tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'audit-pr-20200803' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit

Pull audit updates from Paul Moore:
"Aside from some smaller bug fixes, here are the highlights:

- add a new backlog wait metric to the audit status message, this is
intended to help admins determine how long processes have been
waiting for the audit backlog queue to clear

- generate audit records for nftables configuration changes

- generate CWD audit records for for the relevant LSM audit records"

* tag 'audit-pr-20200803' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
audit: report audit wait metric in audit status reply
audit: purge audit_log_string from the intra-kernel audit API
audit: issue CWD record to accompany LSM_AUDIT_DATA_* records
audit: use the proper gfp flags in the audit_log_nfcfg() calls
audit: remove unused !CONFIG_AUDITSYSCALL __audit_inode* stubs
audit: add gfp parameter to audit_log_nfcfg
audit: log nftables configuration change events
audit: Use struct_size() helper in alloc_chunk

Linus Torvalds fd76a74d 49e917de

+273 -106
+29 -17
include/linux/audit.h
··· 12 12 #include <linux/sched.h> 13 13 #include <linux/ptrace.h> 14 14 #include <uapi/linux/audit.h> 15 + #include <uapi/linux/netfilter/nf_tables.h> 15 16 16 17 #define AUDIT_INO_UNSET ((unsigned long)-1) 17 18 #define AUDIT_DEV_UNSET ((dev_t)-1) ··· 99 98 AUDIT_XT_OP_REGISTER, 100 99 AUDIT_XT_OP_REPLACE, 101 100 AUDIT_XT_OP_UNREGISTER, 101 + AUDIT_NFT_OP_TABLE_REGISTER, 102 + AUDIT_NFT_OP_TABLE_UNREGISTER, 103 + AUDIT_NFT_OP_CHAIN_REGISTER, 104 + AUDIT_NFT_OP_CHAIN_UNREGISTER, 105 + AUDIT_NFT_OP_RULE_REGISTER, 106 + AUDIT_NFT_OP_RULE_UNREGISTER, 107 + AUDIT_NFT_OP_SET_REGISTER, 108 + AUDIT_NFT_OP_SET_UNREGISTER, 109 + AUDIT_NFT_OP_SETELEM_REGISTER, 110 + AUDIT_NFT_OP_SETELEM_UNREGISTER, 111 + AUDIT_NFT_OP_GEN_REGISTER, 112 + AUDIT_NFT_OP_OBJ_REGISTER, 113 + AUDIT_NFT_OP_OBJ_UNREGISTER, 114 + AUDIT_NFT_OP_OBJ_RESET, 115 + AUDIT_NFT_OP_FLOWTABLE_REGISTER, 116 + AUDIT_NFT_OP_FLOWTABLE_UNREGISTER, 117 + AUDIT_NFT_OP_INVALID, 102 118 }; 103 119 104 120 extern int is_audit_feature_set(int which); ··· 292 274 extern void __audit_syscall_exit(int ret_success, long ret_value); 293 275 extern struct filename *__audit_reusename(const __user char *uptr); 294 276 extern void __audit_getname(struct filename *name); 295 - 277 + extern void __audit_getcwd(void); 296 278 extern void __audit_inode(struct filename *name, const struct dentry *dentry, 297 279 unsigned int flags); 298 280 extern void __audit_file(const struct file *); ··· 351 333 if (unlikely(!audit_dummy_context())) 352 334 __audit_getname(name); 353 335 } 336 + static inline void audit_getcwd(void) 337 + { 338 + if (unlikely(audit_context())) 339 + __audit_getcwd(); 340 + } 354 341 static inline void audit_inode(struct filename *name, 355 342 const struct dentry *dentry, 356 343 unsigned int aflags) { ··· 409 386 extern void __audit_tk_injoffset(struct timespec64 offset); 410 387 extern void __audit_ntp_log(const struct audit_ntp_data *ad); 411 388 extern void __audit_log_nfcfg(const char *name, u8 af, unsigned int nentries, 412 - enum audit_nfcfgop op); 389 + enum audit_nfcfgop op, gfp_t gfp); 413 390 414 391 static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp) 415 392 { ··· 547 524 548 525 static inline void audit_log_nfcfg(const char *name, u8 af, 549 526 unsigned int nentries, 550 - enum audit_nfcfgop op) 527 + enum audit_nfcfgop op, gfp_t gfp) 551 528 { 552 529 if (audit_enabled) 553 - __audit_log_nfcfg(name, af, nentries, op); 530 + __audit_log_nfcfg(name, af, nentries, op, gfp); 554 531 } 555 532 556 533 extern int audit_n_rules; ··· 584 561 } 585 562 static inline void audit_getname(struct filename *name) 586 563 { } 587 - static inline void __audit_inode(struct filename *name, 588 - const struct dentry *dentry, 589 - unsigned int flags) 590 - { } 591 - static inline void __audit_inode_child(struct inode *parent, 592 - const struct dentry *dentry, 593 - const unsigned char type) 564 + static inline void audit_getcwd(void) 594 565 { } 595 566 static inline void audit_inode(struct filename *name, 596 567 const struct dentry *dentry, ··· 682 665 683 666 static inline void audit_log_nfcfg(const char *name, u8 af, 684 667 unsigned int nentries, 685 - enum audit_nfcfgop op) 668 + enum audit_nfcfgop op, gfp_t gfp) 686 669 { } 687 670 688 671 #define audit_n_rules 0 ··· 692 675 static inline bool audit_loginuid_set(struct task_struct *tsk) 693 676 { 694 677 return uid_valid(audit_get_loginuid(tsk)); 695 - } 696 - 697 - static inline void audit_log_string(struct audit_buffer *ab, const char *buf) 698 - { 699 - audit_log_n_string(ab, buf, strlen(buf)); 700 678 } 701 679 702 680 #endif
+11 -7
include/uapi/linux/audit.h
··· 333 333 }; 334 334 335 335 /* Status symbols */ 336 - /* Mask values */ 337 - #define AUDIT_STATUS_ENABLED 0x0001 338 - #define AUDIT_STATUS_FAILURE 0x0002 339 - #define AUDIT_STATUS_PID 0x0004 336 + /* Mask values */ 337 + #define AUDIT_STATUS_ENABLED 0x0001 338 + #define AUDIT_STATUS_FAILURE 0x0002 339 + #define AUDIT_STATUS_PID 0x0004 340 340 #define AUDIT_STATUS_RATE_LIMIT 0x0008 341 - #define AUDIT_STATUS_BACKLOG_LIMIT 0x0010 342 - #define AUDIT_STATUS_BACKLOG_WAIT_TIME 0x0020 343 - #define AUDIT_STATUS_LOST 0x0040 341 + #define AUDIT_STATUS_BACKLOG_LIMIT 0x0010 342 + #define AUDIT_STATUS_BACKLOG_WAIT_TIME 0x0020 343 + #define AUDIT_STATUS_LOST 0x0040 344 + #define AUDIT_STATUS_BACKLOG_WAIT_TIME_ACTUAL 0x0080 344 345 345 346 #define AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT 0x00000001 346 347 #define AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME 0x00000002 ··· 468 467 __u32 feature_bitmap; /* bitmap of kernel audit features */ 469 468 }; 470 469 __u32 backlog_wait_time;/* message queue wait timeout */ 470 + __u32 backlog_wait_time_actual;/* time spent waiting while 471 + * message limit exceeded 472 + */ 471 473 }; 472 474 473 475 struct audit_features {
+27 -12
kernel/audit.c
··· 136 136 */ 137 137 static atomic_t audit_lost = ATOMIC_INIT(0); 138 138 139 + /* Monotonically increasing sum of time the kernel has spent 140 + * waiting while the backlog limit is exceeded. 141 + */ 142 + static atomic_t audit_backlog_wait_time_actual = ATOMIC_INIT(0); 143 + 139 144 /* Hash for inode-based rules */ 140 145 struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS]; 141 146 ··· 1206 1201 case AUDIT_GET: { 1207 1202 struct audit_status s; 1208 1203 memset(&s, 0, sizeof(s)); 1209 - s.enabled = audit_enabled; 1210 - s.failure = audit_failure; 1204 + s.enabled = audit_enabled; 1205 + s.failure = audit_failure; 1211 1206 /* NOTE: use pid_vnr() so the PID is relative to the current 1212 1207 * namespace */ 1213 - s.pid = auditd_pid_vnr(); 1214 - s.rate_limit = audit_rate_limit; 1215 - s.backlog_limit = audit_backlog_limit; 1216 - s.lost = atomic_read(&audit_lost); 1217 - s.backlog = skb_queue_len(&audit_queue); 1218 - s.feature_bitmap = AUDIT_FEATURE_BITMAP_ALL; 1219 - s.backlog_wait_time = audit_backlog_wait_time; 1208 + s.pid = auditd_pid_vnr(); 1209 + s.rate_limit = audit_rate_limit; 1210 + s.backlog_limit = audit_backlog_limit; 1211 + s.lost = atomic_read(&audit_lost); 1212 + s.backlog = skb_queue_len(&audit_queue); 1213 + s.feature_bitmap = AUDIT_FEATURE_BITMAP_ALL; 1214 + s.backlog_wait_time = audit_backlog_wait_time; 1215 + s.backlog_wait_time_actual = atomic_read(&audit_backlog_wait_time_actual); 1220 1216 audit_send_reply(skb, seq, AUDIT_GET, 0, 0, &s, sizeof(s)); 1221 1217 break; 1222 1218 } ··· 1320 1314 1321 1315 audit_log_config_change("lost", 0, lost, 1); 1322 1316 return lost; 1317 + } 1318 + if (s.mask == AUDIT_STATUS_BACKLOG_WAIT_TIME_ACTUAL) { 1319 + u32 actual = atomic_xchg(&audit_backlog_wait_time_actual, 0); 1320 + 1321 + audit_log_config_change("backlog_wait_time_actual", 0, actual, 1); 1322 + return actual; 1323 1323 } 1324 1324 break; 1325 1325 } ··· 1838 1826 /* sleep if we are allowed and we haven't exhausted our 1839 1827 * backlog wait limit */ 1840 1828 if (gfpflags_allow_blocking(gfp_mask) && (stime > 0)) { 1829 + long rtime = stime; 1830 + 1841 1831 DECLARE_WAITQUEUE(wait, current); 1842 1832 1843 1833 add_wait_queue_exclusive(&audit_backlog_wait, 1844 1834 &wait); 1845 1835 set_current_state(TASK_UNINTERRUPTIBLE); 1846 - stime = schedule_timeout(stime); 1836 + stime = schedule_timeout(rtime); 1837 + atomic_add(rtime - stime, &audit_backlog_wait_time_actual); 1847 1838 remove_wait_queue(&audit_backlog_wait, &wait); 1848 1839 } else { 1849 1840 if (audit_rate_check() && printk_ratelimit()) ··· 2094 2079 /* We will allow 11 spaces for ' (deleted)' to be appended */ 2095 2080 pathname = kmalloc(PATH_MAX+11, ab->gfp_mask); 2096 2081 if (!pathname) { 2097 - audit_log_string(ab, "<no_memory>"); 2082 + audit_log_format(ab, "\"<no_memory>\""); 2098 2083 return; 2099 2084 } 2100 2085 p = d_path(path, pathname, PATH_MAX+11); 2101 2086 if (IS_ERR(p)) { /* Should never happen since we send PATH_MAX */ 2102 2087 /* FIXME: can we save some information here? */ 2103 - audit_log_string(ab, "<too_long>"); 2088 + audit_log_format(ab, "\"<too_long>\""); 2104 2089 } else 2105 2090 audit_log_untrustedstring(ab, p); 2106 2091 kfree(pathname);
+1 -3
kernel/audit_tree.c
··· 188 188 static struct audit_chunk *alloc_chunk(int count) 189 189 { 190 190 struct audit_chunk *chunk; 191 - size_t size; 192 191 int i; 193 192 194 - size = offsetof(struct audit_chunk, owners) + count * sizeof(struct node); 195 - chunk = kzalloc(size, GFP_KERNEL); 193 + chunk = kzalloc(struct_size(chunk, owners, count), GFP_KERNEL); 196 194 if (!chunk) 197 195 return NULL; 198 196
+38 -7
kernel/auditsc.c
··· 75 75 #include <linux/uaccess.h> 76 76 #include <linux/fsnotify_backend.h> 77 77 #include <uapi/linux/limits.h> 78 + #include <uapi/linux/netfilter/nf_tables.h> 78 79 79 80 #include "audit.h" 80 81 ··· 137 136 }; 138 137 139 138 static const struct audit_nfcfgop_tab audit_nfcfgs[] = { 140 - { AUDIT_XT_OP_REGISTER, "register" }, 141 - { AUDIT_XT_OP_REPLACE, "replace" }, 142 - { AUDIT_XT_OP_UNREGISTER, "unregister" }, 139 + { AUDIT_XT_OP_REGISTER, "xt_register" }, 140 + { AUDIT_XT_OP_REPLACE, "xt_replace" }, 141 + { AUDIT_XT_OP_UNREGISTER, "xt_unregister" }, 142 + { AUDIT_NFT_OP_TABLE_REGISTER, "nft_register_table" }, 143 + { AUDIT_NFT_OP_TABLE_UNREGISTER, "nft_unregister_table" }, 144 + { AUDIT_NFT_OP_CHAIN_REGISTER, "nft_register_chain" }, 145 + { AUDIT_NFT_OP_CHAIN_UNREGISTER, "nft_unregister_chain" }, 146 + { AUDIT_NFT_OP_RULE_REGISTER, "nft_register_rule" }, 147 + { AUDIT_NFT_OP_RULE_UNREGISTER, "nft_unregister_rule" }, 148 + { AUDIT_NFT_OP_SET_REGISTER, "nft_register_set" }, 149 + { AUDIT_NFT_OP_SET_UNREGISTER, "nft_unregister_set" }, 150 + { AUDIT_NFT_OP_SETELEM_REGISTER, "nft_register_setelem" }, 151 + { AUDIT_NFT_OP_SETELEM_UNREGISTER, "nft_unregister_setelem" }, 152 + { AUDIT_NFT_OP_GEN_REGISTER, "nft_register_gen" }, 153 + { AUDIT_NFT_OP_OBJ_REGISTER, "nft_register_obj" }, 154 + { AUDIT_NFT_OP_OBJ_UNREGISTER, "nft_unregister_obj" }, 155 + { AUDIT_NFT_OP_OBJ_RESET, "nft_reset_obj" }, 156 + { AUDIT_NFT_OP_FLOWTABLE_REGISTER, "nft_register_flowtable" }, 157 + { AUDIT_NFT_OP_FLOWTABLE_UNREGISTER, "nft_unregister_flowtable" }, 158 + { AUDIT_NFT_OP_INVALID, "nft_invalid" }, 143 159 }; 144 160 145 161 static int audit_match_perm(struct audit_context *ctx, int mask) ··· 1894 1876 return NULL; 1895 1877 } 1896 1878 1879 + inline void _audit_getcwd(struct audit_context *context) 1880 + { 1881 + if (!context->pwd.dentry) 1882 + get_fs_pwd(current->fs, &context->pwd); 1883 + } 1884 + 1885 + void __audit_getcwd(void) 1886 + { 1887 + struct audit_context *context = audit_context(); 1888 + 1889 + if (context->in_syscall) 1890 + _audit_getcwd(context); 1891 + } 1892 + 1897 1893 /** 1898 1894 * __audit_getname - add a name to the list 1899 1895 * @name: name to add ··· 1932 1900 name->aname = n; 1933 1901 name->refcnt++; 1934 1902 1935 - if (!context->pwd.dentry) 1936 - get_fs_pwd(current->fs, &context->pwd); 1903 + _audit_getcwd(context); 1937 1904 } 1938 1905 1939 1906 static inline int audit_copy_fcaps(struct audit_names *name, ··· 2588 2557 } 2589 2558 2590 2559 void __audit_log_nfcfg(const char *name, u8 af, unsigned int nentries, 2591 - enum audit_nfcfgop op) 2560 + enum audit_nfcfgop op, gfp_t gfp) 2592 2561 { 2593 2562 struct audit_buffer *ab; 2594 2563 char comm[sizeof(current->comm)]; 2595 2564 2596 - ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_NETFILTER_CFG); 2565 + ab = audit_log_start(audit_context(), gfp, AUDIT_NETFILTER_CFG); 2597 2566 if (!ab) 2598 2567 return; 2599 2568 audit_log_format(ab, "table=%s family=%u entries=%u op=%s",
+3 -3
net/bridge/netfilter/ebtables.c
··· 1047 1047 vfree(counterstmp); 1048 1048 1049 1049 audit_log_nfcfg(repl->name, AF_BRIDGE, repl->nentries, 1050 - AUDIT_XT_OP_REPLACE); 1050 + AUDIT_XT_OP_REPLACE, GFP_KERNEL); 1051 1051 return ret; 1052 1052 1053 1053 free_unlock: ··· 1123 1123 list_del(&table->list); 1124 1124 mutex_unlock(&ebt_mutex); 1125 1125 audit_log_nfcfg(table->name, AF_BRIDGE, table->private->nentries, 1126 - AUDIT_XT_OP_UNREGISTER); 1126 + AUDIT_XT_OP_UNREGISTER, GFP_KERNEL); 1127 1127 EBT_ENTRY_ITERATE(table->private->entries, table->private->entries_size, 1128 1128 ebt_cleanup_entry, net, NULL); 1129 1129 if (table->private->nentries) ··· 1218 1218 } 1219 1219 1220 1220 audit_log_nfcfg(repl->name, AF_BRIDGE, repl->nentries, 1221 - AUDIT_XT_OP_REGISTER); 1221 + AUDIT_XT_OP_REGISTER, GFP_KERNEL); 1222 1222 return ret; 1223 1223 free_unlock: 1224 1224 mutex_unlock(&ebt_mutex);
+112
net/netfilter/nf_tables_api.c
··· 12 12 #include <linux/netlink.h> 13 13 #include <linux/vmalloc.h> 14 14 #include <linux/rhashtable.h> 15 + #include <linux/audit.h> 15 16 #include <linux/netfilter.h> 16 17 #include <linux/netfilter/nfnetlink.h> 17 18 #include <linux/netfilter/nf_tables.h> ··· 682 681 { 683 682 struct sk_buff *skb; 684 683 int err; 684 + char *buf = kasprintf(GFP_KERNEL, "%s:%llu;?:0", 685 + ctx->table->name, ctx->table->handle); 686 + 687 + audit_log_nfcfg(buf, 688 + ctx->family, 689 + ctx->table->use, 690 + event == NFT_MSG_NEWTABLE ? 691 + AUDIT_NFT_OP_TABLE_REGISTER : 692 + AUDIT_NFT_OP_TABLE_UNREGISTER, 693 + GFP_KERNEL); 694 + kfree(buf); 685 695 686 696 if (!ctx->report && 687 697 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) ··· 1427 1415 { 1428 1416 struct sk_buff *skb; 1429 1417 int err; 1418 + char *buf = kasprintf(GFP_KERNEL, "%s:%llu;%s:%llu", 1419 + ctx->table->name, ctx->table->handle, 1420 + ctx->chain->name, ctx->chain->handle); 1421 + 1422 + audit_log_nfcfg(buf, 1423 + ctx->family, 1424 + ctx->chain->use, 1425 + event == NFT_MSG_NEWCHAIN ? 1426 + AUDIT_NFT_OP_CHAIN_REGISTER : 1427 + AUDIT_NFT_OP_CHAIN_UNREGISTER, 1428 + GFP_KERNEL); 1429 + kfree(buf); 1430 1430 1431 1431 if (!ctx->report && 1432 1432 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) ··· 2704 2680 { 2705 2681 struct sk_buff *skb; 2706 2682 int err; 2683 + char *buf = kasprintf(GFP_KERNEL, "%s:%llu;%s:%llu", 2684 + ctx->table->name, ctx->table->handle, 2685 + ctx->chain->name, ctx->chain->handle); 2686 + 2687 + audit_log_nfcfg(buf, 2688 + ctx->family, 2689 + rule->handle, 2690 + event == NFT_MSG_NEWRULE ? 2691 + AUDIT_NFT_OP_RULE_REGISTER : 2692 + AUDIT_NFT_OP_RULE_UNREGISTER, 2693 + GFP_KERNEL); 2694 + kfree(buf); 2707 2695 2708 2696 if (!ctx->report && 2709 2697 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) ··· 3718 3682 struct sk_buff *skb; 3719 3683 u32 portid = ctx->portid; 3720 3684 int err; 3685 + char *buf = kasprintf(gfp_flags, "%s:%llu;%s:%llu", 3686 + ctx->table->name, ctx->table->handle, 3687 + set->name, set->handle); 3688 + 3689 + audit_log_nfcfg(buf, 3690 + ctx->family, 3691 + set->field_count, 3692 + event == NFT_MSG_NEWSET ? 3693 + AUDIT_NFT_OP_SET_REGISTER : 3694 + AUDIT_NFT_OP_SET_UNREGISTER, 3695 + gfp_flags); 3696 + kfree(buf); 3721 3697 3722 3698 if (!ctx->report && 3723 3699 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) ··· 4846 4798 u32 portid = ctx->portid; 4847 4799 struct sk_buff *skb; 4848 4800 int err; 4801 + char *buf = kasprintf(GFP_KERNEL, "%s:%llu;%s:%llu", 4802 + ctx->table->name, ctx->table->handle, 4803 + set->name, set->handle); 4804 + 4805 + audit_log_nfcfg(buf, 4806 + ctx->family, 4807 + set->handle, 4808 + event == NFT_MSG_NEWSETELEM ? 4809 + AUDIT_NFT_OP_SETELEM_REGISTER : 4810 + AUDIT_NFT_OP_SETELEM_UNREGISTER, 4811 + GFP_KERNEL); 4812 + kfree(buf); 4849 4813 4850 4814 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) 4851 4815 return; ··· 5939 5879 obj->ops->type->type != filter->type) 5940 5880 goto cont; 5941 5881 5882 + if (reset) { 5883 + char *buf = kasprintf(GFP_ATOMIC, 5884 + "%s:%llu;?:0", 5885 + table->name, 5886 + table->handle); 5887 + 5888 + audit_log_nfcfg(buf, 5889 + family, 5890 + obj->handle, 5891 + AUDIT_NFT_OP_OBJ_RESET, 5892 + GFP_ATOMIC); 5893 + kfree(buf); 5894 + } 5895 + 5942 5896 if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid, 5943 5897 cb->nlh->nlmsg_seq, 5944 5898 NFT_MSG_NEWOBJ, ··· 6063 5989 if (NFNL_MSG_TYPE(nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET) 6064 5990 reset = true; 6065 5991 5992 + if (reset) { 5993 + char *buf = kasprintf(GFP_ATOMIC, "%s:%llu;?:0", 5994 + table->name, table->handle); 5995 + 5996 + audit_log_nfcfg(buf, 5997 + family, 5998 + obj->handle, 5999 + AUDIT_NFT_OP_OBJ_RESET, 6000 + GFP_ATOMIC); 6001 + kfree(buf); 6002 + } 6003 + 6066 6004 err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid, 6067 6005 nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0, 6068 6006 family, table, obj, reset); ··· 6150 6064 { 6151 6065 struct sk_buff *skb; 6152 6066 int err; 6067 + char *buf = kasprintf(gfp, "%s:%llu;?:0", 6068 + table->name, table->handle); 6069 + 6070 + audit_log_nfcfg(buf, 6071 + family, 6072 + obj->handle, 6073 + event == NFT_MSG_NEWOBJ ? 6074 + AUDIT_NFT_OP_OBJ_REGISTER : 6075 + AUDIT_NFT_OP_OBJ_UNREGISTER, 6076 + gfp); 6077 + kfree(buf); 6153 6078 6154 6079 if (!report && 6155 6080 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) ··· 6957 6860 { 6958 6861 struct sk_buff *skb; 6959 6862 int err; 6863 + char *buf = kasprintf(GFP_KERNEL, "%s:%llu;%s:%llu", 6864 + flowtable->table->name, flowtable->table->handle, 6865 + flowtable->name, flowtable->handle); 6866 + 6867 + audit_log_nfcfg(buf, 6868 + ctx->family, 6869 + flowtable->hooknum, 6870 + event == NFT_MSG_NEWFLOWTABLE ? 6871 + AUDIT_NFT_OP_FLOWTABLE_REGISTER : 6872 + AUDIT_NFT_OP_FLOWTABLE_UNREGISTER, 6873 + GFP_KERNEL); 6874 + kfree(buf); 6960 6875 6961 6876 if (ctx->report && 6962 6877 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) ··· 7089 6980 struct nlmsghdr *nlh = nlmsg_hdr(skb); 7090 6981 struct sk_buff *skb2; 7091 6982 int err; 6983 + 6984 + audit_log_nfcfg("?:0;?:0", 0, net->nft.base_seq, 6985 + AUDIT_NFT_OP_GEN_REGISTER, GFP_KERNEL); 7092 6986 7093 6987 if (nlmsg_report(nlh) && 7094 6988 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
+3 -2
net/netfilter/x_tables.c
··· 1410 1410 1411 1411 audit_log_nfcfg(table->name, table->af, private->number, 1412 1412 !private->number ? AUDIT_XT_OP_REGISTER : 1413 - AUDIT_XT_OP_REPLACE); 1413 + AUDIT_XT_OP_REPLACE, 1414 + GFP_KERNEL); 1414 1415 return private; 1415 1416 } 1416 1417 EXPORT_SYMBOL_GPL(xt_replace_table); ··· 1474 1473 list_del(&table->list); 1475 1474 mutex_unlock(&xt[table->af].mutex); 1476 1475 audit_log_nfcfg(table->name, table->af, private->number, 1477 - AUDIT_XT_OP_UNREGISTER); 1476 + AUDIT_XT_OP_UNREGISTER, GFP_KERNEL); 1478 1477 kfree(table); 1479 1478 1480 1479 return private;
+4 -6
security/apparmor/audit.c
··· 57 57 struct common_audit_data *sa = ca; 58 58 59 59 if (aa_g_audit_header) { 60 - audit_log_format(ab, "apparmor="); 61 - audit_log_string(ab, aa_audit_type[aad(sa)->type]); 60 + audit_log_format(ab, "apparmor=\"%s\"", 61 + aa_audit_type[aad(sa)->type]); 62 62 } 63 63 64 64 if (aad(sa)->op) { 65 - audit_log_format(ab, " operation="); 66 - audit_log_string(ab, aad(sa)->op); 65 + audit_log_format(ab, " operation=\"%s\"", aad(sa)->op); 67 66 } 68 67 69 68 if (aad(sa)->info) { 70 - audit_log_format(ab, " info="); 71 - audit_log_string(ab, aad(sa)->info); 69 + audit_log_format(ab, " info=\"%s\"", aad(sa)->info); 72 70 if (aad(sa)->error) 73 71 audit_log_format(ab, " error=%d", aad(sa)->error); 74 72 }
+7 -18
security/apparmor/file.c
··· 35 35 } 36 36 37 37 /** 38 - * audit_file_mask - convert mask to permission string 39 - * @buffer: buffer to write string to (NOT NULL) 40 - * @mask: permission mask to convert 41 - */ 42 - static void audit_file_mask(struct audit_buffer *ab, u32 mask) 43 - { 44 - char str[10]; 45 - 46 - aa_perm_mask_to_str(str, sizeof(str), aa_file_perm_chrs, 47 - map_mask_to_chr_mask(mask)); 48 - audit_log_string(ab, str); 49 - } 50 - 51 - /** 52 38 * file_audit_cb - call back for file specific audit fields 53 39 * @ab: audit_buffer (NOT NULL) 54 40 * @va: audit struct to audit values of (NOT NULL) ··· 43 57 { 44 58 struct common_audit_data *sa = va; 45 59 kuid_t fsuid = current_fsuid(); 60 + char str[10]; 46 61 47 62 if (aad(sa)->request & AA_AUDIT_FILE_MASK) { 48 - audit_log_format(ab, " requested_mask="); 49 - audit_file_mask(ab, aad(sa)->request); 63 + aa_perm_mask_to_str(str, sizeof(str), aa_file_perm_chrs, 64 + map_mask_to_chr_mask(aad(sa)->request)); 65 + audit_log_format(ab, " requested_mask=\"%s\"", str); 50 66 } 51 67 if (aad(sa)->denied & AA_AUDIT_FILE_MASK) { 52 - audit_log_format(ab, " denied_mask="); 53 - audit_file_mask(ab, aad(sa)->denied); 68 + aa_perm_mask_to_str(str, sizeof(str), aa_file_perm_chrs, 69 + map_mask_to_chr_mask(aad(sa)->denied)); 70 + audit_log_format(ab, " denied_mask=\"%s\"", str); 54 71 } 55 72 if (aad(sa)->request & AA_AUDIT_FILE_MASK) { 56 73 audit_log_format(ab, " fsuid=%d",
+23 -23
security/apparmor/ipc.c
··· 20 20 21 21 /** 22 22 * audit_ptrace_mask - convert mask to permission string 23 - * @buffer: buffer to write string to (NOT NULL) 24 23 * @mask: permission mask to convert 24 + * 25 + * Returns: pointer to static string 25 26 */ 26 - static void audit_ptrace_mask(struct audit_buffer *ab, u32 mask) 27 + static const char *audit_ptrace_mask(u32 mask) 27 28 { 28 29 switch (mask) { 29 30 case MAY_READ: 30 - audit_log_string(ab, "read"); 31 - break; 31 + return "read"; 32 32 case MAY_WRITE: 33 - audit_log_string(ab, "trace"); 34 - break; 33 + return "trace"; 35 34 case AA_MAY_BE_READ: 36 - audit_log_string(ab, "readby"); 37 - break; 35 + return "readby"; 38 36 case AA_MAY_BE_TRACED: 39 - audit_log_string(ab, "tracedby"); 40 - break; 37 + return "tracedby"; 41 38 } 39 + return ""; 42 40 } 43 41 44 42 /* call back to audit ptrace fields */ ··· 45 47 struct common_audit_data *sa = va; 46 48 47 49 if (aad(sa)->request & AA_PTRACE_PERM_MASK) { 48 - audit_log_format(ab, " requested_mask="); 49 - audit_ptrace_mask(ab, aad(sa)->request); 50 + audit_log_format(ab, " requested_mask=\"%s\"", 51 + audit_ptrace_mask(aad(sa)->request)); 50 52 51 53 if (aad(sa)->denied & AA_PTRACE_PERM_MASK) { 52 - audit_log_format(ab, " denied_mask="); 53 - audit_ptrace_mask(ab, aad(sa)->denied); 54 + audit_log_format(ab, " denied_mask=\"%s\"", 55 + audit_ptrace_mask(aad(sa)->denied)); 54 56 } 55 57 } 56 58 audit_log_format(ab, " peer="); ··· 140 142 } 141 143 142 144 /** 143 - * audit_file_mask - convert mask to permission string 144 - * @buffer: buffer to write string to (NOT NULL) 145 + * audit_signal_mask - convert mask to permission string 145 146 * @mask: permission mask to convert 147 + * 148 + * Returns: pointer to static string 146 149 */ 147 - static void audit_signal_mask(struct audit_buffer *ab, u32 mask) 150 + static const char *audit_signal_mask(u32 mask) 148 151 { 149 152 if (mask & MAY_READ) 150 - audit_log_string(ab, "receive"); 153 + return "receive"; 151 154 if (mask & MAY_WRITE) 152 - audit_log_string(ab, "send"); 155 + return "send"; 156 + return ""; 153 157 } 154 158 155 159 /** ··· 164 164 struct common_audit_data *sa = va; 165 165 166 166 if (aad(sa)->request & AA_SIGNAL_PERM_MASK) { 167 - audit_log_format(ab, " requested_mask="); 168 - audit_signal_mask(ab, aad(sa)->request); 167 + audit_log_format(ab, " requested_mask=\"%s\"", 168 + audit_signal_mask(aad(sa)->request)); 169 169 if (aad(sa)->denied & AA_SIGNAL_PERM_MASK) { 170 - audit_log_format(ab, " denied_mask="); 171 - audit_signal_mask(ab, aad(sa)->denied); 170 + audit_log_format(ab, " denied_mask=\"%s\"", 171 + audit_signal_mask(aad(sa)->denied)); 172 172 } 173 173 } 174 174 if (aad(sa)->signal == SIGUNKNOWN)
+8 -6
security/apparmor/net.c
··· 72 72 { 73 73 struct common_audit_data *sa = va; 74 74 75 - audit_log_format(ab, " family="); 76 75 if (address_family_names[sa->u.net->family]) 77 - audit_log_string(ab, address_family_names[sa->u.net->family]); 76 + audit_log_format(ab, " family=\"%s\"", 77 + address_family_names[sa->u.net->family]); 78 78 else 79 - audit_log_format(ab, "\"unknown(%d)\"", sa->u.net->family); 80 - audit_log_format(ab, " sock_type="); 79 + audit_log_format(ab, " family=\"unknown(%d)\"", 80 + sa->u.net->family); 81 81 if (sock_type_names[aad(sa)->net.type]) 82 - audit_log_string(ab, sock_type_names[aad(sa)->net.type]); 82 + audit_log_format(ab, " sock_type=\"%s\"", 83 + sock_type_names[aad(sa)->net.type]); 83 84 else 84 - audit_log_format(ab, "\"unknown(%d)\"", aad(sa)->net.type); 85 + audit_log_format(ab, " sock_type=\"unknown(%d)\"", 86 + aad(sa)->net.type); 85 87 audit_log_format(ab, " protocol=%d", aad(sa)->net.protocol); 86 88 87 89 if (aad(sa)->request & NET_PERMS_MASK) {
+7 -2
security/lsm_audit.c
··· 241 241 audit_log_untrustedstring(ab, inode->i_sb->s_id); 242 242 audit_log_format(ab, " ino=%lu", inode->i_ino); 243 243 } 244 + audit_getcwd(); 244 245 break; 245 246 } 246 247 case LSM_AUDIT_DATA_FILE: { ··· 255 254 audit_log_untrustedstring(ab, inode->i_sb->s_id); 256 255 audit_log_format(ab, " ino=%lu", inode->i_ino); 257 256 } 257 + audit_getcwd(); 258 258 break; 259 259 } 260 260 case LSM_AUDIT_DATA_IOCTL_OP: { ··· 271 269 } 272 270 273 271 audit_log_format(ab, " ioctlcmd=0x%hx", a->u.op->cmd); 272 + audit_getcwd(); 274 273 break; 275 274 } 276 275 case LSM_AUDIT_DATA_DENTRY: { ··· 286 283 audit_log_untrustedstring(ab, inode->i_sb->s_id); 287 284 audit_log_format(ab, " ino=%lu", inode->i_ino); 288 285 } 286 + audit_getcwd(); 289 287 break; 290 288 } 291 289 case LSM_AUDIT_DATA_INODE: { ··· 304 300 audit_log_format(ab, " dev="); 305 301 audit_log_untrustedstring(ab, inode->i_sb->s_id); 306 302 audit_log_format(ab, " ino=%lu", inode->i_ino); 303 + audit_getcwd(); 307 304 break; 308 305 } 309 306 case LSM_AUDIT_DATA_TASK: { ··· 432 427 a->u.ibendport->port); 433 428 break; 434 429 case LSM_AUDIT_DATA_LOCKDOWN: 435 - audit_log_format(ab, " lockdown_reason="); 436 - audit_log_string(ab, lockdown_reasons[a->u.reason]); 430 + audit_log_format(ab, " lockdown_reason=\"%s\"", 431 + lockdown_reasons[a->u.reason]); 437 432 break; 438 433 } /* switch (a->type) */ 439 434 }