From mboxrd@z Thu Jan 1 00:00:00 1970 From: Amy Griffis Subject: [PATCH 3/4] complete message queue auditing Date: Mon, 19 Mar 2007 16:43:46 -0400 Message-ID: <20070319204346.GD13931@fc.hp.com> References: <20070319204234.GA13931@fc.hp.com> <20070319204305.GB13931@fc.hp.com> <20070319204324.GC13931@fc.hp.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Return-path: Received: from mx2.redhat.com (mx2.redhat.com [10.255.15.25]) by int-mx2.corp.redhat.com (8.13.1/8.13.1) with ESMTP id l2JKqRgR028010 for ; Mon, 19 Mar 2007 16:52:28 -0400 Received: from atlrel6.hp.com (atlrel6.hp.com [156.153.255.205]) by mx2.redhat.com (8.13.1/8.13.1) with ESMTP id l2JKqQJd025617 for ; Mon, 19 Mar 2007 16:52:26 -0400 Received: from smtp2.fc.hp.com (smtp2.fc.hp.com [15.11.136.114]) by atlrel6.hp.com (Postfix) with ESMTP id 8158F34D70 for ; Mon, 19 Mar 2007 16:52:21 -0400 (EDT) Received: from ldl.fc.hp.com (ldl.fc.hp.com [15.11.146.30]) by smtp2.fc.hp.com (Postfix) with ESMTP id 597F1177A0E for ; Mon, 19 Mar 2007 20:52:21 +0000 (UTC) Content-Disposition: inline In-Reply-To: <20070319204234.GA13931@fc.hp.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com Handle the edge cases for POSIX message queue auditing. Collect inode info when opening an existing mq, and for send/receive operations. Remove audit_inode_update() as it has really evolved into the equivalent of audit_inode(). Signed-off-by: Amy Griffis --- fs/namei.c | 2 +- include/linux/audit.h | 7 ------- ipc/mqueue.c | 4 ++++ kernel/auditsc.c | 27 --------------------------- 4 files changed, 5 insertions(+), 35 deletions(-) diff --git a/fs/namei.c b/fs/namei.c index ee60cc4..33af652 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -1701,7 +1701,7 @@ do_last: * It already exists. */ mutex_unlock(&dir->d_inode->i_mutex); - audit_inode_update(path.dentry->d_inode); + audit_inode(pathname, path.dentry->d_inode); error = -EEXIST; if (flag & O_EXCL) diff --git a/include/linux/audit.h b/include/linux/audit.h index 773e30d..ab289bd 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -351,7 +351,6 @@ extern void audit_putname(const char *name); extern void __audit_inode(const char *name, const struct inode *inode); extern void __audit_inode_child(const char *dname, const struct inode *inode, const struct inode *parent); -extern void __audit_inode_update(const struct inode *inode); static inline int audit_dummy_context(void) { void *p = current->audit_context; @@ -372,10 +371,6 @@ static inline void audit_inode_child(const char *dname, if (unlikely(!audit_dummy_context())) __audit_inode_child(dname, inode, parent); } -static inline void audit_inode_update(const struct inode *inode) { - if (unlikely(!audit_dummy_context())) - __audit_inode_update(inode); -} /* Private API (for audit.c only) */ extern unsigned int audit_serial(void); @@ -457,10 +452,8 @@ extern int audit_n_rules; #define audit_putname(n) do { ; } while (0) #define __audit_inode(n,i) do { ; } while (0) #define __audit_inode_child(d,i,p) do { ; } while (0) -#define __audit_inode_update(i) do { ; } while (0) #define audit_inode(n,i) do { ; } while (0) #define audit_inode_child(d,i,p) do { ; } while (0) -#define audit_inode_update(i) do { ; } while (0) #define auditsc_get_stamp(c,t,s) do { BUG(); } while (0) #define audit_get_loginuid(c) ({ -1; }) #define audit_log_task_context(b) do { ; } while (0) diff --git a/ipc/mqueue.c b/ipc/mqueue.c index 554ac36..db8f11d 100644 --- a/ipc/mqueue.c +++ b/ipc/mqueue.c @@ -682,6 +682,7 @@ asmlinkage long sys_mq_open(const char __user *u_name, int oflag, mode_t mode, if (oflag & O_CREAT) { if (dentry->d_inode) { /* entry already exists */ + audit_inode(name, dentry->d_inode); error = -EEXIST; if (oflag & O_EXCL) goto out; @@ -694,6 +695,7 @@ asmlinkage long sys_mq_open(const char __user *u_name, int oflag, mode_t mode, error = -ENOENT; if (!dentry->d_inode) goto out; + audit_inode(name, dentry->d_inode); filp = do_open(dentry, oflag); } @@ -841,6 +843,7 @@ asmlinkage long sys_mq_timedsend(mqd_t mqdes, const char __user *u_msg_ptr, if (unlikely(filp->f_op != &mqueue_file_operations)) goto out_fput; info = MQUEUE_I(inode); + audit_inode(NULL, inode); if (unlikely(!(filp->f_mode & FMODE_WRITE))) goto out_fput; @@ -924,6 +927,7 @@ asmlinkage ssize_t sys_mq_timedreceive(mqd_t mqdes, char __user *u_msg_ptr, if (unlikely(filp->f_op != &mqueue_file_operations)) goto out_fput; info = MQUEUE_I(inode); + audit_inode(NULL, inode); if (unlikely(!(filp->f_mode & FMODE_READ))) goto out_fput; diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 863479c..e241541 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1413,33 +1413,6 @@ update_context: } /** - * audit_inode_update - update inode info for last collected name - * @inode: inode being audited - * - * When open() is called on an existing object with the O_CREAT flag, the inode - * data audit initially collects is incorrect. This additional hook ensures - * audit has the inode data for the actual object to be opened. - */ -void __audit_inode_update(const struct inode *inode) -{ - struct audit_context *context = current->audit_context; - int idx; - - if (!context->in_syscall || !inode) - return; - - if (context->name_count == 0) { - context->name_count++; -#if AUDIT_DEBUG - context->ino_count++; -#endif - } - idx = context->name_count - 1; - - audit_copy_inode(&context->names[idx], inode); -} - -/** * auditsc_get_stamp - get local copies of audit_context values * @ctx: audit_context for the task * @t: timespec to store time recorded in the audit_context -- 1.4.4.4