From: Paul Moore <paul@paul-moore.com>
To: rgb@redhat.com
Cc: linux-audit@redhat.com, linux-kernel@vger.kernel.org,
Eric Paris <eparis@parisplace.org>,
sgrubb@redhat.com, viro@zeniv.linux.org.uk
Subject: Re: [PATCH ghak59 V2 5/6] audit: kill trees before logging syscall exit for exit/free
Date: Mon, 19 Nov 2018 11:32:27 -0500 [thread overview]
Message-ID: <CAHC9VhSm0c-DUn_bJsv6NrZ+_NwUVzRQbNiC7rLS1Hu=7nALwg@mail.gmail.com> (raw)
In-Reply-To: <01b59195f8ff3c2ec32a2251200f588bd537dff1.1532709911.git.rgb@redhat.com>
On Fri, Jul 27, 2018 at 3:51 PM Richard Guy Briggs <rgb@redhat.com> wrote:
> The EOE record was being issued prior to the pruning of the killed_tree
> list.
>
> Move the kill_trees call before the audit_log_exit call in
> __audit_free() and __audit_syscall_exit() so that the user library
> doesn't leave out any appended pruned trees CONFIG_CHANGE records due to
> the EOE flagging the end of the event.
>
> See: https://github.com/linux-audit/audit-kernel/issues/50
> See: https://github.com/linux-audit/audit-kernel/issues/59
> Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
> ---
> kernel/auditsc.c | 9 ++++-----
> 1 file changed, 4 insertions(+), 5 deletions(-)
This patch and patch 4/6 should be squashed together.
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index 986c5ce..55fd2a3 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -1482,6 +1482,8 @@ void __audit_free(struct task_struct *tsk)
> if (!context)
> return;
>
> + if (!list_empty(&context->killed_trees))
> + audit_kill_trees(context);
> /* Check for system calls that do not go through the exit
> * function (e.g., exit_group), then free context block.
> * We use GFP_ATOMIC here because we might be doing this
> @@ -1489,8 +1491,6 @@ void __audit_free(struct task_struct *tsk)
> /* that can happen only if we are called from do_exit() */
> if (context->in_syscall && context->current_state == AUDIT_RECORD_CONTEXT)
> audit_log_exit(context, tsk);
> - if (!list_empty(&context->killed_trees))
> - audit_kill_trees(context);
>
> audit_free_context(context);
> }
> @@ -1570,15 +1570,14 @@ void __audit_syscall_exit(int success, long return_code)
> if (!context)
> return;
>
> + if (!list_empty(&context->killed_trees))
> + audit_kill_trees(context);
> if (context->in_syscall && context->current_state == AUDIT_RECORD_CONTEXT)
> audit_log_exit(context, current);
>
> context->in_syscall = 0;
> context->prio = context->state == AUDIT_RECORD_CONTEXT ? ~0ULL : 0;
>
> - if (!list_empty(&context->killed_trees))
> - audit_kill_trees(context);
> -
> audit_free_names(context);
> unroll_tree_refs(context, NULL, 0);
> audit_free_aux(context);
> --
> 1.8.3.1
>
--
paul moore
www.paul-moore.com
next prev parent reply other threads:[~2018-11-19 16:32 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-27 19:48 [PATCH ghak59 V2 0/6] audit: config_change normalizations and event record gathering Richard Guy Briggs
2018-07-27 19:48 ` [PATCH ghak59 V2 1/6] audit: give a clue what CONFIG_CHANGE op was involved Richard Guy Briggs
2018-11-19 16:32 ` Paul Moore
2018-07-27 19:48 ` [PATCH ghak59 V2 2/6] audit: add syscall information to CONFIG_CHANGE records Richard Guy Briggs
2018-11-19 16:32 ` Paul Moore
2018-07-27 19:48 ` [PATCH ghak59 V2 3/6] audit: exclude user records from syscall context Richard Guy Briggs
2018-11-19 16:32 ` Paul Moore
2018-07-27 19:48 ` [PATCH ghak59 V2 4/6] audit: hand taken context to audit_kill_trees for syscall logging Richard Guy Briggs
2018-11-19 16:32 ` Paul Moore
2018-07-27 19:48 ` [PATCH ghak59 V2 5/6] audit: kill trees before logging syscall exit for exit/free Richard Guy Briggs
2018-11-19 16:32 ` Paul Moore [this message]
2018-07-27 19:48 ` [PATCH ghak59 V2 6/6] audit: extend config_change mark/watch/tree rule changes Richard Guy Briggs
2018-11-19 16:32 ` Paul Moore
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAHC9VhSm0c-DUn_bJsv6NrZ+_NwUVzRQbNiC7rLS1Hu=7nALwg@mail.gmail.com' \
--to=paul@paul-moore.com \
--cc=eparis@parisplace.org \
--cc=linux-audit@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=rgb@redhat.com \
--cc=sgrubb@redhat.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).