Commit 038cbcf65fd6a30c79e3917690b8c46321a27915
Committed by
Al Viro
Al Viro
1 parent
e85188f424
Exists in
master
and in
4 other branches
Audit: unify the printk of an skb when auditd not around
Remove code duplication of skb printk when auditd is not around in userspace to deal with this message. Signed-off-by: Eric Paris <eparis@redhat.com>
Showing 1 changed file with 22 additions and 17 deletions Side-by-side Diff
kernel/audit.c
| ... | ... | @@ -375,6 +375,25 @@ |
| 375 | 375 | kfree_skb(skb); |
| 376 | 376 | } |
| 377 | 377 | |
| 378 | +/* | |
| 379 | + * For one reason or another this nlh isn't getting delivered to the userspace | |
| 380 | + * audit daemon, just send it to printk. | |
| 381 | + */ | |
| 382 | +static void audit_printk_skb(struct sk_buff *skb) | |
| 383 | +{ | |
| 384 | + struct nlmsghdr *nlh = nlmsg_hdr(skb); | |
| 385 | + char *data = NLMSG_DATA(nlh); | |
| 386 | + | |
| 387 | + if (nlh->nlmsg_type != AUDIT_EOE) { | |
| 388 | + if (printk_ratelimit()) | |
| 389 | + printk(KERN_NOTICE "type=%d %s\n", nlh->nlmsg_type, data); | |
| 390 | + else | |
| 391 | + audit_log_lost("printk limit exceeded\n"); | |
| 392 | + } | |
| 393 | + | |
| 394 | + audit_hold_skb(skb); | |
| 395 | +} | |
| 396 | + | |
| 378 | 397 | static void kauditd_send_skb(struct sk_buff *skb) |
| 379 | 398 | { |
| 380 | 399 | int err; |
| ... | ... | @@ -427,14 +446,8 @@ |
| 427 | 446 | if (skb) { |
| 428 | 447 | if (audit_pid) |
| 429 | 448 | kauditd_send_skb(skb); |
| 430 | - else { | |
| 431 | - if (printk_ratelimit()) | |
| 432 | - printk(KERN_NOTICE "%s\n", skb->data + NLMSG_SPACE(0)); | |
| 433 | - else | |
| 434 | - audit_log_lost("printk limit exceeded\n"); | |
| 435 | - | |
| 436 | - audit_hold_skb(skb); | |
| 437 | - } | |
| 449 | + else | |
| 450 | + audit_printk_skb(skb); | |
| 438 | 451 | } else { |
| 439 | 452 | DECLARE_WAITQUEUE(wait, current); |
| 440 | 453 | set_current_state(TASK_INTERRUPTIBLE); |
| ... | ... | @@ -1475,15 +1488,7 @@ |
| 1475 | 1488 | skb_queue_tail(&audit_skb_queue, ab->skb); |
| 1476 | 1489 | wake_up_interruptible(&kauditd_wait); |
| 1477 | 1490 | } else { |
| 1478 | - if (nlh->nlmsg_type != AUDIT_EOE) { | |
| 1479 | - if (printk_ratelimit()) { | |
| 1480 | - printk(KERN_NOTICE "type=%d %s\n", | |
| 1481 | - nlh->nlmsg_type, | |
| 1482 | - ab->skb->data + NLMSG_SPACE(0)); | |
| 1483 | - } else | |
| 1484 | - audit_log_lost("printk limit exceeded\n"); | |
| 1485 | - } | |
| 1486 | - audit_hold_skb(ab->skb); | |
| 1491 | + audit_printk_skb(ab->skb); | |
| 1487 | 1492 | } |
| 1488 | 1493 | ab->skb = NULL; |
| 1489 | 1494 | } |