From: Richard Guy Briggs <rgb@redhat.com>
To: Linux-Audit Mailing List <linux-audit@redhat.com>,
LKML <linux-kernel@vger.kernel.org>
Cc: eparis@parisplace.org, Paul Moore <paul@paul-moore.com>,
Steve Grubb <sgrubb@redhat.com>,
Alexander Viro <aviro@redhat.com>,
Richard Guy Briggs <rgb@redhat.com>
Subject: [RFC PATCH ghak59 V1 5/6] audit: move EOE record after kill_trees for exit/free
Date: Thu, 14 Jun 2018 16:21:15 -0400 [thread overview]
Message-ID: <65299efddc04e19e6ad4b06fbde0bb3db2643cb5.1529003588.git.rgb@redhat.com> (raw)
In-Reply-To: <cover.1529003588.git.rgb@redhat.com>
In-Reply-To: <cover.1529003588.git.rgb@redhat.com>
The EOE record was being issued prior to the pruning of the killed_tree
list.
Move the EOE record creation out of audit_log_exit() and into its
callers __audit_free() and __audit_syscall_exit() so that
audit_kill_trees() can be called prior to the EOE record creation and
any purged trees CONFIG_CHANGE records included in the syscall record
event.
See: https://github.com/linux-audit/audit-kernel/issues/50
See: https://github.com/linux-audit/audit-kernel/issues/59
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
---
kernel/auditsc.c | 24 +++++++++++++++++-------
1 file changed, 17 insertions(+), 7 deletions(-)
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 2590c9e..d56aead 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1460,10 +1460,6 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
audit_log_proctitle(tsk, context);
- /* Send end of event record to help user space know we are finished */
- ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE);
- if (ab)
- audit_log_end(ab);
if (call_panic)
audit_panic("error converting sid to string");
}
@@ -1491,6 +1487,14 @@ void __audit_free(struct task_struct *tsk)
audit_log_exit(context, tsk);
if (!list_empty(&context->killed_trees))
audit_kill_trees(context);
+ if (context->in_syscall && context->current_state == AUDIT_RECORD_CONTEXT) {
+ struct audit_buffer *ab;
+
+ /* Send end of event record to help user space know we are finished */
+ ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE);
+ if (ab)
+ audit_log_end(ab);
+ }
audit_free_context(context);
}
@@ -1572,13 +1576,19 @@ void __audit_syscall_exit(int success, long return_code)
if (context->in_syscall && context->current_state == AUDIT_RECORD_CONTEXT)
audit_log_exit(context, current);
+ if (!list_empty(&context->killed_trees))
+ audit_kill_trees(context);
+ if (context->in_syscall && context->current_state == AUDIT_RECORD_CONTEXT) {
+ struct audit_buffer *ab;
+ /* Send end of event record to help user space know we are finished */
+ ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE);
+ if (ab)
+ audit_log_end(ab);
+ }
context->in_syscall = 0;
context->prio = context->state == AUDIT_RECORD_CONTEXT ? ~0ULL : 0;
- if (!list_empty(&context->killed_trees))
- audit_kill_trees(context);
-
audit_free_names(context);
unroll_tree_refs(context, NULL, 0);
audit_free_aux(context);
--
1.8.3.1
next prev parent reply other threads:[~2018-06-14 20:23 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-06-14 20:21 [RFC PATCH ghak59 V1 0/6] audit: config_change normalizations and event record gathering Richard Guy Briggs
2018-06-14 20:21 ` [RFC PATCH ghak59 V1 1/6] audit: give a clue what CONFIG_CHANGE op was involved Richard Guy Briggs
2018-06-28 19:41 ` Paul Moore
2018-07-13 0:41 ` Richard Guy Briggs
2018-07-18 21:45 ` Paul Moore
2018-07-19 16:08 ` Richard Guy Briggs
2018-07-19 22:47 ` Paul Moore
2018-07-20 13:27 ` Richard Guy Briggs
2018-07-20 14:21 ` Paul Moore
2018-06-14 20:21 ` [RFC PATCH ghak59 V1 2/6] audit: add syscall information to CONFIG_CHANGE records Richard Guy Briggs
2018-06-28 21:47 ` Paul Moore
2018-06-28 22:10 ` Paul Moore
2018-06-14 20:21 ` [RFC PATCH ghak59 V1 3/6] audit: exclude user records from syscall context Richard Guy Briggs
2018-06-28 22:11 ` Paul Moore
2018-07-12 21:46 ` Richard Guy Briggs
2018-07-23 16:40 ` Richard Guy Briggs
2018-07-23 21:00 ` Paul Moore
2018-07-24 13:02 ` Richard Guy Briggs
2018-07-24 20:17 ` Paul Moore
2018-06-14 20:21 ` [RFC PATCH ghak59 V1 4/6] audit: hand taken context to audit_kill_trees for syscall logging Richard Guy Briggs
2018-06-28 22:23 ` Paul Moore
2018-07-13 21:44 ` Richard Guy Briggs
2018-06-14 20:21 ` Richard Guy Briggs [this message]
2018-06-28 22:25 ` [RFC PATCH ghak59 V1 5/6] audit: move EOE record after kill_trees for exit/free Paul Moore
2018-06-14 20:21 ` [RFC PATCH ghak59 V1 6/6] audit: extend config_change mark/watch/tree rule changes Richard Guy Briggs
2018-06-28 22:28 ` Paul Moore
2018-06-29 12:31 ` Steve Grubb
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=65299efddc04e19e6ad4b06fbde0bb3db2643cb5.1529003588.git.rgb@redhat.com \
--to=rgb@redhat.com \
--cc=aviro@redhat.com \
--cc=eparis@parisplace.org \
--cc=linux-audit@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=sgrubb@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).