01 May, 2006
3 commits
-
Hi,
The patch below builds upon the patch sent earlier and adds subject label to
all audit events generated via the netlink interface. It also cleans up a few
other minor things.Signed-off-by: Steve Grubb
Signed-off-by: Al Viro
-
The below patch should be applied after the inode and ipc sid patches.
This patch is a reworking of Tim's patch that has been updated to match
the inode and ipc patches since its similar.[updated:
> Stephen Smalley also wanted to change a variable from isec to tsec in the
> user sid patch. ]Signed-off-by: Steve Grubb
Signed-off-by: Al Viro -
This patch provides the ability to filter audit messages based on the
elements of the process' SELinux context (user, role, type, mls sensitivity,
and mls clearance). It uses the new interfaces from selinux to opaquely
store information related to the selinux context and to filter based on that
information. It also uses the callback mechanism provided by selinux to
refresh the information when a new policy is loaded.Signed-off-by: Al Viro
01 Apr, 2006
1 commit
-
The boot cmdline is parsed in parse_early_param() and
parse_args(,unknown_bootoption).And __setup() is used in obsolete_checksetup().
start_kernel()
-> parse_args()
-> unknown_bootoption()
-> obsolete_checksetup()If __setup()'s callback (->setup_func()) returns 1 in
obsolete_checksetup(), obsolete_checksetup() thinks a parameter was
handled.If ->setup_func() returns 0, obsolete_checksetup() tries other
->setup_func(). If all ->setup_func() that matched a parameter returns 0,
a parameter is seted to argv_init[].Then, when runing /sbin/init or init=app, argv_init[] is passed to the app.
If the app doesn't ignore those arguments, it will warning and exit.This patch fixes a wrong usage of it, however fixes obvious one only.
Signed-off-by: OGAWA Hirofumi
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds
21 Mar, 2006
9 commits
-
Make audit_init() failure path handle situations where the audit_panic()
action is not AUDIT_FAIL_PANIC (default is AUDIT_FAIL_PRINTK). Other uses
of audit_sock are not reached unless audit's netlink message handler is
properly registered. Bug noticed by Peter Staubach.Signed-off-by: Amy Griffis
Signed-off-by: Al Viro -
Hi,
This is a trivial patch that enables the possibility of using some auditing
functions within loadable kernel modules (ie. inside a Linux Security Module)._
Make the audit_log_start, audit_log_end, audit_format and audit_log
interfaces available to Loadable Kernel Modules, thus making possible
the usage of the audit framework inside LSMs, etc.Signed-off-by: >
Signed-off-by: Al Viro -
Semaphore to mutex conversion.
The conversion was generated via scripts, and the result was validated
automatically via a script as well.Signed-off-by: Ingo Molnar
Cc: David Woodhouse
Signed-off-by: Andrew Morton
Signed-off-by: Al Viro -
Updated patch to dynamically allocate audit rule fields in kernel's
internal representation. Added unlikely() calls for testing memory
allocation result.Amy Griffis wrote: [Wed Jan 11 2006, 02:02:31PM EST]
> Modify audit's kernel-userspace interface to allow the specification
> of string fields in audit rules.
>
> Signed-off-by: Amy GriffisSigned-off-by: Al Viro
(cherry picked from 5ffc4a863f92351b720fe3e9c5cd647accff9e03 commit) -
This fixes the per-user and per-message-type filtering when syscall
auditing isn't enabled.[AV: folded followup fix from the same author]
Signed-off-by: David Woodhouse
Signed-off-by: Al Viro -
This patch extends existing audit records with subject/object context
information. Audit records associated with filesystem inodes, ipc, and
tasks now contain SELinux label information in the field "subj" if the
item is performing the action, or in "obj" if the item is the receiver
of an action.These labels are collected via hooks in SELinux and appended to the
appropriate record in the audit code.This additional information is required for Common Criteria Labeled
Security Protection Profile (LSPP).[AV: fixed kmalloc flags use]
[folded leak fixes]
[folded cleanup from akpm (kfree(NULL)]
[folded audit_inode_context() leak fix]
[folded akpm's fix for audit_ipc_perm() definition in case of !CONFIG_AUDIT]Signed-off-by: Dustin Kirkland
Signed-off-by: David Woodhouse
Signed-off-by: Andrew Morton
Signed-off-by: Al Viro -
- Add a new, 5th filter called "exclude".
- And add a new field AUDIT_MSGTYPE.
- Define a new function audit_filter_exclude() that takes a message type
as input and examines all rules in the filter. It returns '1' if the
message is to be excluded, and '0' otherwise.
- Call the audit_filter_exclude() function near the top of
audit_log_start() just after asserting audit_initialized. If the
message type is not to be audited, return NULL very early, before
doing a lot of work.
[combined with followup fix for bug in original patch, Nov 4, same author]
[combined with later renaming AUDIT_FILTER_EXCLUDE->AUDIT_FILTER_TYPE
and audit_filter_exclude() -> audit_filter_type()]Signed-off-by: Dustin Kirkland
Signed-off-by: David Woodhouse
Signed-off-by: Al Viro -
The attached patch updates various items for the new user space
messages. Please apply.Signed-off-by: Steve Grubb
Signed-off-by: David Woodhouse -
- add kerneldoc for non-static functions;
- don't init static data to 0;
- limit lines to < 80 columns;
- fix long-format style;
- delete whitespace at end of some lines;(chrisw: resend and update to current audit-2.6 tree)
Signed-off-by: Randy Dunlap
Signed-off-by: Chris Wright
Signed-off-by: David Woodhouse
19 Jan, 2006
1 commit
-
EDAC requires a way to scrub memory if an ECC error is found and the chipset
does not do the work automatically. That means rewriting memory locations
atomically with respect to all CPUs _and_ bus masters. That means we can't
use atomic_add(foo, 0) as it gets optimised for non-SMPThis adds a function to include/asm-foo/atomic.h for the platforms currently
supported which implements a scrub of a mapped block.It also adjusts a few other files include order where atomic.h is included
before types.h as this now causes an error as atomic_scrub uses u32.Signed-off-by: Alan Cox
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds
09 Jan, 2006
1 commit
-
This patch contains the following cleanups:
- make needlessly global functions static
- every file should include the headers containing the prototypes for
it's global functionsSigned-off-by: Adrian Bunk
Acked-by: "Paul E. McKenney"
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds
13 Dec, 2005
1 commit
-
kauditd was causing suspends to fail because it refused to freeze. Adding
a try_to_freeze() to its sleep loop solves the issue.Signed-off-by: Pierre Ossman
Acked-by: Pavel Machek
Cc: David Woodhouse
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds
28 Oct, 2005
1 commit
-
Signed-off-by: Al Viro
Signed-off-by: Linus Torvalds
09 Oct, 2005
1 commit
-
- added typedef unsigned int __nocast gfp_t;
- replaced __nocast uses for gfp flags with gfp_t - it gives exactly
the same warnings as far as sparse is concerned, doesn't change
generated code (from gcc point of view we replaced unsigned int with
typedef) and documents what's going on far better.Signed-off-by: Al Viro
Signed-off-by: Linus Torvalds
14 Sep, 2005
1 commit
30 Aug, 2005
2 commits
-
Signed-off-by: Patrick McHardy
Signed-off-by: David S. Miller -
- Remove bogus code for compiling netlink as module
- Add module refcounting support for modules implementing a netlink
protocol
- Add support for autoloading modules that implement a netlink protocol
as soon as someone opens a socket for that protocolSigned-off-by: Harald Welte
Signed-off-by: David S. Miller
17 Aug, 2005
1 commit
-
The following patch against audit.81 prevents duplicate syscall rules in
a given filter list by walking the list on each rule add.I also removed the unused struct audit_entry in audit.c and made the
static inlines in auditsc.c consistent.Signed-off-by: Amy Griffis
Signed-off-by: David Woodhouse
19 Jul, 2005
1 commit
-
... by generating serial numbers only if an audit context is actually
_used_, rather than doing so at syscall entry even when the context
isn't necessarily marked auditable.Signed-off-by: David Woodhouse
15 Jul, 2005
1 commit
-
The tricks with atomic_t were bizarre. Just do it sensibly instead.
Signed-off-by: David Woodhouse
14 Jul, 2005
1 commit
-
Fix the sparse warning "implicit cast to nocast type"
Signed-off-by: Victor Fusco
Signed-off-by: Domen Puncer
Signed-off-by: Andrew Morton
Signed-off-by: David Woodhouse
02 Jul, 2005
1 commit
-
We force a rate-limit on auditable events by making them wait for space
on the backlog queue. However, if auditd really is AWOL then this could
potentially bring the entire system to a halt, depending on the audit
rules in effect.Firstly, make sure the wait time is honoured correctly -- it's the
maximum time the process should wait, rather than the time to wait
_each_ time round the loop. We were getting re-woken _each_ time a
packet was dequeued, and the timeout was being restarted each time.Secondly, reset the wait time after audit_panic() is called. In general
this will be reset to zero, to allow progress to be made. If the system
is configured to _actually_ panic on audit_panic() then that will
already have happened; otherwise we know that audit records are being
lost anyway.These two tunables can't be exposed via AUDIT_GET and AUDIT_SET because
those aren't particularly well-designed. It probably should have been
done by sysctls or sysfs anyway -- one for a later patch.Signed-off-by: David Woodhouse
25 Jun, 2005
1 commit
-
They aren't errors.
Signed-off-by: David Woodhouse
24 Jun, 2005
1 commit
-
Don't look up the task by its pid and then use the syscall filtering
helper. Just implement our own filter helper which operates solely on
the information in the netlink_skb_parms.Signed-off-by: David Woodhouse
22 Jun, 2005
3 commits
-
It's not used any more.
Signed-off-by: David Woodhouse
-
Add a gfp_mask to audit_log_start() and audit_log(), to reduce the
amount of GFP_ATOMIC allocation -- most of it doesn't need to be
GFP_ATOMIC. Also if the mask includes __GFP_WAIT, then wait up to
60 seconds for the auditd backlog to clear instead of immediately
abandoning the message.The timeout should probably be made configurable, but for now it'll
suffice that it only happens if auditd is actually running.Signed-off-by: David Woodhouse
-
Also exempt USER_AVC message from being discarded to preserve
existing behaviour for SE Linux.Signed-off-by: David Woodhouse
21 Jun, 2005
1 commit
-
If we have enough rules to fill the netlink buffer space, it'll
deadlock because auditctl isn't ever actually going to read from the
socket until we return, and we aren't going to return until it
reads... so we spawn a kernel thread to spew out the list and then
exit.Signed-off-by: David Woodhouse
20 Jun, 2005
2 commits
-
Signed-off-by: David Woodhouse
-
Turn the field from a bitmask to an enumeration and add a list to allow
filtering of messages generated by userspace. We also define a list for
file system watches in anticipation of that feature.Signed-off-by: David Woodhouse
24 May, 2005
1 commit
-
These changes make processing of audit logs easier. Based on a patch
from Steve GrubbSigned-off-by: David Woodhouse
22 May, 2005
1 commit
-
Move audit_serial() into audit.c and use it to generate serial numbers
on messages even when there is no audit context from syscall auditing.
This allows us to disambiguate audit records when more than one is
generated in the same millisecond.Based on a patch by Steve Grubb after he observed the problem.
Signed-off-by: David Woodhouse
21 May, 2005
2 commits
-
The attached patch changes all occurrences of loginuid to auid. It also
changes everything to %u that is an unsigned type.Signed-off-by: Steve Grubb
Signed-off-by: David Woodhouse -
The original AVC_USER message wasn't consolidated with the new range of
user messages. The attached patch fixes the kernel so the old messages
work again.Signed-off-by: Steve Grubb
Signed-off-by: David Woodhouse
19 May, 2005
2 commits
-
The limit on the number of outstanding audit messages was inadvertently
removed with the switch to queuing skbs directly for sending by a kernel
thread. Put it back again.Signed-off-by: David Woodhouse
-
netlink_unicast() will attempt to reallocate and will free messages if
the socket's rcvbuf limit is reached unless we give it an infinite
timeout. So do that, from a kernel thread which is dedicated to spewing
stuff up the netlink socket.Signed-off-by: David Woodhouse