[PATCH RFC 14/48] Audit: only allow init user namespace to change audit_failure
flat view
STALE4867d
From: Gao feng <hidden>
Date: 2013-05-07 02:31:40
Also in:
lkml
Subsystem:
audit subsystem, the rest · Maintainers:
Paul Moore, Eric Paris, Linus Torvalds
Revision rfc of 3 in this series.
Revisions (3)
- rfc current
- v1 [diff vs current]
- v2 [diff vs current]
Setting audit_failure to AUDIT_FAIL_PANIC may cause system panic. We should disallow uninit user namesapce to change it. Signed-off-by: Gao feng <redacted> --- kernel/audit.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/kernel/audit.c b/kernel/audit.c
index 8a3ea47..18cf5ce 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c@@ -345,6 +345,9 @@ static int audit_set_failure(int state, kuid_t loginuid, u32 sessionid, u32 sid) && state != AUDIT_FAIL_PANIC) return -EINVAL; + if (current_user_ns() != &init_user_ns) + return -EPERM; + return audit_do_config_change("audit_failure", &audit_failure, state, loginuid, sessionid, sid); }
--
1.8.1.4