From: Alexander Viro <aviro@redhat.com> Date: Fri, 12 Sep 2008 14:09:16 -0400 Subject: [audit] audit-fork patch Message-id: alpine.LRH.1.10.0809121406010.25024@file.rdu.redhat.com O-Subject: [rhel5] bz#461831 audit-fork patch Bugzilla: 461831 RH-Acked-by: Rik van Riel <riel@redhat.com> RH-Acked-by: Eric Paris <eparis@redhat.com> Make sure that we don't lose fork() record for child; copy ->auditable and friends into child's context before making it runnable (if child does have an audit context, obviously). That's against -111.el5, should take care of bz#461831 parts 1 and 2. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> diff --git a/include/linux/audit.h b/include/linux/audit.h index 6c2d390..ec974c0 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -362,6 +362,7 @@ extern int audit_classify_arch(int arch); #ifdef CONFIG_AUDITSYSCALL /* These are defined in auditsc.c */ /* Public API */ +extern void audit_finish_fork(struct task_struct *child); extern int audit_alloc(struct task_struct *task); extern void audit_free(struct task_struct *task); extern void audit_syscall_entry(int arch, @@ -468,6 +469,7 @@ static inline int audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat) extern int audit_n_rules; extern int audit_signals; #else +#define audit_finish_fork(t) #define audit_alloc(t) ({ 0; }) #define audit_free(t) do { ; } while (0) #define audit_syscall_entry(ta,a,b,c,d,e) do { ; } while (0) diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 45a8eee..1320dc5 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1545,6 +1545,23 @@ void audit_syscall_entry(int arch, int major, context->ppid = 0; } +void audit_finish_fork(struct task_struct *child) +{ + struct audit_context *ctx = current->audit_context; + struct audit_context *p = child->audit_context; + if (!p || !ctx || !ctx->auditable) + return; + p->arch = ctx->arch; + p->major = ctx->major; + memcpy(p->argv, ctx->argv, sizeof(ctx->argv)); + p->ctime = ctx->ctime; + p->dummy = ctx->dummy; + p->auditable = ctx->auditable; + p->in_syscall = ctx->in_syscall; + p->filterkey = kstrdup(ctx->filterkey, GFP_KERNEL); + p->ppid = current->pid; +} + /** * audit_syscall_exit - deallocate audit context after a system call * @tsk: task being audited diff --git a/kernel/fork.c b/kernel/fork.c index 9e14ef0..4a33b29 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1472,6 +1472,7 @@ long do_fork(unsigned long clone_flags, init_completion(&vfork); } + audit_finish_fork(p); if (likely(is_user)) tracehook_report_clone(clone_flags, p);