Messages in this thread Patch in this message |  | | From | Richard Guy Briggs <> | Subject | [PATCH 5/5] audit: allow user processes to log from another PID namespace | Date | Mon, 23 Dec 2013 17:27:39 -0500 |
| |
Still only permit the audit logging daemon and control to operate from the initial PID namespace, but allow processes to log from another PID namespace.
Cc: "Eric W. Biederman" <ebiederm@xmission.com> (informed by ebiederman's c776b5d2)
Signed-off-by: Richard Guy Briggs <rgb@redhat.com> --- kernel/audit.c | 10 +++++++--- 1 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/kernel/audit.c b/kernel/audit.c index e39606b..83f8068 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -606,9 +606,8 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type) { int err = 0; - /* Only support the initial namespaces for now. */ - if ((current_user_ns() != &init_user_ns) || - (task_active_pid_ns(current) != &init_pid_ns)) + /* Only support initial user namespace for now. */ + if ((current_user_ns() != &init_user_ns)) return -EPERM; switch (msg_type) { @@ -628,6 +627,11 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type) case AUDIT_TTY_SET: case AUDIT_TRIM: case AUDIT_MAKE_EQUIV: + /* Only support auditd and auditctl in initial pid namespace + * for now. */ + if ((task_active_pid_ns(current) != &init_pid_ns)) + return -EPERM; + if (!capable(CAP_AUDIT_CONTROL)) err = -EPERM; break; -- 1.7.1
|  |