loginuid) extern void audit_log_task_context(struct audit_buffer *ab); extern int __audit_ipc_obj(struct kern_ipc_perm *ipcp); extern int __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode); diff --git a/include/linux/init_task.h b/include/linux/init_task.h index e6b3f708067..ea3e9efd739 100644 --- a/include/linux/init_task.h +++ b/include/linux/init_task.h @@ -114,6 +114,12 @@ extern struct group_info init_groups; .pid = &init_struct_pid, \ } +#ifdef CONFIG_AUDITSYSCALL +#define INIT_IDS \ + .loginuid = -1, +#else +#define INIT_IDS +#endif /* * INIT_TASK is used to set up the first task table, touch at * your own risk!. Base=0, limit=0x1fffff (=2MB) @@ -173,6 +179,7 @@ extern struct group_info init_groups; [PIDTYPE_SID] = INIT_PID_LINK(PIDTYPE_SID), \ }, \ .dirties = INIT_PROP_LOCAL_SINGLE(dirties), \ + INIT_IDS \ INIT_TRACE_IRQFLAGS \ INIT_LOCKDEP \ } diff --git a/include/linux/sched.h b/include/linux/sched.h index 6c333579d9d..5e273038908 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -1139,6 +1139,9 @@ struct task_struct { void *security; #endif struct audit_context *audit_context; +#ifdef CONFIG_AUDITSYSCALL + uid_t loginuid; +#endif seccomp_t seccomp; /* Thread group tracking */ -- cgit v1.2.3 From 4746ec5b01ed07205a91e4f7ed9de9d70f371407 Mon Sep 17 00:00:00 2001 From: Eric Paris Date: Tue, 8 Jan 2008 10:06:53 -0500 Subject: [AUDIT] add session id to audit messages In order to correlate audit records to an individual login add a session id. This is incremented every time a user logs in and is included in almost all messages which currently output the auid. The field is labeled ses= or oses= Signed-off-by: Eric Paris --- include/linux/audit.h | 2 ++ include/linux/init_task.h | 3 ++- include/linux/sched.h | 1 + 3 files changed, 5 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/audit.h b/include/linux/audit.h index d7c6a12f4d1..52f1b12505a 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -410,6 +410,7 @@ extern void auditsc_get_stamp(struct audit_context *ctx, struct timespec *t, unsigned int *serial); extern int audit_set_loginuid(struct task_struct *task, uid_t loginuid); #define audit_get_loginuid(t) ((t)->loginuid) +#define audit_get_sessionid(t) ((t)->sessionid) extern void audit_log_task_context(struct audit_buffer *ab); extern int __audit_ipc_obj(struct kern_ipc_perm *ipcp); extern int __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode); @@ -489,6 +490,7 @@ extern int audit_signals; #define audit_core_dumps(i) do { ; } while (0) #define auditsc_get_stamp(c,t,s) do { BUG(); } while (0) #define audit_get_loginuid(t) (-1) +#define audit_get_sessionid(t) (-1) #define audit_log_task_context(b) do { ; } while (0) #define audit_ipc_obj(i) ({ 0; }) #define audit_ipc_set_perm(q,u,g,m) ({ 0; }) diff --git a/include/linux/init_task.h b/include/linux/init_task.h index ea3e9efd739..f42663eaf65 100644 --- a/include/linux/init_task.h +++ b/include/linux/init_task.h @@ -116,7 +116,8 @@ extern struct group_info init_groups; #ifdef CONFIG_AUDITSYSCALL #define INIT_IDS \ - .loginuid = -1, + .loginuid = -1, \ + .sessionid = -1, #else #define INIT_IDS #endif diff --git a/include/linux/sched.h b/include/linux/sched.h index 5e273038908..af6947e69b4 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -1141,6 +1141,7 @@ struct task_struct { struct audit_context *audit_context; #ifdef CONFIG_AUDITSYSCALL uid_t loginuid; + unsigned int sessionid; #endif seccomp_t seccomp; -- cgit v1.2.3 From c0641f28dcbecb6dc34a4fd003a9947fcd080696 Mon Sep 17 00:00:00 2001 From: Eric Paris Date: Mon, 7 Jan 2008 13:49:15 -0500 Subject: [AUDIT] Add End of Event record This patch adds an end of event record type. It will be sent by the kernel as the last record when a multi-record event is triggered. This will aid realtime analysis programs since they will now reliably know they have the last record to complete an event. The audit daemon filters this and will not write it to disk. Signed-off-by: Steve Grubb Signed-off-by: Eric Paris --- include/linux/audit.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/audit.h b/include/linux/audit.h index 52f1b12505a..4d1c2f2fcc1 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -98,6 +98,7 @@ #define AUDIT_FD_PAIR 1317 /* audit record for pipe/socketpair */ #define AUDIT_OBJ_PID 1318 /* ptrace target */ #define AUDIT_TTY 1319 /* Input on an administrative TTY */ +#define AUDIT_EOE 1320 /* End of multi-record event */ #define AUDIT_AVC 1400 /* SE Linux avc denial or grant */ #define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */ -- cgit v1.2.3 From de6bbd1d30e5912620d25dd15e3f180ac7f9fcef Mon Sep 17 00:00:00 2001 From: Eric Paris Date: Mon, 7 Jan 2008 14:31:58 -0500 Subject: [AUDIT] break large execve argument logging into smaller messages execve arguments can be quite large. There is no limit on the number of arguments and a 4G limit on the size of an argument. this patch prints those aruguments in bite sized pieces. a userspace size limitation of 8k was discovered so this keeps messages around 7.5k single arguments larger than 7.5k in length are split into multiple records and can be identified as aX[Y]= Signed-off-by: Eric Paris --- include/linux/audit.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/audit.h b/include/linux/audit.h index 4d1c2f2fcc1..97153027207 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -525,9 +525,11 @@ extern void audit_log_end(struct audit_buffer *ab); extern void audit_log_hex(struct audit_buffer *ab, const unsigned char *buf, size_t len); -extern const char * audit_log_untrustedstring(struct audit_buffer *ab, +extern int audit_string_contains_control(const char *string, + size_t len); +extern void audit_log_untrustedstring(struct audit_buffer *ab, const char *string); -extern const char * audit_log_n_untrustedstring(struct audit_buffer *ab, +extern void audit_log_n_untrustedstring(struct audit_buffer *ab, size_t n, const char *string); extern void audit_log_d_path(struct audit_buffer *ab, -- cgit v1.2.3