[PATCH RFC 13/48] Audit: only allow init user namespace to change audit_rate_limit
flat view
STALE4871d
SUPERSEDED
From: Gao feng <hidden>
Date: 2013-05-07 02:28:38
Also in:
lkml
Subsystem:
audit subsystem, the rest · Maintainers:
Paul Moore, Eric Paris, Linus Torvalds
Revision rfc of 3 in this series.
Revisions (3)
- rfc current
- v1 [diff vs current]
- v2 [diff vs current]
Because We want to avoid the DoS attack caused by other user namespace,so don't make audit_rate_limit per user namespace. And only init user namespace has rights to change it. Signed-off-by: Gao feng <redacted> --- kernel/audit.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/kernel/audit.c b/kernel/audit.c
index bf8b59c..8a3ea47 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c@@ -308,6 +308,9 @@ static int audit_do_config_change(char *function_name, int *to_change, static int audit_set_rate_limit(int limit, kuid_t loginuid, u32 sessionid, u32 sid) { + if (current_user_ns() != &init_user_ns) + return -EPERM; + return audit_do_config_change("audit_rate_limit", &audit_rate_limit, limit, loginuid, sessionid, sid); }
--
1.8.1.4