Messages in this thread | | | Date | Wed, 7 Aug 2013 21:06:12 +0200 | From | Oleg Nesterov <> | Subject | Re: [PATCH 1/1] audit_alloc: clear TIF_SYSCALL_AUDIT if !audit_context |
| |
On 08/07, Kees Cook wrote: > > On Wed, Aug 7, 2013 at 11:05 AM, Oleg Nesterov <oleg@redhat.com> wrote: > > > > diff --git a/kernel/auditsc.c b/kernel/auditsc.c > > index 9845cb3..95293ab 100644 > > --- a/kernel/auditsc.c > > +++ b/kernel/auditsc.c > > @@ -943,8 +943,10 @@ int audit_alloc(struct task_struct *tsk) > > return 0; /* Return if not auditing. */ > > > > state = audit_filter_task(tsk, &key); > > - if (state == AUDIT_DISABLED) > > + if (state == AUDIT_DISABLED) { > > + clear_tsk_thread_flag(tsk, TIF_SYSCALL_AUDIT); > > return 0; > > + } > > > > if (!(context = audit_alloc_context(state))) { > > kfree(key); > > -- > > 1.5.5.1 > > > > > > Interestingly, I see no other callers of "clear_tsk_thread_flag(tsk, > TIF_SYSCALL_AUDIT)" :) > > This patch seems right, since TIF_SYSCALL_AUDIT is set only when > audit_filter_task != AUDIT_DISABLED. Though maybe this should be > explicitly handled in dup_task_struct()?
Personally I agree.
But note that we have more clear-tif-after-fork's. IOW, I think we should probably add copy_tif_flags() or something which acts like copy_flags(). TIF_SYSCALL_TRACE, TIF_SYSCALL_EMU, TIF_NEED_RESCHED at least. Until then we should follow the copy-them-all-then-clear rule.
Besides, if we add the new clear_tsk_thread_flag() into copy_process's path we probably need ifdef or ifdef'ed helper.
Oleg.
| |