From: Stephen Rothwell <sfr@canb.auug.org.au>
To: Eric Paris <eparis@redhat.com>
Cc: linux-next@vger.kernel.org, linux-kernel@vger.kernel.org,
Richard Guy Briggs <rgb@redhat.com>
Subject: linux-next: manual merge of the audit tree with Linus' tree
Date: Tue, 1 Apr 2014 15:07:21 +1100 [thread overview]
Message-ID: <20140401150721.1e9d4e6c36660d5411c10f37@canb.auug.org.au> (raw)
[-- Attachment #1: Type: text/plain, Size: 1705 bytes --]
Hi Eric,
Today's linux-next merge of the audit tree got a conflict in
kernel/audit.c between commit aa4af831bb4f ("AUDIT: Allow login in
non-init namespaces") from Linus' tree and commit 5a3cb3b6c3a0 ("audit:
allow user processes to log from another PID namespace") from the audit
tree.
I fixed it up (see below) and can carry the fix as necessary (no action
is required).
[Eric: that audit tree commit has no Signed-off-by from you even though
you committed it ... there are a few like that]
--
Cheers,
Stephen Rothwell sfr@canb.auug.org.au
diff --cc kernel/audit.c
index 95a20f3f52f1,ad77d1e80895..000000000000
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@@ -607,20 -607,9 +607,19 @@@ static int audit_netlink_ok(struct sk_b
{
int err = 0;
- /* Only support the initial namespaces for now. */
+ /* Only support initial user namespace for now. */
+ /*
+ * We return ECONNREFUSED because it tricks userspace into thinking
+ * that audit was not configured into the kernel. Lots of users
+ * configure their PAM stack (because that's what the distro does)
+ * to reject login if unable to send messages to audit. If we return
+ * ECONNREFUSED the PAM stack thinks the kernel does not have audit
+ * configured in and will let login proceed. If we return EPERM
+ * userspace will reject all logins. This should be removed when we
+ * support non init namespaces!!
+ */
- if ((current_user_ns() != &init_user_ns) ||
- (task_active_pid_ns(current) != &init_pid_ns))
+ if ((current_user_ns() != &init_user_ns))
- return -EPERM;
+ return -ECONNREFUSED;
switch (msg_type) {
case AUDIT_LIST:
[-- Attachment #2: Type: application/pgp-signature, Size: 836 bytes --]
next reply other threads:[~2014-04-01 4:07 UTC|newest]
Thread overview: 35+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-04-01 4:07 Stephen Rothwell [this message]
2014-04-01 12:54 ` linux-next: manual merge of the audit tree with Linus' tree Richard Guy Briggs
2014-04-01 13:11 ` Stephen Rothwell
-- strict thread matches above, loose matches on Subject: below --
2019-04-08 1:31 Stephen Rothwell
2019-04-08 17:15 ` Dmitry V. Levin
2019-04-08 20:30 ` Paul Moore
2017-03-24 2:18 Stephen Rothwell
2017-03-24 6:33 ` Richard Guy Briggs
2017-03-24 16:39 ` Paul Moore
2017-01-19 2:51 Stephen Rothwell
2017-01-19 4:16 ` Richard Guy Briggs
2016-11-22 5:29 Stephen Rothwell
2016-11-22 10:35 ` Richard Guy Briggs
2016-11-22 21:25 ` Paul Moore
2016-01-19 1:02 Stephen Rothwell
2016-01-19 2:48 ` Paul Moore
2015-11-19 1:06 Stephen Rothwell
2015-11-19 15:53 ` Paul Moore
2015-11-19 18:30 ` Richard Guy Briggs
2015-11-19 20:16 ` Stephen Rothwell
2015-10-06 2:55 Stephen Rothwell
2015-10-06 17:21 ` Paul Moore
2015-08-07 4:15 Stephen Rothwell
2015-08-07 6:33 ` Richard Guy Briggs
2015-06-01 6:30 Stephen Rothwell
2015-06-01 15:59 ` Richard Guy Briggs
2015-01-20 4:04 Stephen Rothwell
2015-01-20 4:04 Stephen Rothwell
2015-01-20 15:45 ` Paul Moore
2015-01-20 4:03 Stephen Rothwell
2014-04-22 3:58 Stephen Rothwell
2014-04-16 4:02 Stephen Rothwell
2014-04-16 12:08 ` Eric Paris
2014-01-15 4:48 Stephen Rothwell
2013-11-06 6:19 Stephen Rothwell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140401150721.1e9d4e6c36660d5411c10f37@canb.auug.org.au \
--to=sfr@canb.auug.org.au \
--cc=eparis@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-next@vger.kernel.org \
--cc=rgb@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).