--- v24
+++ v33
@@ -1,63 +1,142 @@
-With the inclusion of the interface LSM process attribute
-mechanism AppArmor no longer needs to be treated as an
-"exclusive" security module. Remove the flag that indicates
-it is exclusive. Remove the stub getpeersec_dgram AppArmor
-hook as it has no effect in the single LSM case and
-interferes in the multiple LSM case.
+Replace the single skb pointer in an audit_buffer with
+a list of skb pointers. Add the audit_stamp information
+to the audit_buffer as there's no guarantee that there
+will be an audit_context containing the stamp associated
+with the event. At audit_log_end() time create auxiliary
+records (none are currently defined) as have been added
+to the list.
-Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
-Acked-by: John Johansen <john.johansen@canonical.com>
-Reviewed-by: Kees Cook <keescook@chromium.org>
+Suggested-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
---
- security/apparmor/lsm.c | 20 +-------------------
- 1 file changed, 1 insertion(+), 19 deletions(-)
+ kernel/audit.c | 53 +++++++++++++++++++++++++++++++++-----------------
+ 1 file changed, 35 insertions(+), 18 deletions(-)
-diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
-index 4af0518b55d6..e3c682011d63 100644
---- a/security/apparmor/lsm.c
-+++ b/security/apparmor/lsm.c
-@@ -1129,22 +1129,6 @@ static int apparmor_socket_getpeersec_stream(struct socket *sock,
- return error;
+diff --git a/kernel/audit.c b/kernel/audit.c
+index f012c3786264..4713e66a12af 100644
+--- a/kernel/audit.c
++++ b/kernel/audit.c
+@@ -197,8 +197,10 @@ static struct audit_ctl_mutex {
+ * to place it on a transmit queue. Multiple audit_buffers can be in
+ * use simultaneously. */
+ struct audit_buffer {
+- struct sk_buff *skb; /* formatted skb ready to send */
++ struct sk_buff *skb; /* the skb for audit_log functions */
++ struct sk_buff_head skb_list; /* formatted skbs, ready to send */
+ struct audit_context *ctx; /* NULL or associated context */
++ struct audit_stamp stamp; /* audit stamp for these records */
+ gfp_t gfp_mask;
+ };
+
+@@ -1744,7 +1746,6 @@ static void audit_buffer_free(struct audit_buffer *ab)
+ if (!ab)
+ return;
+
+- kfree_skb(ab->skb);
+ kmem_cache_free(audit_buffer_cache, ab);
}
--/**
-- * apparmor_socket_getpeersec_dgram - get security label of packet
-- * @sock: the peer socket
-- * @skb: packet data
-- * @secid: pointer to where to put the secid of the packet
-- *
-- * Sets the netlabel socket state on sk from parent
-- */
--static int apparmor_socket_getpeersec_dgram(struct socket *sock,
-- struct sk_buff *skb, u32 *secid)
+@@ -1760,11 +1761,15 @@ static struct audit_buffer *audit_buffer_alloc(struct audit_context *ctx,
+ ab->skb = nlmsg_new(AUDIT_BUFSIZ, gfp_mask);
+ if (!ab->skb)
+ goto err;
+- if (!nlmsg_put(ab->skb, 0, 0, type, 0, 0))
++ if (!nlmsg_put(ab->skb, 0, 0, type, 0, 0)) {
++ kfree_skb(ab->skb);
+ goto err;
++ }
+
+ ab->ctx = ctx;
+ ab->gfp_mask = gfp_mask;
++ skb_queue_head_init(&ab->skb_list);
++ skb_queue_tail(&ab->skb_list, ab->skb);
+
+ return ab;
+
+@@ -1825,7 +1830,6 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
+ int type)
+ {
+ struct audit_buffer *ab;
+- struct audit_stamp stamp;
+
+ if (audit_initialized != AUDIT_INITIALIZED)
+ return NULL;
+@@ -1880,14 +1884,14 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
+ return NULL;
+ }
+
+- audit_get_stamp(ab->ctx, &stamp);
++ audit_get_stamp(ab->ctx, &ab->stamp);
+ /* cancel dummy context to enable supporting records */
+ if (ctx)
+ ctx->dummy = 0;
+ audit_log_format(ab, "audit(%llu.%03lu:%u): ",
+- (unsigned long long)stamp.ctime.tv_sec,
+- stamp.ctime.tv_nsec/1000000,
+- stamp.serial);
++ (unsigned long long)ab->stamp.ctime.tv_sec,
++ ab->stamp.ctime.tv_nsec/1000000,
++ ab->stamp.serial);
+
+ return ab;
+ }
+@@ -2378,26 +2382,19 @@ int audit_signal_info(int sig, struct task_struct *t)
+ }
+
+ /**
+- * audit_log_end - end one audit record
+- * @ab: the audit_buffer
++ * __audit_log_end - end one audit record
++ * @skb: the buffer to send
+ *
+ * We can not do a netlink send inside an irq context because it blocks (last
+ * arg, flags, is not set to MSG_DONTWAIT), so the audit buffer is placed on a
+ * queue and a kthread is scheduled to remove them from the queue outside the
+ * irq context. May be called in any context.
+ */
+-void audit_log_end(struct audit_buffer *ab)
++static void __audit_log_end(struct sk_buff *skb)
+ {
+- struct sk_buff *skb;
+ struct nlmsghdr *nlh;
+
+- if (!ab)
+- return;
-
--{
-- /* TODO: requires secid support */
-- return -ENOPROTOOPT;
--}
+ if (audit_rate_check()) {
+- skb = ab->skb;
+- ab->skb = NULL;
-
- /**
- * apparmor_sock_graft - Initialize newly created socket
- * @sk: child sock
-@@ -1248,8 +1232,6 @@ static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = {
- #endif
- LSM_HOOK_INIT(socket_getpeersec_stream,
- apparmor_socket_getpeersec_stream),
-- LSM_HOOK_INIT(socket_getpeersec_dgram,
-- apparmor_socket_getpeersec_dgram),
- LSM_HOOK_INIT(sock_graft, apparmor_sock_graft),
- #ifdef CONFIG_NETWORK_SECMARK
- LSM_HOOK_INIT(inet_conn_request, apparmor_inet_conn_request),
-@@ -1918,7 +1900,7 @@ static int __init apparmor_init(void)
+ /* setup the netlink header, see the comments in
+ * kauditd_send_multicast_skb() for length quirks */
+ nlh = nlmsg_hdr(skb);
+@@ -2408,6 +2405,26 @@ void audit_log_end(struct audit_buffer *ab)
+ wake_up_interruptible(&kauditd_wait);
+ } else
+ audit_log_lost("rate limit exceeded");
++}
++
++/**
++ * audit_log_end - end one audit record
++ * @ab: the audit_buffer
++ *
++ * We can not do a netlink send inside an irq context because it blocks (last
++ * arg, flags, is not set to MSG_DONTWAIT), so the audit buffer is placed on a
++ * queue and a kthread is scheduled to remove them from the queue outside the
++ * irq context. May be called in any context.
++ */
++void audit_log_end(struct audit_buffer *ab)
++{
++ struct sk_buff *skb;
++
++ if (!ab)
++ return;
++
++ while ((skb = skb_dequeue(&ab->skb_list)))
++ __audit_log_end(skb);
- DEFINE_LSM(apparmor) = {
- .name = "apparmor",
-- .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
-+ .flags = LSM_FLAG_LEGACY_MAJOR,
- .enabled = &apparmor_enabled,
- .blobs = &apparmor_blob_sizes,
- .init = apparmor_init,
+ audit_buffer_free(ab);
+ }
--
-2.25.4
+2.31.1