Commit 48887e63d6e057543067327da6b091297f7fe645

Authored by Al Viro
1 parent 7f0ed77d24

[PATCH] fix broken timestamps in AVC generated by kernel threads

Timestamp in audit_context is valid only if ->in_syscall is set.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Showing 3 changed files with 7 additions and 6 deletions Side-by-side Diff

include/linux/audit.h
... ... @@ -435,7 +435,7 @@
435 435  
436 436 /* Private API (for audit.c only) */
437 437 extern unsigned int audit_serial(void);
438   -extern void auditsc_get_stamp(struct audit_context *ctx,
  438 +extern int auditsc_get_stamp(struct audit_context *ctx,
439 439 struct timespec *t, unsigned int *serial);
440 440 extern int audit_set_loginuid(struct task_struct *task, uid_t loginuid);
441 441 #define audit_get_loginuid(t) ((t)->loginuid)
... ... @@ -518,7 +518,7 @@
518 518 #define audit_inode(n,d) do { ; } while (0)
519 519 #define audit_inode_child(d,i,p) do { ; } while (0)
520 520 #define audit_core_dumps(i) do { ; } while (0)
521   -#define auditsc_get_stamp(c,t,s) do { BUG(); } while (0)
  521 +#define auditsc_get_stamp(c,t,s) (0)
522 522 #define audit_get_loginuid(t) (-1)
523 523 #define audit_get_sessionid(t) (-1)
524 524 #define audit_log_task_context(b) do { ; } while (0)
... ... @@ -1121,9 +1121,7 @@
1121 1121 static inline void audit_get_stamp(struct audit_context *ctx,
1122 1122 struct timespec *t, unsigned int *serial)
1123 1123 {
1124   - if (ctx)
1125   - auditsc_get_stamp(ctx, t, serial);
1126   - else {
  1124 + if (!ctx || !auditsc_get_stamp(ctx, t, serial)) {
1127 1125 *t = CURRENT_TIME;
1128 1126 *serial = audit_serial();
1129 1127 }
... ... @@ -1957,15 +1957,18 @@
1957 1957 *
1958 1958 * Also sets the context as auditable.
1959 1959 */
1960   -void auditsc_get_stamp(struct audit_context *ctx,
  1960 +int auditsc_get_stamp(struct audit_context *ctx,
1961 1961 struct timespec *t, unsigned int *serial)
1962 1962 {
  1963 + if (!ctx->in_syscall)
  1964 + return 0;
1963 1965 if (!ctx->serial)
1964 1966 ctx->serial = audit_serial();
1965 1967 t->tv_sec = ctx->ctime.tv_sec;
1966 1968 t->tv_nsec = ctx->ctime.tv_nsec;
1967 1969 *serial = ctx->serial;
1968 1970 ctx->auditable = 1;
  1971 + return 1;
1969 1972 }
1970 1973  
1971 1974 /* global counter which is incremented every time something logs in */