- 20 Mar, 2006 9 commits
-
-
Amy Griffis authored
Make audit_init() failure path handle situations where the audit_panic() action is not AUDIT_FAIL_PANIC (default is AUDIT_FAIL_PRINTK). Other uses of audit_sock are not reached unless audit's netlink message handler is properly registered. Bug noticed by Peter Staubach. Signed-off-by:
Amy Griffis <amy.griffis@hp.com> Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk>
-
lorenzo@gnu.org authored
Hi, This is a trivial patch that enables the possibility of using some auditing functions within loadable kernel modules (ie. inside a Linux Security Module). _ Make the audit_log_start, audit_log_end, audit_format and audit_log interfaces available to Loadable Kernel Modules, thus making possible the usage of the audit framework inside LSMs, etc. Signed-off-by:
<Lorenzo Hernández García-Hierro <lorenzo@gnu.org>> Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk>
-
Ingo Molnar authored
Semaphore to mutex conversion. The conversion was generated via scripts, and the result was validated automatically via a script as well. Signed-off-by:
Ingo Molnar <mingo@elte.hu> Cc: David Woodhouse <dwmw2@infradead.org> Signed-off-by:
Andrew Morton <akpm@osdl.org> Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk>
-
Amy Griffis authored
Updated patch to dynamically allocate audit rule fields in kernel's internal representation. Added unlikely() calls for testing memory allocation result. Amy Griffis wrote: [Wed Jan 11 2006, 02:02:31PM EST] > Modify audit's kernel-userspace interface to allow the specification > of string fields in audit rules. > > Signed-off-by: Amy Griffis <amy.griffis@hp.com> Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk> (cherry picked from 5ffc4a863f92351b720fe3e9c5cd647accff9e03 commit)
-
David Woodhouse authored
This fixes the per-user and per-message-type filtering when syscall auditing isn't enabled. [AV: folded followup fix from the same author] Signed-off-by:
David Woodhouse <dwmw2@infradead.org> Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk>
-
Dustin Kirkland authored
This patch extends existing audit records with subject/object context information. Audit records associated with filesystem inodes, ipc, and tasks now contain SELinux label information in the field "subj" if the item is performing the action, or in "obj" if the item is the receiver of an action. These labels are collected via hooks in SELinux and appended to the appropriate record in the audit code. This additional information is required for Common Criteria Labeled Security Protection Profile (LSPP). [AV: fixed kmalloc flags use] [folded leak fixes] [folded cleanup from akpm (kfree(NULL)] [folded audit_inode_context() leak fix] [folded akpm's fix for audit_ipc_perm() definition in case of !CONFIG_AUDIT] Signed-off-by:
Dustin Kirkland <dustin.kirkland@us.ibm.com> Signed-off-by:
David Woodhouse <dwmw2@infradead.org> Signed-off-by:
Andrew Morton <akpm@osdl.org> Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk>
-
Dustin Kirkland authored
- Add a new, 5th filter called "exclude". - And add a new field AUDIT_MSGTYPE. - Define a new function audit_filter_exclude() that takes a message type as input and examines all rules in the filter. It returns '1' if the message is to be excluded, and '0' otherwise. - Call the audit_filter_exclude() function near the top of audit_log_start() just after asserting audit_initialized. If the message type is not to be audited, return NULL very early, before doing a lot of work. [combined with followup fix for bug in original patch, Nov 4, same author] [combined with later renaming AUDIT_FILTER_EXCLUDE->AUDIT_FILTER_TYPE and audit_filter_exclude() -> audit_filter_type()] Signed-off-by:
Dustin Kirkland <dustin.kirkland@us.ibm.com> Signed-off-by:
David Woodhouse <dwmw2@infradead.org> Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk>
-
Steve Grubb authored
The attached patch updates various items for the new user space messages. Please apply. Signed-off-by:
Steve Grubb <sgrubb@redhat.com> Signed-off-by:
David Woodhouse <dwmw2@infradead.org>
-
Randy Dunlap authored
- add kerneldoc for non-static functions; - don't init static data to 0; - limit lines to < 80 columns; - fix long-format style; - delete whitespace at end of some lines; (chrisw: resend and update to current audit-2.6 tree) Signed-off-by:
Randy Dunlap <rdunlap@xenotime.net> Signed-off-by:
Chris Wright <chrisw@osdl.org> Signed-off-by:
David Woodhouse <dwmw2@infradead.org>
-
- 18 Jan, 2006 1 commit
-
-
Alan Cox authored
EDAC requires a way to scrub memory if an ECC error is found and the chipset does not do the work automatically. That means rewriting memory locations atomically with respect to all CPUs _and_ bus masters. That means we can't use atomic_add(foo, 0) as it gets optimised for non-SMP This adds a function to include/asm-foo/atomic.h for the platforms currently supported which implements a scrub of a mapped block. It also adjusts a few other files include order where atomic.h is included before types.h as this now causes an error as atomic_scrub uses u32. Signed-off-by:
Alan Cox <alan@redhat.com> Signed-off-by:
Andrew Morton <akpm@osdl.org> Signed-off-by:
Linus Torvalds <torvalds@osdl.org>
-
- 08 Jan, 2006 1 commit
-
-
Adrian Bunk authored
This patch contains the following cleanups: - make needlessly global functions static - every file should include the headers containing the prototypes for it's global functions Signed-off-by:
Adrian Bunk <bunk@stusta.de> Acked-by:
"Paul E. McKenney" <paulmck@us.ibm.com> Signed-off-by:
Andrew Morton <akpm@osdl.org> Signed-off-by:
Linus Torvalds <torvalds@osdl.org>
-
- 12 Dec, 2005 1 commit
-
-
Pierre Ossman authored
kauditd was causing suspends to fail because it refused to freeze. Adding a try_to_freeze() to its sleep loop solves the issue. Signed-off-by:
Pierre Ossman <drzeus@drzeus.cx> Acked-by:
Pavel Machek <pavel@suse.cz> Cc: David Woodhouse <dwmw2@infradead.org> Signed-off-by:
Andrew Morton <akpm@osdl.org> Signed-off-by:
Linus Torvalds <torvalds@osdl.org>
-
- 28 Oct, 2005 1 commit
-
-
Al Viro authored
Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk> Signed-off-by:
Linus Torvalds <torvalds@osdl.org>
-
- 08 Oct, 2005 1 commit
-
-
Al Viro authored
- added typedef unsigned int __nocast gfp_t; - replaced __nocast uses for gfp flags with gfp_t - it gives exactly the same warnings as far as sparse is concerned, doesn't change generated code (from gcc point of view we replaced unsigned int with typedef) and documents what's going on far better. Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk> Signed-off-by:
Linus Torvalds <torvalds@osdl.org>
-
- 29 Aug, 2005 2 commits
-
-
Patrick McHardy authored
Signed-off-by:
Patrick McHardy <kaber@trash.net> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Harald Welte authored
- Remove bogus code for compiling netlink as module - Add module refcounting support for modules implementing a netlink protocol - Add support for autoloading modules that implement a netlink protocol as soon as someone opens a socket for that protocol Signed-off-by:
Harald Welte <laforge@netfilter.org> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
- 17 Aug, 2005 1 commit
-
-
Amy Griffis authored
The following patch against audit.81 prevents duplicate syscall rules in a given filter list by walking the list on each rule add. I also removed the unused struct audit_entry in audit.c and made the static inlines in auditsc.c consistent. Signed-off-by:
Amy Griffis <amy.griffis@hp.com> Signed-off-by:
David Woodhouse <dwmw2@infradead.org>
-
- 18 Jul, 2005 1 commit
-
-
David Woodhouse authored
... by generating serial numbers only if an audit context is actually _used_, rather than doing so at syscall entry even when the context isn't necessarily marked auditable. Signed-off-by:
David Woodhouse <dwmw2@infradead.org>
-
- 15 Jul, 2005 1 commit
-
-
David Woodhouse authored
The tricks with atomic_t were bizarre. Just do it sensibly instead. Signed-off-by:
David Woodhouse <dwmw2@infradead.org>
-
- 13 Jul, 2005 1 commit
-
-
Victor Fusco authored
Fix the sparse warning "implicit cast to nocast type" Signed-off-by:
Victor Fusco <victor@cetuc.puc-rio.br> Signed-off-by:
Domen Puncer <domen@coderock.org> Signed-off-by:
Andrew Morton <akpm@osdl.org> Signed-off-by:
David Woodhouse <dwmw2@infradead.org>
-
- 02 Jul, 2005 1 commit
-
-
David Woodhouse authored
We force a rate-limit on auditable events by making them wait for space on the backlog queue. However, if auditd really is AWOL then this could potentially bring the entire system to a halt, depending on the audit rules in effect. Firstly, make sure the wait time is honoured correctly -- it's the maximum time the process should wait, rather than the time to wait _each_ time round the loop. We were getting re-woken _each_ time a packet was dequeued, and the timeout was being restarted each time. Secondly, reset the wait time after audit_panic() is called. In general this will be reset to zero, to allow progress to be made. If the system is configured to _actually_ panic on audit_panic() then that will already have happened; otherwise we know that audit records are being lost anyway. These two tunables can't be exposed via AUDIT_GET and AUDIT_SET because those aren't particularly well-designed. It probably should have been done by sysctls or sysfs anyway -- one for a later patch. Signed-off-by:
David Woodhouse <dwmw2@infradead.org>
-
- 24 Jun, 2005 2 commits
-
-
David Woodhouse authored
They aren't errors. Signed-off-by:
David Woodhouse <dwmw2@infradead.org>
-
David Woodhouse authored
Don't look up the task by its pid and then use the syscall filtering helper. Just implement our own filter helper which operates solely on the information in the netlink_skb_parms. Signed-off-by:
David Woodhouse <dwmw2@infradead.org>
-
- 22 Jun, 2005 3 commits
-
-
David Woodhouse authored
It's not used any more. Signed-off-by:
David Woodhouse <dwmw2@infradead.org>
-
David Woodhouse authored
Add a gfp_mask to audit_log_start() and audit_log(), to reduce the amount of GFP_ATOMIC allocation -- most of it doesn't need to be GFP_ATOMIC. Also if the mask includes __GFP_WAIT, then wait up to 60 seconds for the auditd backlog to clear instead of immediately abandoning the message. The timeout should probably be made configurable, but for now it'll suffice that it only happens if auditd is actually running. Signed-off-by:
David Woodhouse <dwmw2@infradead.org>
-
David Woodhouse authored
Also exempt USER_AVC message from being discarded to preserve existing behaviour for SE Linux. Signed-off-by:
David Woodhouse <dwmw2@infradead.org>
-
- 21 Jun, 2005 1 commit
-
-
David Woodhouse authored
If we have enough rules to fill the netlink buffer space, it'll deadlock because auditctl isn't ever actually going to read from the socket until we return, and we aren't going to return until it reads... so we spawn a kernel thread to spew out the list and then exit. Signed-off-by:
David Woodhouse <dwmw2@infradead.org>
-
- 20 Jun, 2005 1 commit
-
-
David Woodhouse authored
Signed-off-by:
David Woodhouse <dwmw2@infradead.org>
-
- 19 Jun, 2005 1 commit
-
-
David Woodhouse authored
Turn the field from a bitmask to an enumeration and add a list to allow filtering of messages generated by userspace. We also define a list for file system watches in anticipation of that feature. Signed-off-by:
David Woodhouse <dwmw2@infradead.org>
-
- 23 May, 2005 1 commit
-
-
David Woodhouse authored
These changes make processing of audit logs easier. Based on a patch from Steve Grubb <sgrubb@redhat.com> Signed-off-by:
David Woodhouse <dwmw2@infradead.org>
-
- 21 May, 2005 1 commit
-
-
David Woodhouse authored
Move audit_serial() into audit.c and use it to generate serial numbers on messages even when there is no audit context from syscall auditing. This allows us to disambiguate audit records when more than one is generated in the same millisecond. Based on a patch by Steve Grubb after he observed the problem. Signed-off-by:
David Woodhouse <dwmw2@infradead.org>
-
- 20 May, 2005 2 commits
-
-
Steve Grubb authored
The attached patch changes all occurrences of loginuid to auid. It also changes everything to %u that is an unsigned type. Signed-off-by:
Steve Grubb <sgrubb@redhat.com> Signed-off-by:
David Woodhouse <dwmw2@infradead.org>
-
Steve Grubb authored
The original AVC_USER message wasn't consolidated with the new range of user messages. The attached patch fixes the kernel so the old messages work again. Signed-off-by:
Steve Grubb <sgrubb@redhat.com> Signed-off-by:
David Woodhouse <dwmw2@infradead.org>
-
- 19 May, 2005 3 commits
-
-
David Woodhouse authored
The limit on the number of outstanding audit messages was inadvertently removed with the switch to queuing skbs directly for sending by a kernel thread. Put it back again. Signed-off-by:
David Woodhouse <dwmw2@infradead.org>
-
David Woodhouse authored
netlink_unicast() will attempt to reallocate and will free messages if the socket's rcvbuf limit is reached unless we give it an infinite timeout. So do that, from a kernel thread which is dedicated to spewing stuff up the netlink socket. Signed-off-by:
David Woodhouse <dwmw2@infradead.org>
-
Steve Grubb authored
* If vsnprintf returns -1, it will mess up the sk buffer space accounting. This is fixed by not calling skb_put with bogus len values. * audit_log_hex was a loop that called audit_log_vformat with %02X for each character. This is very inefficient since conversion from unsigned character to Ascii representation is essentially masking, shifting, and byte lookups. Also, the length of the converted string is well known - it's twice the original. Fixed by rewriting the function. * audit_log_untrustedstring had no comments. This makes it hard for someone to understand what the string format will be. * audit_log_d_path was never fixed to use untrustedstring. This could mess up user space parsers. This was fixed to make a temp buffer, call d_path, and log temp buffer using untrustedstring. From: Steve Grubb <sgrubb@redhat.com> Signed-off-by:
David Woodhouse <dwmw2@infradead.org>
-
- 18 May, 2005 1 commit
-
-
David Woodhouse authored
It's silly to have to add explicit entries for new userspace messages as we invent them. Just treat all messages in the user range the same. Signed-off-by:
David Woodhouse <dwmw2@infradead.org>
-
- 13 May, 2005 3 commits
-
-
David Woodhouse authored
Der... if you use max_t it helps if you give it a type. Note to self: Always just apply the tested patches, don't try to port them by hand. You're not clever enough. Signed-off-by:
David Woodhouse <dwmw2@infradead.org>
-
Steve Grubb authored
I'm going through the kernel code and have a patch that corrects several spelling errors in comments. From: Steve Grubb <sgrubb@redhat.com> Signed-off-by:
David Woodhouse <dwmw2@infradead.org>
-
Steve Grubb authored
This patch adds more messages types to the audit subsystem so that audit analysis is quicker, intuitive, and more useful. Signed-off-by:
Steve Grubb <sgrubb@redhat.com> --- I forgot one type in the big patch. I need to add one for user space originating SE Linux avc messages. This is used by dbus and nscd. -Steve --- Updated to 2.6.12-rc4-mm1. -dwmw2 Signed-off-by:
David Woodhouse <dwmw2@infradead.org>
-