lkml.org 
[lkml]   [2019]   [Apr]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [PATCH ghak90 V5 06/10] audit: add support for non-syscall auxiliary records
    On Fri, Mar 15, 2019 at 2:34 PM Richard Guy Briggs <rgb@redhat.com> wrote:
    > Standalone audit records have the timestamp and serial number generated
    > on the fly and as such are unique, making them standalone. This new
    > function audit_alloc_local() generates a local audit context that will
    > be used only for a standalone record and its auxiliary record(s). The
    > context is discarded immediately after the local associated records are
    > produced.
    >
    > Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
    > Acked-by: Serge Hallyn <serge@hallyn.com>
    > ---
    > include/linux/audit.h | 8 ++++++++
    > kernel/audit.h | 1 +
    > kernel/auditsc.c | 35 ++++++++++++++++++++++++++++++-----
    > 3 files changed, 39 insertions(+), 5 deletions(-)

    ...

    > diff --git a/include/linux/audit.h b/include/linux/audit.h
    > index ebd6625ca80e..6db5aba7cc01 100644
    > --- a/include/linux/audit.h
    > +++ b/include/linux/audit.h
    > @@ -285,6 +285,8 @@ static inline void audit_log_contid(struct audit_context *context, u64 contid)
    >
    > /* These are defined in auditsc.c */
    > /* Public API */
    > +extern struct audit_context *audit_alloc_local(gfp_t gfpflags);
    > +extern void audit_free_context(struct audit_context *context);
    > extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1,
    > unsigned long a2, unsigned long a3);
    > extern void __audit_syscall_exit(int ret_success, long ret_value);
    > @@ -512,6 +514,12 @@ static inline void audit_fanotify(unsigned int response)
    > extern int audit_n_rules;
    > extern int audit_signals;
    > #else /* CONFIG_AUDITSYSCALL */
    > +static inline struct audit_context *audit_alloc_local(gfp_t gfpflags)
    > +{
    > + return NULL;
    > +}
    > +static inline void audit_free_context(struct audit_context *context)
    > +{ }
    > static inline void audit_syscall_entry(int major, unsigned long a0,
    > unsigned long a1, unsigned long a2,
    > unsigned long a3)
    > diff --git a/kernel/audit.h b/kernel/audit.h
    > index c5ac6436317e..2a1a8b8a8019 100644
    > --- a/kernel/audit.h
    > +++ b/kernel/audit.h
    > @@ -111,6 +111,7 @@ struct audit_proctitle {
    > struct audit_context {
    > int dummy; /* must be the first element */
    > int in_syscall; /* 1 if task is in a syscall */
    > + bool local; /* local context needed */

    It's very possible I've missed it, but "local" never gets used in any
    meaningful way in this patchset does it?

    > enum audit_state state, current_state;
    > unsigned int serial; /* serial number for record */
    > int major; /* syscall number */

    --
    paul moore
    www.paul-moore.com

    \
     
     \ /
      Last update: 2019-04-01 16:51    [W:4.119 / U:0.060 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site