--- v32
+++ v1
@@ -1,159 +1,164 @@
-Create a new audit record AUDIT_MAC_TASK_CONTEXTS.
-An example of the MAC_TASK_CONTEXTS (1420) record is:
-
- type=MAC_TASK_CONTEXTS[1420]
- msg=audit(1600880931.832:113)
- subj_apparmor=unconfined
- subj_smack=_
-
-When an audit event includes a AUDIT_MAC_TASK_CONTEXTS record
-the "subj=" field in other records in the event will be "subj=?".
-An AUDIT_MAC_TASK_CONTEXTS record is supplied when the system has
-multiple security modules that may make access decisions based
-on a subject security context.
+Convert osid to be an lsm_export structure
+instead of a u32 secid. Clean out the associated
+scaffolding. Change the name to olsm to be
+descriptive.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
---
- include/linux/security.h | 9 ++++++
- include/uapi/linux/audit.h | 1 +
- kernel/audit.c | 58 ++++++++++++++++++++++++++++++++------
- 3 files changed, 60 insertions(+), 8 deletions(-)
+ kernel/audit.c | 4 +---
+ kernel/audit.h | 4 ++--
+ kernel/auditsc.c | 36 ++++++++++++------------------------
+ 3 files changed, 15 insertions(+), 29 deletions(-)
-diff --git a/include/linux/security.h b/include/linux/security.h
-index 39e113574ba7..280ea8d4778f 100644
---- a/include/linux/security.h
-+++ b/include/linux/security.h
-@@ -231,6 +231,15 @@ static inline bool lsmblob_equal(struct lsmblob *bloba, struct lsmblob *blobb)
- extern int lsm_name_to_slot(char *name);
- extern const char *lsm_slot_to_name(int slot);
-
-+static inline bool lsm_multiple_contexts(void)
-+{
-+#ifdef CONFIG_SECURITY
-+ return lsm_slot_to_name(1) != NULL;
-+#else
-+ return false;
-+#endif
-+}
-+
- /**
- * lsmblob_value - find the first non-zero value in an lsmblob structure.
- * @blob: Pointer to the data
-diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
-index 8eda133ca4c1..af0aaccfaf57 100644
---- a/include/uapi/linux/audit.h
-+++ b/include/uapi/linux/audit.h
-@@ -143,6 +143,7 @@
- #define AUDIT_MAC_UNLBL_STCDEL 1417 /* NetLabel: del a static label */
- #define AUDIT_MAC_CALIPSO_ADD 1418 /* NetLabel: add CALIPSO DOI entry */
- #define AUDIT_MAC_CALIPSO_DEL 1419 /* NetLabel: del CALIPSO DOI entry */
-+#define AUDIT_MAC_TASK_CONTEXTS 1420 /* Multiple LSM task contexts */
-
- #define AUDIT_FIRST_KERN_ANOM_MSG 1700
- #define AUDIT_LAST_KERN_ANOM_MSG 1799
diff --git a/kernel/audit.c b/kernel/audit.c
-index 559fb14e0380..e8744e80ef21 100644
+index 5226e2af9498..d83d1f05c95d 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
-@@ -197,6 +197,9 @@ static struct audit_ctl_mutex {
- struct audit_context_entry {
- struct list_head list;
- int type; /* Audit record type */
-+ union {
-+ struct lsmblob lsm_subjs;
-+ };
- };
+@@ -2073,12 +2073,10 @@ int audit_log_task_context(struct audit_buffer *ab)
+ char *ctx = NULL;
+ unsigned len;
+ int error;
+- u32 sid;
+ struct lsm_export le;
- /* The audit_buffer is used when formatting an audit record. The caller
-@@ -2163,16 +2166,31 @@ int audit_log_task_context(struct audit_buffer *ab)
- if (!lsmblob_is_set(&blob))
+ security_task_getsecid(current, &le);
+- lsm_export_secid(&le, &sid);
+- if (!sid)
++ if (!lsm_export_any(&le))
return 0;
-- error = security_secid_to_secctx(&blob, &context, LSMBLOB_FIRST);
-+ if (!lsm_multiple_contexts()) {
-+ error = security_secid_to_secctx(&blob, &context,
-+ LSMBLOB_FIRST);
-+ if (error) {
-+ if (error != -EINVAL)
-+ goto error_path;
-+ return 0;
-+ }
+ error = security_secid_to_secctx(&le, &ctx, &len);
+diff --git a/kernel/audit.h b/kernel/audit.h
+index e2e6fa911f9c..7d2fcdf0bc94 100644
+--- a/kernel/audit.h
++++ b/kernel/audit.h
+@@ -91,7 +91,7 @@ struct audit_names {
+ kuid_t uid;
+ kgid_t gid;
+ dev_t rdev;
+- u32 osid;
++ struct lsm_export olsm;
+ struct audit_cap_data fcap;
+ unsigned int fcap_ver;
+ unsigned char type; /* record type */
+@@ -165,7 +165,7 @@ struct audit_context {
+ kuid_t uid;
+ kgid_t gid;
+ umode_t mode;
+- u32 osid;
++ struct lsm_export olsm;
+ int has_perm;
+ uid_t perm_uid;
+ gid_t perm_gid;
+diff --git a/kernel/auditsc.c b/kernel/auditsc.c
+index 75d181029d40..d64775f4bb1b 100644
+--- a/kernel/auditsc.c
++++ b/kernel/auditsc.c
+@@ -645,17 +645,15 @@ static int audit_filter_rules(struct task_struct *tsk,
+ if (f->lsm_rule) {
+ /* Find files that match */
+ if (name) {
+- lsm_export_to_all(&le, name->osid);
+ result = security_audit_rule_match(
+- &le,
++ &name->olsm,
+ f->type,
+ f->op,
+ f->lsm_rule);
+ } else if (ctx) {
+ list_for_each_entry(n, &ctx->names_list, list) {
+- lsm_export_to_all(&le, n->osid);
+ if (security_audit_rule_match(
+- &le,
++ &n->olsm,
+ f->type,
+ f->op,
+ f->lsm_rule)) {
+@@ -667,8 +665,7 @@ static int audit_filter_rules(struct task_struct *tsk,
+ /* Find ipc objects that match */
+ if (!ctx || ctx->type != AUDIT_IPC)
+ break;
+- lsm_export_to_all(&le, ctx->ipc.osid);
+- if (security_audit_rule_match(&le,
++ if (security_audit_rule_match(&ctx->ipc.olsm,
+ f->type, f->op,
+ f->lsm_rule))
+ ++result;
+@@ -1187,19 +1184,17 @@ static void show_special(struct audit_context *context, int *call_panic)
+ context->socketcall.args[i]);
+ break; }
+ case AUDIT_IPC: {
+- u32 osid = context->ipc.osid;
++ struct lsm_export *l = &context->ipc.olsm;
-- if (error) {
-- if (error != -EINVAL)
-+ audit_log_format(ab, " subj=%s", context.context);
-+ security_release_secctx(&context);
-+ } else {
-+ struct audit_context_entry *ace;
-+
-+ audit_log_format(ab, " subj=?");
-+ ace = kzalloc(sizeof(*ace), ab->gfp_mask);
-+ if (!ace) {
-+ error = -ENOMEM;
- goto error_path;
-- return 0;
-+ }
-+ INIT_LIST_HEAD(&ace->list);
-+ ace->type = AUDIT_MAC_TASK_CONTEXTS;
-+ ace->lsm_subjs = blob;
-+ list_add(&ace->list, &ab->aux_records);
- }
+ audit_log_format(ab, "ouid=%u ogid=%u mode=%#ho",
+ from_kuid(&init_user_ns, context->ipc.uid),
+ from_kgid(&init_user_ns, context->ipc.gid),
+ context->ipc.mode);
+- if (osid) {
++ if (lsm_export_any(l)) {
+ char *ctx = NULL;
+ u32 len;
+- struct lsm_export le;
+- lsm_export_to_all(&le, osid);
+- if (security_secid_to_secctx(&le, &ctx, &len)) {
+- audit_log_format(ab, " osid=%u", osid);
++ if (security_secid_to_secctx(l, &ctx, &len)) {
++ audit_log_format(ab, " osid=(unknown)");
+ *call_panic = 1;
+ } else {
+ audit_log_format(ab, " obj=%s", ctx);
+@@ -1346,14 +1341,12 @@ static void audit_log_name(struct audit_context *context, struct audit_names *n,
+ from_kgid(&init_user_ns, n->gid),
+ MAJOR(n->rdev),
+ MINOR(n->rdev));
+- if (n->osid != 0) {
++ if (lsm_export_any(&n->olsm)) {
+ char *ctx = NULL;
+ u32 len;
+- struct lsm_export le;
+
+- lsm_export_to_all(&le, n->osid);
+- if (security_secid_to_secctx(&le, &ctx, &len)) {
+- audit_log_format(ab, " osid=%u", n->osid);
++ if (security_secid_to_secctx(&n->olsm, &ctx, &len)) {
++ audit_log_format(ab, " osid=(unknown)");
+ if (call_panic)
+ *call_panic = 2;
+ } else {
+@@ -1907,16 +1900,13 @@ static inline int audit_copy_fcaps(struct audit_names *name,
+ void audit_copy_inode(struct audit_names *name, const struct dentry *dentry,
+ struct inode *inode, unsigned int flags)
+ {
+- struct lsm_export le;
-
-- audit_log_format(ab, " subj=%s", context.context);
-- security_release_secctx(&context);
- return 0;
+ name->ino = inode->i_ino;
+ name->dev = inode->i_sb->s_dev;
+ name->mode = inode->i_mode;
+ name->uid = inode->i_uid;
+ name->gid = inode->i_gid;
+ name->rdev = inode->i_rdev;
+- security_inode_getsecid(inode, &le);
+- lsm_export_secid(&le, &name->osid);
++ security_inode_getsecid(inode, &name->olsm);
+ if (flags & AUDIT_INODE_NOEVAL) {
+ name->fcap_ver = -1;
+ return;
+@@ -2266,13 +2256,11 @@ void __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
+ void __audit_ipc_obj(struct kern_ipc_perm *ipcp)
+ {
+ struct audit_context *context = audit_context();
+- struct lsm_export le;
+ context->ipc.uid = ipcp->uid;
+ context->ipc.gid = ipcp->gid;
+ context->ipc.mode = ipcp->mode;
+ context->ipc.has_perm = 0;
+- security_ipc_getsecid(ipcp, &le);
+- lsm_export_secid(&le, &context->ipc.osid);
++ security_ipc_getsecid(ipcp, &context->ipc.olsm);
+ context->type = AUDIT_IPC;
+ }
- error_path:
-@@ -2434,9 +2452,12 @@ void audit_log_end(struct audit_buffer *ab)
- struct audit_context_entry *entry;
- struct audit_context mcontext;
- struct audit_context *mctx;
-+ struct lsmcontext lcontext;
- struct audit_buffer *mab;
- struct list_head *l;
- struct list_head *n;
-+ int rc;
-+ int i;
-
- if (!ab)
- return;
-@@ -2449,6 +2470,7 @@ void audit_log_end(struct audit_buffer *ab)
- }
-
- if (ab->ctx == NULL) {
-+ mcontext.context = AUDIT_CTX_SYSCALL;
- mcontext.stamp = ab->stamp;
- mctx = &mcontext;
- } else
-@@ -2462,7 +2484,27 @@ void audit_log_end(struct audit_buffer *ab)
- continue;
- }
- switch (entry->type) {
-- /* Don't know of any quite yet. */
-+ case AUDIT_MAC_TASK_CONTEXTS:
-+ for (i = 0; i < LSMBLOB_ENTRIES; i++) {
-+ if (entry->lsm_subjs.secid[i] == 0)
-+ continue;
-+ rc = security_secid_to_secctx(&entry->lsm_subjs,
-+ &lcontext, i);
-+ if (rc) {
-+ if (rc != -EINVAL)
-+ audit_panic("error in audit_log_end");
-+ audit_log_format(mab, "%ssubj_%s=?",
-+ i ? " " : "",
-+ lsm_slot_to_name(i));
-+ } else {
-+ audit_log_format(mab, "%ssubj_%s=%s",
-+ i ? " " : "",
-+ lsm_slot_to_name(i),
-+ lcontext.context);
-+ security_release_secctx(&lcontext);
-+ }
-+ }
-+ break;
- default:
- audit_panic("Unknown type in audit_log_end");
- break;
--
-2.31.1
+2.19.1