[PATCH v29 22/28] Audit: Keep multiple LSM data in audit_names
From: Casey Schaufler <casey@schaufler-ca.com>
Date: 2021-09-24 18:19:21
Also in:
lkml, selinux
Subsystem:
audit subsystem, the rest · Maintainers:
Paul Moore, Eric Paris, Linus Torvalds
Replace the osid field in the audit_names structure with a lsmblob structure. This accomodates the use of an lsmblob in security_audit_rule_match() and security_inode_getsecid(). Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> --- kernel/audit.h | 2 +- kernel/auditsc.c | 21 +++++++-------------- 2 files changed, 8 insertions(+), 15 deletions(-)
diff --git a/kernel/audit.h b/kernel/audit.h
index d43a08eabd86..f3ff2bd31459 100644
--- a/kernel/audit.h
+++ b/kernel/audit.h@@ -81,7 +81,7 @@ struct audit_names { kuid_t uid; kgid_t gid; dev_t rdev; - u32 osid; + struct lsmblob lsmblob; struct audit_cap_data fcap; unsigned int fcap_ver; unsigned char type; /* record type */
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index e87f21cf9494..e960410cf4e4 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c@@ -698,17 +698,15 @@ static int audit_filter_rules(struct task_struct *tsk, * lsmblob, which happens later in * this patch set. */ - lsmblob_init(&blob, name->osid); result = security_audit_rule_match( - &blob, + &name->lsmblob, f->type, f->op, f->lsm_rules); } else if (ctx) { list_for_each_entry(n, &ctx->names_list, list) { - lsmblob_init(&blob, name->osid); if (security_audit_rule_match( - &blob, + &n->lsmblob, f->type, f->op, f->lsm_rules)) {
@@ -1412,13 +1410,12 @@ static void audit_log_name(struct audit_context *context, struct audit_names *n, from_kgid(&init_user_ns, n->gid), MAJOR(n->rdev), MINOR(n->rdev)); - if (n->osid != 0) { - struct lsmblob blob; + if (lsmblob_is_set(&n->lsmblob)) { struct lsmcontext lsmctx; - lsmblob_init(&blob, n->osid); - if (security_secid_to_secctx(&blob, &lsmctx, LSMBLOB_FIRST)) { - audit_log_format(ab, " osid=%u", n->osid); + if (security_secid_to_secctx(&n->lsmblob, &lsmctx, + LSMBLOB_FIRST)) { + audit_log_format(ab, " osid=?"); if (call_panic) *call_panic = 2; } else {
@@ -1972,17 +1969,13 @@ static void audit_copy_inode(struct audit_names *name, const struct dentry *dentry, struct inode *inode, unsigned int flags) { - struct lsmblob blob; - name->ino = inode->i_ino; name->dev = inode->i_sb->s_dev; name->mode = inode->i_mode; name->uid = inode->i_uid; name->gid = inode->i_gid; name->rdev = inode->i_rdev; - security_inode_getsecid(inode, &blob); - /* scaffolding until osid is updated */ - name->osid = blob.secid[0]; + security_inode_getsecid(inode, &name->lsmblob); if (flags & AUDIT_INODE_NOEVAL) { name->fcap_ver = -1; return;
--
2.31.1