lkml.org 
[lkml]   [2012]   [Sep]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: 3.6-rc4 audit_log_d_path oops.
From
On Thu, Sep 6, 2012 at 9:45 AM, Dave Jones <davej@redhat.com> wrote:
> On Thu, Sep 06, 2012 at 09:32:49AM -0700, Kees Cook wrote:
> > > I just realised, the funny thing about this is that the machine running that test
> > > had selinux/audit disabled. And yet here we are, screwing around with audit buffers.
> >
> > The intent was to have this message show up in dmesg even if auditd
> > wasn't running, and even if the specific process wasn't being
> > explicitly audited.
> >
> > > Should there be a test on audit_enable=0 in audit_log_link_denied() ?
> > >
> > > I'm now curious how much more of the audit code is getting run through similar lack of tests
> >
> > What is the condition in which audit_log_start fails?
>
> in the case of that oops, given I had booted with audit=0, I suspect it was hitting the first check...
>
> 1157 if (audit_initialized != AUDIT_INITIALIZED)
> 1158 return NULL;

Ah-ha, okay. Yeah, I'm fine with the fix you had. If _start fails, just return.

-Kees

--
Kees Cook
Chrome OS Security


\
 
 \ /
  Last update: 2012-09-06 20:42    [W:0.408 / U:0.788 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site