[PATCH v30 22/28] Audit: Keep multiple LSM data in audit_names
flat view
STALE1765d
From: Casey Schaufler <casey@schaufler-ca.com>
Date: 2021-11-24 02:08:12
Also in:
lkml, selinux
Subsystem:
audit subsystem, the rest · Maintainers:
Paul Moore, Eric Paris, Linus Torvalds
Revision v30 of 41 in this series.
Revisions (41)
- v1 [diff vs current]
- v1 [diff vs current]
- v1 [diff vs current]
- v1 [diff vs current]
- v1 [diff vs current]
- v2 [diff vs current]
- v3 [diff vs current]
- v3 [diff vs current]
- v4 [diff vs current]
- v5 [diff vs current]
- v5 [diff vs current]
- v7 [diff vs current]
- v8 [diff vs current]
- v10 [diff vs current]
- v10 [diff vs current]
- v11 [diff vs current]
- v11 [diff vs current]
- v12 [diff vs current]
- v12 [diff vs current]
- v13 [diff vs current]
- v14 [diff vs current]
- v15 [diff vs current]
- v16 [diff vs current]
- v22 [diff vs current]
- v22 [diff vs current]
- v24 [diff vs current]
- v25 [diff vs current]
- v26 [diff vs current]
- v27 [diff vs current]
- v28 [diff vs current]
- v29 [diff vs current]
- v30 current
- v31 [diff vs current]
- v32 [diff vs current]
- v33 [diff vs current]
- v34 [diff vs current]
- v34 [diff vs current]
- v35 [diff vs current]
- v36 [diff vs current]
- v37 [diff vs current]
- v38 [diff vs current]
Replace the osid field in the audit_names structure with a lsmblob structure. This accomodates the use of an lsmblob in security_audit_rule_match() and security_inode_getsecid(). Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> --- kernel/audit.h | 2 +- kernel/auditsc.c | 22 ++++++++-------------- 2 files changed, 9 insertions(+), 15 deletions(-)
diff --git a/kernel/audit.h b/kernel/audit.h
index 527d4c4acb12..a2fca1134519 100644
--- a/kernel/audit.h
+++ b/kernel/audit.h@@ -82,7 +82,7 @@ struct audit_names { kuid_t uid; kgid_t gid; dev_t rdev; - u32 osid; + struct lsmblob lsmblob; struct audit_cap_data fcap; unsigned int fcap_ver; unsigned char type; /* record type */
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index ded4e8740fa2..0d0351dc0c52 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c@@ -691,17 +691,16 @@ static int audit_filter_rules(struct task_struct *tsk, * lsmblob, which happens later in * this patch set. */ - lsmblob_init(&blob, name->osid); result = security_audit_rule_match( - &blob, + &name->lsmblob, f->type, f->op, &f->lsm_rules); } else if (ctx) { list_for_each_entry(n, &ctx->names_list, list) { - lsmblob_init(&blob, n->osid); if (security_audit_rule_match( - &blob, f->type, f->op, + &n->lsmblob, + f->type, f->op, &f->lsm_rules)) { ++result; break;
@@ -1528,13 +1527,12 @@ static void audit_log_name(struct audit_context *context, struct audit_names *n, from_kgid(&init_user_ns, n->gid), MAJOR(n->rdev), MINOR(n->rdev)); - if (n->osid != 0) { - struct lsmblob blob; + if (lsmblob_is_set(&n->lsmblob)) { struct lsmcontext lsmctx; - lsmblob_init(&blob, n->osid); - if (security_secid_to_secctx(&blob, &lsmctx, LSMBLOB_FIRST)) { - audit_log_format(ab, " osid=%u", n->osid); + if (security_secid_to_secctx(&n->lsmblob, &lsmctx, + LSMBLOB_FIRST)) { + audit_log_format(ab, " osid=?"); if (call_panic) *call_panic = 2; } else {
@@ -2236,17 +2234,13 @@ static void audit_copy_inode(struct audit_names *name, const struct dentry *dentry, struct inode *inode, unsigned int flags) { - struct lsmblob blob; - name->ino = inode->i_ino; name->dev = inode->i_sb->s_dev; name->mode = inode->i_mode; name->uid = inode->i_uid; name->gid = inode->i_gid; name->rdev = inode->i_rdev; - security_inode_getsecid(inode, &blob); - /* scaffolding until osid is updated */ - name->osid = blob.secid[0]; + security_inode_getsecid(inode, &name->lsmblob); if (flags & AUDIT_INODE_NOEVAL) { name->fcap_ver = -1; return;
--
2.31.1