lsm-stacking: fix broken lsm audit

Hello,
These patches address the problem of not processing LSM audit rules.
Problem was introduced in lsm stacking series.
These patches are for cschaufler/lsm-stacking repository branch stack-5.10-rc4-v23 
Some UBUNTU distributions have also this problem.

Kind regards,
Dmitry Mastykin

Wrong address was passed to audit_rule_match hooks instead of
rule's address.

Signed-off-by: Dmitry Mastykin <redacted>
---
 security/security.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/security.c b/security/security.c
index e33c8ccc06a0..fd14064e9106 100644
--- a/security/security.c
+++ b/security/security.c

@@ -2934,7 +2934,7 @@ int security_audit_rule_match(struct lsmblob *blob, u32 field, u32 op,
 			continue;
 		rc = hp->hook.audit_rule_match(blob->secid[hp->lsmid->slot],
 					       field, op,
-					       &lsmrule[hp->lsmid->slot]);
+					       lsmrule[hp->lsmid->slot]);
 		if (rc)
 			return rc;
 	}

-- 
2.11.0

File audit didn't work. Uninitialized local structure was passed
to security_audit_rule_match instead of audit_names oblob.

Signed-off-by: Dmitry Mastykin <redacted>
---
 kernel/auditsc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index c314533dd220..3b1afdb5cda4 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c

@@ -689,14 +689,14 @@ static int audit_filter_rules(struct task_struct *tsk,
 				/* Find files that match */
 				if (name) {
 					result = security_audit_rule_match(
-								&blob,
+								&name->oblob,
 								f->type,
 								f->op,
 								f->lsm_rules);
 				} else if (ctx) {
 					list_for_each_entry(n, &ctx->names_list, list) {
 						if (security_audit_rule_match(
-								&blob,
+								&n->oblob,
 								f->type,
 								f->op,
 								f->lsm_rules)) {

-- 
2.11.0

Just remove a typo: the same if() was duplicated.

Signed-off-by: Dmitry Mastykin <redacted>
---
 security/security.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/security/security.c b/security/security.c
index fd14064e9106..1ab6f56a93b6 100644
--- a/security/security.c
+++ b/security/security.c

@@ -2930,8 +2930,6 @@ int security_audit_rule_match(struct lsmblob *blob, u32 field, u32 op,
 			continue;
 		if (lsmrule[hp->lsmid->slot] == NULL)
 			continue;
-		if (lsmrule[hp->lsmid->slot] == NULL)
-			continue;
 		rc = hp->hook.audit_rule_match(blob->secid[hp->lsmid->slot],
 					       field, op,
 					       lsmrule[hp->lsmid->slot]);

-- 
2.11.0

On 8/6/2021 12:02 AM, Dmitry Mastykin wrote:

Hello,
These patches address the problem of not processing LSM audit rules.
Problem was introduced in lsm stacking series.

Thank you. I will incorporate these changes in v29.

These patches are for cschaufler/lsm-stacking repository branch stack-5.10-rc4-v23 
Some UBUNTU distributions have also this problem.

Kind regards,
Dmitry Mastykin

Hello Casey,

 > On 8/6/21 11:01 PM, Casey Schaufler wrote:

quoted

On 8/6/2021 12:02 AM, Dmitry Mastykin wrote:
Hello,
These patches address the problem of not processing LSM audit rules.
Problem was introduced in lsm stacking series.

Thank you. I will incorporate these changes in v29.

thank you for the v29.
I think the following fix is still required:

---
  security/security.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/security.c b/security/security.c
index e33c8ccc06a0..fd14064e9106 100644
--- a/security/security.c
+++ b/security/security.c

@@ -2934,7 +2934,7 @@ int security_audit_rule_match(struct lsmblob 

*blob, u32 field, u32 op,
  			continue;
  		rc = hp->hook.audit_rule_match(blob->secid[hp->lsmid->slot],
  					       field, op,
-					       &lsmrule[hp->lsmid->slot]);
+					       lsmrule[hp->lsmid->slot]);
  		if (rc)
  			return rc;
  	}


Kind regards,
Dmitry Mastykin

On 10/25/2021 1:17 AM, Dmitry Mastykin wrote:

The code has the correct indirection as written. With your change
it dies horribly. The interface is not very attractive.

if (rc)
             return rc;
     }


Kind regards,
Dmitry Mastykin