hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

audit: Allow auditd to set pid to 0 to end auditing 

The API to end auditing has historically been for auditd to set the
pid to 0. This patch restores that functionality.

See: https://github.com/linux-audit/audit-kernel/issues/69

Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Steve Grubb <sgrubb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Steve Grubb 2017-10-17 18:29:22 -04:00 committed by Paul Moore
parent 6e66ec3cae
commit 33e8a90780
1 changed files with 16 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
kernel/audit.c
View File

@ -1197,25 +1197,28 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
pid_t auditd_pid; pid_t auditd_pid;
struct pid *req_pid = task_tgid(current); struct pid *req_pid = task_tgid(current);
/* sanity check - PID values must match */ /* Sanity check - PID values must match. Setting
if (new_pid != pid_vnr(req_pid)) * pid to 0 is how auditd ends auditing. */
if (new_pid && (new_pid != pid_vnr(req_pid)))
return -EINVAL; return -EINVAL;
/* test the auditd connection */ /* test the auditd connection */
audit_replace(req_pid); audit_replace(req_pid);
auditd_pid = auditd_pid_vnr(); auditd_pid = auditd_pid_vnr();
/* only the current auditd can unregister itself */ if (auditd_pid) {
if ((!new_pid) && (new_pid != auditd_pid)) { /* replacing a healthy auditd is not allowed */
audit_log_config_change("audit_pid", new_pid, if (new_pid) {
auditd_pid, 0); audit_log_config_change("audit_pid",
return -EACCES; new_pid, auditd_pid, 0);
} return -EEXIST;
/* replacing a healthy auditd is not allowed */ }
if (auditd_pid && new_pid) { /* only current auditd can unregister itself */
audit_log_config_change("audit_pid", new_pid, if (pid_vnr(req_pid) != auditd_pid) {
auditd_pid, 0); audit_log_config_change("audit_pid",
return -EEXIST; new_pid, auditd_pid, 0);
return -EACCES;
}
} }
if (new_pid) { if (new_pid) {