04 Jan, 2012

3 commits


31 Oct, 2011

1 commit

  • The changed files were only including linux/module.h for the
    EXPORT_SYMBOL infrastructure, and nothing else. Revector them
    onto the isolated export header for faster compile times.

    Nothing to see here but a whole lot of instances of:

    -#include
    +#include

    This commit is only changing the kernel dir; next targets
    will probably be mm, fs, the arch dirs, etc.

    Signed-off-by: Paul Gortmaker

    Paul Gortmaker
     

27 Jul, 2011

1 commit

  • This allows us to move duplicated code in
    (atomic_inc_not_zero() for now) to

    Signed-off-by: Arun Sharma
    Reviewed-by: Eric Dumazet
    Cc: Ingo Molnar
    Cc: David Miller
    Cc: Eric Dumazet
    Acked-by: Mike Frysinger
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Arun Sharma
     

27 Apr, 2011

1 commit

  • Commit c69e8d9c01db ("CRED: Use RCU to access another task's creds and to
    release a task's own creds") added calls to get_task_cred and put_cred in
    audit_filter_rules. Profiling with a large number of audit rules active
    on the exit chain shows that we are spending upto 48% in this routine for
    syscall intensive tests, most of which is in the atomic ops.

    1. The code should be accessing tsk->cred rather than tsk->real_cred.
    2. Since tsk is current (or tsk is being created by copy_process) access to
    tsk->cred without rcu read lock is possible. At the request of the audit
    maintainer, a new flag has been added to audit_filter_rules in order to make
    this explicit and guide future code.

    Signed-off-by: Tony Jones
    Acked-by: Eric Paris
    Signed-off-by: Jiri Kosina

    Tony Jones
     

31 Mar, 2011

1 commit


30 Oct, 2010

1 commit

  • Normal syscall audit doesn't catch 5th argument of syscall. It also
    doesn't catch the contents of userland structures pointed to be
    syscall argument, so for both old and new mmap(2) ABI it doesn't
    record the descriptor we are mapping. For old one it also misses
    flags.

    Signed-off-by: Al Viro

    Al Viro
     

11 Aug, 2010

1 commit


28 Jul, 2010

4 commits


06 Apr, 2010

1 commit

  • There have been a number of reports of people seeing the message:
    "name_count maxed, losing inode data: dev=00:05, inode=3185"
    in dmesg. These usually lead to people reporting problems to the filesystem
    group who are in turn clueless what they mean.

    Eventually someone finds me and I explain what is going on and that
    these come from the audit system. The basics of the problem is that the
    audit subsystem never expects a single syscall to 'interact' (for some
    wish washy meaning of interact) with more than 20 inodes. But in fact
    some operations like loading kernel modules can cause changes to lots of
    inodes in debugfs.

    There are a couple real fixes being bandied about including removing the
    fixed compile time limit of 20 or not auditing changes in debugfs (or
    both) but neither are small and obvious so I am not sending them for
    immediate inclusion (I hope Al forwards a real solution next devel
    window).

    In the meantime this patch simply adds 'audit' to the beginning of the
    crap message so if a user sees it, they come blame me first and we can
    talk about what it means and make sure we understand all of the reasons
    it can happen and make sure this gets solved correctly in the long run.

    Signed-off-by: Eric Paris
    Signed-off-by: Linus Torvalds

    Eric Paris
     

30 Mar, 2010

1 commit

  • …it slab.h inclusion from percpu.h

    percpu.h is included by sched.h and module.h and thus ends up being
    included when building most .c files. percpu.h includes slab.h which
    in turn includes gfp.h making everything defined by the two files
    universally available and complicating inclusion dependencies.

    percpu.h -> slab.h dependency is about to be removed. Prepare for
    this change by updating users of gfp and slab facilities include those
    headers directly instead of assuming availability. As this conversion
    needs to touch large number of source files, the following script is
    used as the basis of conversion.

    http://userweb.kernel.org/~tj/misc/slabh-sweep.py

    The script does the followings.

    * Scan files for gfp and slab usages and update includes such that
    only the necessary includes are there. ie. if only gfp is used,
    gfp.h, if slab is used, slab.h.

    * When the script inserts a new include, it looks at the include
    blocks and try to put the new include such that its order conforms
    to its surrounding. It's put in the include block which contains
    core kernel includes, in the same order that the rest are ordered -
    alphabetical, Christmas tree, rev-Xmas-tree or at the end if there
    doesn't seem to be any matching order.

    * If the script can't find a place to put a new include (mostly
    because the file doesn't have fitting include block), it prints out
    an error message indicating which .h file needs to be added to the
    file.

    The conversion was done in the following steps.

    1. The initial automatic conversion of all .c files updated slightly
    over 4000 files, deleting around 700 includes and adding ~480 gfp.h
    and ~3000 slab.h inclusions. The script emitted errors for ~400
    files.

    2. Each error was manually checked. Some didn't need the inclusion,
    some needed manual addition while adding it to implementation .h or
    embedding .c file was more appropriate for others. This step added
    inclusions to around 150 files.

    3. The script was run again and the output was compared to the edits
    from #2 to make sure no file was left behind.

    4. Several build tests were done and a couple of problems were fixed.
    e.g. lib/decompress_*.c used malloc/free() wrappers around slab
    APIs requiring slab.h to be added manually.

    5. The script was run on all .h files but without automatically
    editing them as sprinkling gfp.h and slab.h inclusions around .h
    files could easily lead to inclusion dependency hell. Most gfp.h
    inclusion directives were ignored as stuff from gfp.h was usually
    wildly available and often used in preprocessor macros. Each
    slab.h inclusion directive was examined and added manually as
    necessary.

    6. percpu.h was updated not to include slab.h.

    7. Build test were done on the following configurations and failures
    were fixed. CONFIG_GCOV_KERNEL was turned off for all tests (as my
    distributed build env didn't work with gcov compiles) and a few
    more options had to be turned off depending on archs to make things
    build (like ipr on powerpc/64 which failed due to missing writeq).

    * x86 and x86_64 UP and SMP allmodconfig and a custom test config.
    * powerpc and powerpc64 SMP allmodconfig
    * sparc and sparc64 SMP allmodconfig
    * ia64 SMP allmodconfig
    * s390 SMP allmodconfig
    * alpha SMP allmodconfig
    * um on x86_64 SMP allmodconfig

    8. percpu.h modifications were reverted so that it could be applied as
    a separate patch and serve as bisection point.

    Given the fact that I had only a couple of failures from tests on step
    6, I'm fairly confident about the coverage of this conversion patch.
    If there is a breakage, it's likely to be something in one of the arch
    headers which should be easily discoverable easily on most builds of
    the specific arch.

    Signed-off-by: Tejun Heo <tj@kernel.org>
    Guess-its-ok-by: Christoph Lameter <cl@linux-foundation.org>
    Cc: Ingo Molnar <mingo@redhat.com>
    Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>

    Tejun Heo
     

09 Feb, 2010

1 commit


23 Dec, 2009

1 commit

  • * pull ACC_MODE to fs.h; we have several copies all over the place
    * nightmarish expression calculating f_mode by f_flags deserves a helper
    too (OPEN_FMODE(flags))

    Signed-off-by: Al Viro

    Al Viro
     

24 Sep, 2009

1 commit


24 Jun, 2009

4 commits

  • If syscall removes the root of subtree being watched, we
    definitely do not want the rules refering that subtree
    to be destroyed without the syscall in question having
    a chance to match them.

    Signed-off-by: Al Viro

    Al Viro
     
  • A number of places in the audit system we send an op= followed by a string
    that includes spaces. Somehow this works but it's just wrong. This patch
    moves all of those that I could find to be quoted.

    Example:

    Change From: type=CONFIG_CHANGE msg=audit(1244666690.117:31): auid=0 ses=1
    subj=unconfined_u:unconfined_r:auditctl_t:s0-s0:c0.c1023 op=remove rule
    key="number2" list=4 res=0

    Change To: type=CONFIG_CHANGE msg=audit(1244666690.117:31): auid=0 ses=1
    subj=unconfined_u:unconfined_r:auditctl_t:s0-s0:c0.c1023 op="remove rule"
    key="number2" list=4 res=0

    Signed-off-by: Eric Paris

    Eric Paris
     
  • In preparation for converting audit to use fsnotify instead of inotify we
    seperate the inode watching code into it's own file. This is similar to
    how the audit tree watching code is already seperated into audit_tree.c

    Signed-off-by: Eric Paris

    Eric Paris
     
  • The audit execve record splitting code estimates the length of the message
    generated. But it forgot to include the "" that wrap each string in its
    estimation. This means that execve messages with lots of tiny (1-2 byte)
    arguments could still cause records greater than 8k to be emitted. Simply
    fix the estimate.

    Signed-off-by: Eric Paris

    Eric Paris
     

06 Apr, 2009

5 commits

  • audit_log_d_path had spaces in the strings which would be emitted on the
    error paths. This patch simply replaces those spaces with an _ or removes
    the needless spaces entirely.

    Signed-off-by: Eric Paris
    Signed-off-by: Al Viro

    Eric Paris
     
  • after 0590b9335a1c72a3f0defcc6231287f7817e07c8 audit_set_auditable() is now only
    used by the audit tree code. If CONFIG_AUDIT_TREE is unset it will be defined
    but unused. This patch simply moves the function inside a CONFIG_AUDIT_TREE
    block.

    cc1: warnings being treated as errors
    /home/acme_unencrypted/git/linux-2.6-tip/kernel/auditsc.c:745: error: ‘audit_set_auditable’ defined but not used
    make[2]: *** [kernel/auditsc.o] Error 1
    make[1]: *** [kernel] Error 2
    make[1]: *** Waiting for unfinished jobs....

    Signed-off-by: Eric Paris
    Signed-off-by: Al Viro

    Eric Paris
     
  • The audit subsystem treats syscall return codes as type long, unfortunately
    the audit_get_context() function mistakenly converts the return code to an
    int type in the parameters which could cause problems on systems where the
    sizeof(int) != sizeof(long).

    Signed-off-by: Paul Moore
    Signed-off-by: Al Viro

    Paul Moore
     
  • Fix auditsc kernel-doc notation:

    Warning(linux-2.6.28-git7//kernel/auditsc.c:2156): No description found for parameter 'attr'
    Warning(linux-2.6.28-git7//kernel/auditsc.c:2156): Excess function parameter 'u_attr' description in '__audit_mq_open'
    Warning(linux-2.6.28-git7//kernel/auditsc.c:2204): No description found for parameter 'notification'
    Warning(linux-2.6.28-git7//kernel/auditsc.c:2204): Excess function parameter 'u_notification' description in '__audit_mq_notify'

    Signed-off-by: Randy Dunlap
    cc: Al Viro
    cc: Eric Paris
    Signed-off-by: Al Viro

    Randy Dunlap
     
  • (updated)
    Added hunk that changes the comment, the rest is the same.

    EXECVE records contain a newline after every argument. auditd converts
    "\n" to " " so you cannot see newlines even in raw logs, but they're
    there nevertheless. If you're not using auditd, you need to work round
    them. These '\n' chars are can be easily replaced by spaces when
    creating record in kernel. Note there is no need for trailing '\n' in
    an audit record.

    record before this patch:
    "type=EXECVE msg=audit(1231421801.566:31): argc=4 a0=\"./test\"\na1=\"a\"\na2=\"b\"\na3=\"c\"\n"

    record after this patch:
    "type=EXECVE msg=audit(1231421801.566:31): argc=4 a0=\"./test\" a1=\"a\" a2=\"b\" a3=\"c\""

    Signed-off-by: Jiri Pirko
    Acked-by: Eric Paris
    Signed-off-by: Al Viro

    Jiri Pirko
     

01 Apr, 2009

1 commit


05 Jan, 2009

12 commits