lkml.org 
[lkml]   [2018]   [Feb]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH] audit: deprecate the AUDIT_FILTER_ENTRY filter
On Wed, Feb 7, 2018 at 6:24 AM, Richard Guy Briggs <rgb@redhat.com> wrote:
> The audit entry filter has been long deprecated with userspace support
> finally removed in audit-v2.6.7 and plans to remove kernel support have
> existed since kernel-v2.6.31.
> Remove it.
>
> Passes audit-testsuite.
>
> See: https://github.com/linux-audit/audit-kernel/issues/6
> Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
> ---
> kernel/auditfilter.c | 4 ++--
> kernel/auditsc.c | 3 ++-
> 2 files changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
> index 4a1758a..1bbf5de 100644
> --- a/kernel/auditfilter.c
> +++ b/kernel/auditfilter.c
> @@ -258,8 +258,8 @@ static inline struct audit_entry *audit_to_entry_common(struct audit_rule_data *
> goto exit_err;
> #ifdef CONFIG_AUDITSYSCALL
> case AUDIT_FILTER_ENTRY:
> - if (rule->action == AUDIT_ALWAYS)
> - goto exit_err;
> + pr_err("AUDIT_FILTER_ENTRY is deprecated\n");
> + goto exit_err;
> case AUDIT_FILTER_EXIT:
> case AUDIT_FILTER_TASK:
> #endif
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index e80459f..9348302 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -1530,7 +1530,8 @@ void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2,
> context->dummy = !audit_n_rules;
> if (!context->dummy && state == AUDIT_BUILD_CONTEXT) {
> context->prio = 0;
> - state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_ENTRY]);
> + if (auditd_test_task(tsk))
> + return;

Since we are removing the call to audit_filter_syscall() entirely -
which would appear to be the right thing - I wonder if it would be a
good idea to move the auditd_test_task() check earlier in the function
(fail early). I'm thinking up where we check audit_enabled, before we
start populating context.

> }
> if (state == AUDIT_DISABLED)
> return;
> --
> 1.8.3.1
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

--
paul moore
www.paul-moore.com

\
 
 \ /
  Last update: 2018-02-09 00:59    [W:0.042 / U:1.796 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site