hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add audit uid to netlink credentials 

Most audit control messages are sent over netlink.In order to properly
log the identity of the sender of audit control messages, we would like
to add the loginuid to the netlink_creds structure, as per the attached
patch.

Signed-off-by: Serge Hallyn <serue@us.ibm.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
This commit is contained in:
Serge Hallyn 2005-04-29 16:27:17 +01:00 committed by
parent 85c8721ff3
commit c94c257c88
5 changed files with 32 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/linux/audit.h
View File

@ -184,7 +184,7 @@ extern void audit_inode(const char *name, const struct inode *inode);
/* Private API (for audit.c only) */ /* Private API (for audit.c only) */
extern int audit_receive_filter(int type, int pid, int uid, int seq, extern int audit_receive_filter(int type, int pid, int uid, int seq,
void *data); void *data, uid_t loginuid);
extern void audit_get_stamp(struct audit_context *ctx, extern void audit_get_stamp(struct audit_context *ctx,
struct timespec *t, unsigned int *serial); struct timespec *t, unsigned int *serial);
extern int audit_set_loginuid(struct audit_context *ctx, uid_t loginuid); extern int audit_set_loginuid(struct audit_context *ctx, uid_t loginuid);

1
include/linux/netlink.h
View File

@ -110,6 +110,7 @@ struct netlink_skb_parms
__u32 dst_pid; __u32 dst_pid;
__u32 dst_groups; __u32 dst_groups;
kernel_cap_t eff_cap; kernel_cap_t eff_cap;
__u32 loginuid; /* Login (audit) uid */
}; };
#define NETLINK_CB(skb) (*(struct netlink_skb_parms*)&((skb)->cb)) #define NETLINK_CB(skb) (*(struct netlink_skb_parms*)&((skb)->cb))

46
kernel/audit.c
View File

@ -239,36 +239,36 @@ void audit_log_lost(const char *message)
} }
static int audit_set_rate_limit(int limit) static int audit_set_rate_limit(int limit, uid_t loginuid)
{ {
int old = audit_rate_limit; int old = audit_rate_limit;
audit_rate_limit = limit; audit_rate_limit = limit;
audit_log(current->audit_context, "audit_rate_limit=%d old=%d", audit_log(NULL, "audit_rate_limit=%d old=%d by auid %u",
audit_rate_limit, old); audit_rate_limit, old, loginuid);
return old; return old;
} }
static int audit_set_backlog_limit(int limit) static int audit_set_backlog_limit(int limit, uid_t loginuid)
{ {
int old = audit_backlog_limit; int old = audit_backlog_limit;
audit_backlog_limit = limit; audit_backlog_limit = limit;
audit_log(current->audit_context, "audit_backlog_limit=%d old=%d", audit_log(NULL, "audit_backlog_limit=%d old=%d by auid %u",
audit_backlog_limit, old); audit_backlog_limit, old, loginuid);
return old; return old;
} }
static int audit_set_enabled(int state) static int audit_set_enabled(int state, uid_t loginuid)
{ {
int old = audit_enabled; int old = audit_enabled;
if (state != 0 && state != 1) if (state != 0 && state != 1)
return -EINVAL; return -EINVAL;
audit_enabled = state; audit_enabled = state;
audit_log(current->audit_context, "audit_enabled=%d old=%d", audit_log(NULL, "audit_enabled=%d old=%d by auid %u",
audit_enabled, old); audit_enabled, old, loginuid);
return old; return old;
} }
static int audit_set_failure(int state) static int audit_set_failure(int state, uid_t loginuid)
{ {
int old = audit_failure; int old = audit_failure;
if (state != AUDIT_FAIL_SILENT if (state != AUDIT_FAIL_SILENT
@ -276,8 +276,8 @@ static int audit_set_failure(int state)
&& state != AUDIT_FAIL_PANIC) && state != AUDIT_FAIL_PANIC)
return -EINVAL; return -EINVAL;
audit_failure = state; audit_failure = state;
audit_log(current->audit_context, "audit_failure=%d old=%d", audit_log(NULL, "audit_failure=%d old=%d by auid %u",
audit_failure, old); audit_failure, old, loginuid);
return old; return old;
} }
@ -344,6 +344,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
int err; int err;
struct audit_buffer *ab; struct audit_buffer *ab;
u16 msg_type = nlh->nlmsg_type; u16 msg_type = nlh->nlmsg_type;
uid_t loginuid; /* loginuid of sender */
err = audit_netlink_ok(NETLINK_CB(skb).eff_cap, msg_type); err = audit_netlink_ok(NETLINK_CB(skb).eff_cap, msg_type);
if (err) if (err)
@ -351,6 +352,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
pid = NETLINK_CREDS(skb)->pid; pid = NETLINK_CREDS(skb)->pid;
uid = NETLINK_CREDS(skb)->uid; uid = NETLINK_CREDS(skb)->uid;
loginuid = NETLINK_CB(skb).loginuid;
seq = nlh->nlmsg_seq; seq = nlh->nlmsg_seq;
data = NLMSG_DATA(nlh); data = NLMSG_DATA(nlh);
@ -371,34 +373,36 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
return -EINVAL; return -EINVAL;
status_get = (struct audit_status *)data; status_get = (struct audit_status *)data;
if (status_get->mask & AUDIT_STATUS_ENABLED) { if (status_get->mask & AUDIT_STATUS_ENABLED) {
err = audit_set_enabled(status_get->enabled); err = audit_set_enabled(status_get->enabled, loginuid);
if (err < 0) return err; if (err < 0) return err;
} }
if (status_get->mask & AUDIT_STATUS_FAILURE) { if (status_get->mask & AUDIT_STATUS_FAILURE) {
err = audit_set_failure(status_get->failure); err = audit_set_failure(status_get->failure, loginuid);
if (err < 0) return err; if (err < 0) return err;
} }
if (status_get->mask & AUDIT_STATUS_PID) { if (status_get->mask & AUDIT_STATUS_PID) {
int old = audit_pid; int old = audit_pid;
audit_pid = status_get->pid; audit_pid = status_get->pid;
audit_log(current->audit_context, audit_log(NULL, "audit_pid=%d old=%d by auid %u",
"audit_pid=%d old=%d", audit_pid, old); audit_pid, old, loginuid);
} }
if (status_get->mask & AUDIT_STATUS_RATE_LIMIT) if (status_get->mask & AUDIT_STATUS_RATE_LIMIT)
audit_set_rate_limit(status_get->rate_limit); audit_set_rate_limit(status_get->rate_limit, loginuid);
if (status_get->mask & AUDIT_STATUS_BACKLOG_LIMIT) if (status_get->mask & AUDIT_STATUS_BACKLOG_LIMIT)
audit_set_backlog_limit(status_get->backlog_limit); audit_set_backlog_limit(status_get->backlog_limit,
loginuid);
break; break;
case AUDIT_USER: case AUDIT_USER:
ab = audit_log_start(NULL); ab = audit_log_start(NULL);
if (!ab) if (!ab)
break; /* audit_panic has been called */ break; /* audit_panic has been called */
audit_log_format(ab, audit_log_format(ab,
"user pid=%d uid=%d length=%d msg='%.1024s'", "user pid=%d uid=%d length=%d loginuid=%u"
" msg='%.1024s'",
pid, uid, pid, uid,
(int)(nlh->nlmsg_len (int)(nlh->nlmsg_len
- ((char *)data - (char *)nlh)), - ((char *)data - (char *)nlh)),
(char *)data); loginuid, (char *)data);
ab->type = AUDIT_USER; ab->type = AUDIT_USER;
ab->pid = pid; ab->pid = pid;
audit_log_end(ab); audit_log_end(ab);
@ -411,7 +415,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
case AUDIT_LIST: case AUDIT_LIST:
#ifdef CONFIG_AUDITSYSCALL #ifdef CONFIG_AUDITSYSCALL
err = audit_receive_filter(nlh->nlmsg_type, NETLINK_CB(skb).pid, err = audit_receive_filter(nlh->nlmsg_type, NETLINK_CB(skb).pid,
uid, seq, data); uid, seq, data, loginuid);
#else #else
err = -EOPNOTSUPP; err = -EOPNOTSUPP;
#endif #endif

5
kernel/auditsc.c
View File

@ -251,7 +251,8 @@ static int audit_copy_rule(struct audit_rule *d, struct audit_rule *s)
return 0; return 0;
} }
int audit_receive_filter(int type, int pid, int uid, int seq, void *data) int audit_receive_filter(int type, int pid, int uid, int seq, void *data,
uid_t loginuid)
{ {
u32 flags; u32 flags;
struct audit_entry *entry; struct audit_entry *entry;
@ -286,6 +287,7 @@ int audit_receive_filter(int type, int pid, int uid, int seq, void *data)
err = audit_add_rule(entry, &audit_entlist); err = audit_add_rule(entry, &audit_entlist);
if (!err && (flags & AUDIT_AT_EXIT)) if (!err && (flags & AUDIT_AT_EXIT))
err = audit_add_rule(entry, &audit_extlist); err = audit_add_rule(entry, &audit_extlist);
audit_log(NULL, "auid %u added an audit rule\n", loginuid);
break; break;
case AUDIT_DEL: case AUDIT_DEL:
flags =((struct audit_rule *)data)->flags; flags =((struct audit_rule *)data)->flags;
@ -295,6 +297,7 @@ int audit_receive_filter(int type, int pid, int uid, int seq, void *data)
err = audit_del_rule(data, &audit_entlist); err = audit_del_rule(data, &audit_entlist);
if (!err && (flags & AUDIT_AT_EXIT)) if (!err && (flags & AUDIT_AT_EXIT))
err = audit_del_rule(data, &audit_extlist); err = audit_del_rule(data, &audit_extlist);
audit_log(NULL, "auid %u removed an audit rule\n", loginuid);
break; break;
default: default:
return -EINVAL; return -EINVAL;

1
net/netlink/af_netlink.c
View File

@ -905,6 +905,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
NETLINK_CB(skb).groups = nlk->groups; NETLINK_CB(skb).groups = nlk->groups;
NETLINK_CB(skb).dst_pid = dst_pid; NETLINK_CB(skb).dst_pid = dst_pid;
NETLINK_CB(skb).dst_groups = dst_groups; NETLINK_CB(skb).dst_groups = dst_groups;
NETLINK_CB(skb).loginuid = audit_get_loginuid(current->audit_context);
memcpy(NETLINK_CREDS(skb), &siocb->scm->creds, sizeof(struct ucred)); memcpy(NETLINK_CREDS(skb), &siocb->scm->creds, sizeof(struct ucred));
/* What can I do? Netlink is asynchronous, so that /* What can I do? Netlink is asynchronous, so that