Eric Lee / smarc-fsl-linux-kernel

22 Jun, 2020

2 commits

  • 51d2957b2   audit: fix a net reference leak in audit_list_rules_send() ... Browse Code »

    [ Upstream commit 3054d06719079388a543de6adb812638675ad8f5 ]

    If audit_list_rules_send() fails when trying to create a new thread
    to send the rules it also fails to cleanup properly, leaking a
    reference to a net structure. This patch fixes the error patch and
    renames audit_send_list() to audit_send_list_thread() to better
    match its cousin, audit_send_reply_thread().

    Reported-by: teroincn@gmail.com
    Reviewed-by: Richard Guy Briggs
    Signed-off-by: Paul Moore
    Signed-off-by: Sasha Levin

    Paul Moore
     
  • 189ca174b   audit: fix a net reference leak in audit_send_reply() ... Browse Code »

    [ Upstream commit a48b284b403a4a073d8beb72d2bb33e54df67fb6 ]

    If audit_send_reply() fails when trying to create a new thread to
    send the reply it also fails to cleanup properly, leaking a reference
    to a net structure. This patch fixes the error path and makes a
    handful of other cleanups that came up while fixing the code.

    Reported-by: teroincn@gmail.com
    Reviewed-by: Richard Guy Briggs
    Signed-off-by: Paul Moore
    Signed-off-by: Sasha Levin

    Paul Moore
     

29 Apr, 2020

1 commit

  • 83f82fd55   audit: check the length of userspace generated audit records ... Browse Code »

    commit 763dafc520add02a1f4639b500c509acc0ea8e5b upstream.

    Commit 756125289285 ("audit: always check the netlink payload length
    in audit_receive_msg()") fixed a number of missing message length
    checks, but forgot to check the length of userspace generated audit
    records. The good news is that you need CAP_AUDIT_WRITE to submit
    userspace audit records, which is generally only given to trusted
    processes, so the impact should be limited.

    Cc: stable@vger.kernel.org
    Fixes: 756125289285 ("audit: always check the netlink payload length in audit_receive_msg()")
    Reported-by: syzbot+49e69b4d71a420ceda3e@syzkaller.appspotmail.com
    Signed-off-by: Paul Moore
    Signed-off-by: Greg Kroah-Hartman

    Paul Moore
     

05 Mar, 2020

1 commit

  • 82a6cb7a8   audit: always check the netlink payload length in audit_receive_msg() ... Browse Code »

    commit 756125289285f6e55a03861bf4b6257aa3d19a93 upstream.

    This patch ensures that we always check the netlink payload length
    in audit_receive_msg() before we take any action on the payload
    itself.

    Cc: stable@vger.kernel.org
    Reported-by: syzbot+399c44bf1f43b8747403@syzkaller.appspotmail.com
    Reported-by: syzbot+e4b12d8d202701f08b6d@syzkaller.appspotmail.com
    Signed-off-by: Paul Moore
    Signed-off-by: Greg Kroah-Hartman

    Paul Moore
     

09 Jul, 2019

1 commit

  • 61fc5771f   Merge tag 'audit-pr-20190702' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit ... Browse Code »

    Pull audit updates from Paul Moore:
    "This pull request is a bit early, but with some vacation time coming
    up I wanted to send this out now just in case the remote Internet Gods
    decide not to smile on me once the merge window opens. The patchset
    for v5.3 is pretty minor this time, the highlights include:

    - When the audit daemon is sent a signal, ensure we deliver
    information about the sender even when syscall auditing is not
    enabled/supported.

    - Add the ability to filter audit records based on network address
    family.

    - Tighten the audit field filtering restrictions on string based
    fields.

    - Cleanup the audit field filtering verification code.

    - Remove a few BUG() calls from the audit code"

    * tag 'audit-pr-20190702' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
    audit: remove the BUG() calls in the audit rule comparison functions
    audit: enforce op for string fields
    audit: add saddr_fam filter field
    audit: re-structure audit field valid checks
    audit: deliver signal_info regarless of syscall

    Linus Torvalds
     

31 May, 2019

1 commit

  • 1a59d1b8e   treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 ... Browse Code »

    Based on 1 normalized pattern(s):

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license as published by
    the free software foundation either version 2 of the license or at
    your option any later version this program is distributed in the
    hope that it will be useful but without any warranty without even
    the implied warranty of merchantability or fitness for a particular
    purpose see the gnu general public license for more details you
    should have received a copy of the gnu general public license along
    with this program if not write to the free software foundation inc
    59 temple place suite 330 boston ma 02111 1307 usa

    extracted by the scancode license scanner the SPDX license identifier

    GPL-2.0-or-later

    has been chosen to replace the boilerplate/reference in 1334 file(s).

    Signed-off-by: Thomas Gleixner
    Reviewed-by: Allison Randal
    Reviewed-by: Richard Fontana
    Cc: linux-spdx@vger.kernel.org
    Link: https://lkml.kernel.org/r/20190527070033.113240726@linutronix.de
    Signed-off-by: Greg Kroah-Hartman

    Thomas Gleixner
     

22 May, 2019

1 commit

  • b48345aaf   audit: deliver signal_info regarless of syscall ... Browse Code »

    When a process signals the audit daemon (shutdown, rotate, resume,
    reconfig) but syscall auditing is not enabled, we still want to know the
    identity of the process sending the signal to the audit daemon.

    Move audit_signal_info() out of syscall auditing to general auditing but
    create a new function audit_signal_info_syscall() to take care of the
    syscall dependent parts for when syscall auditing is enabled.

    Please see the github kernel audit issue
    https://github.com/linux-audit/audit-kernel/issues/111

    Signed-off-by: Richard Guy Briggs
    Signed-off-by: Paul Moore

    Richard Guy Briggs
     

21 Mar, 2019

1 commit

  • 73e65b88f   audit: connect LOGIN record to its syscall record ... Browse Code »

    Currently the AUDIT_LOGIN event is a standalone record that isn't
    connected to any other records that may be part of its syscall event. To
    avoid the confusion of generating two events, connect the records by
    using its syscall context.

    Please see the github issue
    https://github.com/linux-audit/audit-kernel/issues/110

    Signed-off-by: Richard Guy Briggs
    Signed-off-by: Paul Moore

    Richard Guy Briggs
     

04 Feb, 2019

1 commit

  • 5f3d544f1   audit: remove audit_context when CONFIG_ AUDIT and not AUDITSYSCALL ... Browse Code »

    Remove audit_context from struct task_struct and struct audit_buffer
    when CONFIG_AUDIT is enabled but CONFIG_AUDITSYSCALL is not.

    Also, audit_log_name() (and supporting inode and fcaps functions) should
    have been put back in auditsc.c when soft and hard link logging was
    normalized since it is only used by syscall auditing.

    See github issue https://github.com/linux-audit/audit-kernel/issues/105

    Signed-off-by: Richard Guy Briggs
    Signed-off-by: Paul Moore

    Richard Guy Briggs
     

31 Jan, 2019

1 commit

  • 57d465771   audit: ignore fcaps on umount ... Browse Code »

    Don't fetch fcaps when umount2 is called to avoid a process hang while
    it waits for the missing resource to (possibly never) re-appear.

    Note the comment above user_path_mountpoint_at():
    * A umount is a special case for path walking. We're not actually interested
    * in the inode in this situation, and ESTALE errors can be a problem. We
    * simply want track down the dentry and vfsmount attached at the mountpoint
    * and avoid revalidating the last component.

    This can happen on ceph, cifs, 9p, lustre, fuse (gluster) or NFS.

    Please see the github issue tracker
    https://github.com/linux-audit/audit-kernel/issues/100

    Signed-off-by: Richard Guy Briggs
    [PM: merge fuzz in audit_log_fcaps()]
    Signed-off-by: Paul Moore

    Richard Guy Briggs
     

26 Jan, 2019

2 commits

  • 2fec30e24   audit: add support for fcaps v3 ... Browse Code »

    V3 namespaced file capabilities were introduced in
    commit 8db6c34f1dbc ("Introduce v3 namespaced file capabilities")

    Add support for these by adding the "frootid" field to the existing
    fcaps fields in the NAME and BPRM_FCAPS records.

    Please see github issue
    https://github.com/linux-audit/audit-kernel/issues/103

    Signed-off-by: Richard Guy Briggs
    Acked-by: Serge Hallyn
    [PM: comment tweak to fit an 80 char line width]
    Signed-off-by: Paul Moore

    Richard Guy Briggs
     
  • 4b7d248b3   audit: move loginuid and sessionid from CONFIG_AUDITSYSCALL to CONFIG_AUDIT ... Browse Code »

    loginuid and sessionid (and audit_log_session_info) should be part of
    CONFIG_AUDIT scope and not CONFIG_AUDITSYSCALL since it is used in
    CONFIG_CHANGE, ANOM_LINK, FEATURE_CHANGE (and INTEGRITY_RULE), none of
    which are otherwise dependent on AUDITSYSCALL.

    Please see github issue
    https://github.com/linux-audit/audit-kernel/issues/104

    Signed-off-by: Richard Guy Briggs
    [PM: tweaked subject line for better grep'ing]
    Signed-off-by: Paul Moore

    Richard Guy Briggs
     

19 Jan, 2019

1 commit

  • 626abcd13   audit: add syscall information to CONFIG_CHANGE records ... Browse Code »

    Tie syscall information to all CONFIG_CHANGE calls since they are all a
    result of user actions.

    Exclude user records from syscall context:
    Since the function audit_log_common_recv_msg() is shared by a number of
    AUDIT_CONFIG_CHANGE and the entire range of AUDIT_USER_* record types,
    and since the AUDIT_CONFIG_CHANGE message type has been converted to a
    syscall accompanied record type, special-case the AUDIT_USER_* range of
    messages so they remain standalone records.

    See: https://github.com/linux-audit/audit-kernel/issues/59
    See: https://github.com/linux-audit/audit-kernel/issues/50

    Signed-off-by: Richard Guy Briggs
    [PM: fix line lengths in kernel/audit.c]
    Signed-off-by: Paul Moore

    Richard Guy Briggs
     

15 Jan, 2019

1 commit

  • 53fc7a01d   audit: give a clue what CONFIG_CHANGE op was involved ... Browse Code »

    The failure to add an audit rule due to audit locked gives no clue
    what CONFIG_CHANGE operation failed.
    Similarly the set operation is the only other operation that doesn't
    give the "op=" field to indicate the action.
    All other CONFIG_CHANGE records include an op= field to give a clue as
    to what sort of configuration change is being executed.

    Since these are the only CONFIG_CHANGE records that that do not have an
    op= field, add them to bring them in line with the rest.

    Old records:
    type=CONFIG_CHANGE msg=audit(1519812997.781:374): pid=610 uid=0 auid=0 ses=1 subj=... audit_enabled=2 res=0
    type=CONFIG_CHANGE msg=audit(2018-06-14 14:55:04.507:47) : audit_enabled=1 old=1 auid=unset ses=unset subj=... res=yes

    New records:
    type=CONFIG_CHANGE msg=audit(1520958477.855:100): pid=610 uid=0 auid=0 ses=1 subj=... op=add_rule audit_enabled=2 res=0

    type=CONFIG_CHANGE msg=audit(2018-06-14 14:55:04.507:47) : op=set audit_enabled=1 old=1 auid=unset ses=unset subj=... res=yes

    See: https://github.com/linux-audit/audit-kernel/issues/59

    Signed-off-by: Richard Guy Briggs
    [PM: fixed checkpatch.pl line length problems]
    Signed-off-by: Paul Moore

    Richard Guy Briggs
     

15 Dec, 2018

1 commit

04 Dec, 2018

1 commit

  • 9a547c7e5   audit: shorten PATH cap values when zero ... Browse Code »

    Since the vast majority of files (99.993% on a typical system) have no
    fcaps, display "0" instead of the full zero-padded 16 hex digits in the
    two PATH record cap_f* fields to save netlink bandwidth and disk space.

    Simply changing the format to %x won't work since the value is two (or
    possibly more in the future) 32-bit hexadecimal values concatenated and
    bits in higher order values will be misrepresented.

    Passes audit-testsuite and userspace tools already work fine.
    Please see the github issue tracker for more details
    https://github.com/linux-audit/audit-kernel/issues/101

    Signed-off-by: Richard Guy Briggs
    Acked-by: Steve Grubb
    Signed-off-by: Paul Moore

    Richard Guy Briggs
     

27 Nov, 2018

2 commits

  • 2a1fe215e   audit: use current whenever possible ... Browse Code »

    There are many places, notably audit_log_task_info() and
    audit_log_exit(), that take task_struct pointers but in reality they
    are always working on the current task. This patch eliminates the
    task_struct arguments and uses current directly which allows a number
    of cleanups as well.

    Acked-by: Richard Guy Briggs
    Signed-off-by: Paul Moore

    Paul Moore
     
  • d0a3f18a7   audit: minimize our use of audit_log_format() ... Browse Code »

    There are some cases where we are making multiple audit_log_format()
    calls in a row, for no apparent reason. Squash these down to a
    single audit_log_format() call whenever possible.

    Acked-by: Richard Guy Briggs
    Signed-off-by: Paul Moore

    Paul Moore
     

20 Nov, 2018

1 commit

  • a2c97da11   audit: use session_info helper ... Browse Code »

    There are still a couple of places (mark and watch config changes) that
    open code auid and ses fields in sequence in records instead of using
    the audit_log_session_info() helper. Use the helper. Adjust the helper
    to accommodate being the first fields. Passes audit-testsuite.

    Signed-off-by: Richard Guy Briggs
    [PM: fixed misspellings in the description]
    Signed-off-by: Paul Moore

    Richard Guy Briggs
     

18 Jul, 2018

1 commit

  • 290e44b7d   audit: use ktime_get_coarse_real_ts64() for timestamps ... Browse Code »

    Commit c72051d5778a ("audit: use ktime_get_coarse_ts64() for time
    access") converted audit's use of current_kernel_time64() to the
    new ktime_get_coarse_ts64() function. Unfortunately this resulted
    in incorrect timestamps, e.g. events stamped with the year 1969
    despite it being 2018. This patch corrects this by using
    ktime_get_coarse_real_ts64() just like the current_kernel_time64()
    wrapper.

    Fixes: c72051d5778a ("audit: use ktime_get_coarse_ts64() for time access")
    Reviewed-by: Arnd Bergmann
    Signed-off-by: Paul Moore

    Paul Moore
     

03 Jul, 2018

1 commit

19 Jun, 2018

2 commits

  • f7859590d   audit: eliminate audit_enabled magic number comparison ... Browse Code »

    Remove comparison of audit_enabled to magic numbers outside of audit.

    Related: https://github.com/linux-audit/audit-kernel/issues/86

    Signed-off-by: Richard Guy Briggs
    Signed-off-by: Paul Moore

    Richard Guy Briggs
     
  • d904ac032   audit: rename FILTER_TYPE to FILTER_EXCLUDE ... Browse Code »

    The AUDIT_FILTER_TYPE name is vague and misleading due to not describing
    where or when the filter is applied and obsolete due to its available
    filter fields having been expanded.

    Userspace has already renamed it from AUDIT_FILTER_TYPE to
    AUDIT_FILTER_EXCLUDE without checking if it already exists. The
    userspace maintainer assures that as long as it is set to the same value
    it will not be a problem since the userspace code does not treat
    compiler warnings as errors. If this policy changes then checks if it
    already exists can be added at the same time.

    See: https://github.com/linux-audit/audit-kernel/issues/89

    Signed-off-by: Richard Guy Briggs
    Signed-off-by: Paul Moore

    Richard Guy Briggs
     

15 May, 2018

1 commit

  • cdfb6b341   audit: use inline function to get audit context ... Browse Code »

    Recognizing that the audit context is an internal audit value, use an
    access function to retrieve the audit context pointer for the task
    rather than reaching directly into the task struct to get it.

    Signed-off-by: Richard Guy Briggs
    [PM: merge fuzz in auditsc.c and selinuxfs.c, checkpatch.pl fixes]
    Signed-off-by: Paul Moore

    Richard Guy Briggs
     

21 Apr, 2018

1 commit

07 Apr, 2018

1 commit

  • 6ad11bdd5   Merge tag 'audit-pr-20180403' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit ... Browse Code »

    Pull audit updates from Paul Moore:
    "We didn't have anything to send for v4.16, but we're back with a
    little more than usual for v4.17.

    Eleven patches in total, most fall into the small fix category, but
    there are three non-trivial changes worth calling out:

    - the audit entry filter is being removed after deprecating it for
    quite a while (years of no one really using it because it turns out
    to be not very practical)

    - created our own version of "__mutex_owner()" because the locking
    folks were upset we were using theirs

    - improved our handling of kernel command line parameters to make
    them more forgiving

    - we fixed auditing of symlink operations

    Everything passes the audit-testsuite and as of a few minutes ago it
    merges well with your tree"

    * tag 'audit-pr-20180403' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
    audit: add refused symlink to audit_names
    audit: remove path param from link denied function
    audit: link denied should not directly generate PATH record
    audit: make ANOM_LINK obey audit_enabled and audit_dummy_context
    audit: do not panic on invalid boot parameter
    audit: track the owner of the command mutex ourselves
    audit: return on memory error to avoid null pointer dereference
    audit: bail before bug check if audit disabled
    audit: deprecate the AUDIT_FILTER_ENTRY filter
    audit: session ID should not set arch quick field pointer
    audit: update bugtracker and source URIs

    Linus Torvalds
     

26 Mar, 2018

1 commit

  • 447a5647c   treewide: Align function definition open/close braces ... Browse Code »

    Some functions definitions have either the initial open brace and/or
    the closing brace outside of column 1.

    Move those braces to column 1.

    This allows various function analyzers like gnu complexity to work
    properly for these modified functions.

    Signed-off-by: Joe Perches
    Acked-by: Andy Shevchenko
    Acked-by: Paul Moore
    Acked-by: Alex Deucher
    Acked-by: Dave Chinner
    Reviewed-by: Darrick J. Wong
    Acked-by: Alexandre Belloni
    Acked-by: Martin K. Petersen
    Acked-by: Takashi Iwai
    Acked-by: Mauro Carvalho Chehab
    Acked-by: Rafael J. Wysocki
    Acked-by: Nicolin Chen
    Acked-by: Martin K. Petersen
    Acked-by: Steven Rostedt (VMware)
    Signed-off-by: Jiri Kosina

    Joe Perches
     

21 Mar, 2018

1 commit

09 Mar, 2018

2 commits

07 Mar, 2018

1 commit

  • 11dd26663   audit: do not panic on invalid boot parameter ... Browse Code »

    If you pass in an invalid audit boot parameter value, e.g. "audit=off",
    the kernel panics very early in boot before the regular console is
    initialized. Unless you have earlyprintk enabled, there is no
    indication of what the problem is on the console.

    Convert the panic() calls to pr_err(), and leave auditing enabled if an
    invalid parameter value was passed in.

    Modify the parameter to also accept "on" or "off" as valid values, and
    update the documentation accordingly.

    Signed-off-by: Greg Edwards
    Signed-off-by: Paul Moore

    Greg Edwards
     

24 Feb, 2018

1 commit

  • ce423631c   audit: track the owner of the command mutex ourselves ... Browse Code »

    Evidently the __mutex_owner() function was never intended for use
    outside the core mutex code, so build a thing locking wrapper around
    the mutex code which allows us to track the mutex owner.

    One, arguably positive, side effect is that this allows us to hide
    the audit_cmd_mutex inside of kernel/audit.c behind the lock/unlock
    functions.

    Reported-by: Peter Zijlstra
    Reviewed-by: Richard Guy Briggs
    Signed-off-by: Paul Moore

    Paul Moore
     

22 Feb, 2018

1 commit

  • 23138ead2   audit: return on memory error to avoid null pointer dereference ... Browse Code »

    If there is a memory allocation error when trying to change an audit
    kernel feature value, the ignored allocation error will trigger a NULL
    pointer dereference oops on subsequent use of that pointer. Return
    instead.

    Passes audit-testsuite.
    See: https://github.com/linux-audit/audit-kernel/issues/76

    Signed-off-by: Richard Guy Briggs
    [PM: not necessary (other funcs check for NULL), but a good practice]
    Signed-off-by: Paul Moore

    Richard Guy Briggs
     

15 Feb, 2018

1 commit

11 Nov, 2017

6 commits