Messages in this thread | | | From | Paul Moore <> | Date | Thu, 28 Jun 2018 18:25:25 -0400 | Subject | Re: [RFC PATCH ghak59 V1 5/6] audit: move EOE record after kill_trees for exit/free |
| |
On Thu, Jun 14, 2018 at 4:23 PM Richard Guy Briggs <rgb@redhat.com> wrote: > The EOE record was being issued prior to the pruning of the killed_tree > list. > > Move the EOE record creation out of audit_log_exit() and into its > callers __audit_free() and __audit_syscall_exit() so that > audit_kill_trees() can be called prior to the EOE record creation and > any purged trees CONFIG_CHANGE records included in the syscall record > event. > > See: https://github.com/linux-audit/audit-kernel/issues/50 > See: https://github.com/linux-audit/audit-kernel/issues/59 > Signed-off-by: Richard Guy Briggs <rgb@redhat.com> > --- > kernel/auditsc.c | 24 +++++++++++++++++------- > 1 file changed, 17 insertions(+), 7 deletions(-)
See my comments in 4/6. Assuming we are able to shuffle the ordering of audit_log_exit() and audit_kill_trees() this patch would no longer be needed, yes?
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c > index 2590c9e..d56aead 100644 > --- a/kernel/auditsc.c > +++ b/kernel/auditsc.c > @@ -1460,10 +1460,6 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts > > audit_log_proctitle(tsk, context); > > - /* Send end of event record to help user space know we are finished */ > - ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE); > - if (ab) > - audit_log_end(ab); > if (call_panic) > audit_panic("error converting sid to string"); > } > @@ -1491,6 +1487,14 @@ void __audit_free(struct task_struct *tsk) > audit_log_exit(context, tsk); > if (!list_empty(&context->killed_trees)) > audit_kill_trees(context); > + if (context->in_syscall && context->current_state == AUDIT_RECORD_CONTEXT) { > + struct audit_buffer *ab; > + > + /* Send end of event record to help user space know we are finished */ > + ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE); > + if (ab) > + audit_log_end(ab); > + } > > audit_free_context(context); > } > @@ -1572,13 +1576,19 @@ void __audit_syscall_exit(int success, long return_code) > > if (context->in_syscall && context->current_state == AUDIT_RECORD_CONTEXT) > audit_log_exit(context, current); > + if (!list_empty(&context->killed_trees)) > + audit_kill_trees(context); > + if (context->in_syscall && context->current_state == AUDIT_RECORD_CONTEXT) { > + struct audit_buffer *ab; > > + /* Send end of event record to help user space know we are finished */ > + ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE); > + if (ab) > + audit_log_end(ab); > + } > context->in_syscall = 0; > context->prio = context->state == AUDIT_RECORD_CONTEXT ? ~0ULL : 0; > > - if (!list_empty(&context->killed_trees)) > - audit_kill_trees(context); > - > audit_free_names(context); > unroll_tree_refs(context, NULL, 0); > audit_free_aux(context); > -- > 1.8.3.1 >
-- paul moore www.paul-moore.com
| |