lkml.org 
[lkml]   [2013]   [May]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH RFC 06/48] Audit: make kauditd_task per user namespace
Date
This patch makes kauditd_task per user namespace,
Since right now we only allow user in init user
namesapce to send audit netlink message to kernel,
so actually the kauditd_task belongs to other user
namespace will still not run.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
---
include/linux/user_namespace.h | 1 +
kernel/audit.c | 25 +++++++++++++++----------
2 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
index 53420a4..24f7c2f 100644
--- a/include/linux/user_namespace.h
+++ b/include/linux/user_namespace.h
@@ -23,6 +23,7 @@ struct audit_ctrl {
struct sock *sock;
struct sk_buff_head queue;
struct sk_buff_head hold_queue;
+ struct task_struct *kauditd_task;
};
#endif

diff --git a/kernel/audit.c b/kernel/audit.c
index 61562c5..839c4c0 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -129,7 +129,6 @@ static DEFINE_SPINLOCK(audit_freelist_lock);
static int audit_freelist_count;
static LIST_HEAD(audit_freelist);

-static struct task_struct *kauditd_task;
static DECLARE_WAIT_QUEUE_HEAD(kauditd_wait);
static DECLARE_WAIT_QUEUE_HEAD(audit_backlog_wait);

@@ -418,8 +417,9 @@ static void kauditd_send_skb(struct sk_buff *skb)
static int kauditd_thread(void *dummy)
{
struct sk_buff *skb;
- struct sk_buff_head *queue = &init_user_ns.audit.queue;
- struct sk_buff_head *hold_queue = &init_user_ns.audit.hold_queue;
+ struct user_namespace *ns = dummy;
+ struct sk_buff_head *queue = &ns->audit.queue;
+ struct sk_buff_head *hold_queue = &ns->audit.hold_queue;

set_freezable();
while (!kthread_should_stop()) {
@@ -663,14 +663,16 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
ns = current_user_ns();
/* As soon as there's any sign of userspace auditd,
* start kauditd to talk to it */
- if (!kauditd_task) {
- kauditd_task = kthread_run(kauditd_thread, NULL, "kauditd");
- if (IS_ERR(kauditd_task)) {
- err = PTR_ERR(kauditd_task);
- kauditd_task = NULL;
- return err;
- }
+ if (!ns->audit.kauditd_task) {
+ struct task_struct *tsk;
+
+ tsk = kthread_run(kauditd_thread, ns, "kauditd");
+ if (IS_ERR(tsk))
+ return PTR_ERR(tsk);
+
+ ns->audit.kauditd_task = tsk;
}
+
loginuid = audit_get_loginuid(current);
sessionid = audit_get_sessionid(current);
security_task_getsecid(current, &sid);
@@ -1615,6 +1617,9 @@ void audit_free_user_ns(struct user_namespace *ns)

skb_queue_purge(&ns->audit.queue);
skb_queue_purge(&ns->audit.hold_queue);
+
+ if (ns->audit.kauditd_task)
+ kthread_stop(ns->audit.kauditd_task);
}

EXPORT_SYMBOL(audit_log_start);
--
1.8.1.4


\
 
 \ /
  Last update: 2013-05-07 08:07    [W:0.131 / U:1.152 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site