lkml.org 
[lkml]   [2015]   [Jan]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.14 44/52] audit: restore AUDIT_LOGINUID unset ABI
    Date
    3.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Richard Guy Briggs <rgb@redhat.com>

    commit 041d7b98ffe59c59fdd639931dea7d74f9aa9a59 upstream.

    A regression was caused by commit 780a7654cee8:
    audit: Make testing for a valid loginuid explicit.
    (which in turn attempted to fix a regression caused by e1760bd)

    When audit_krule_to_data() fills in the rules to get a listing, there was a
    missing clause to convert back from AUDIT_LOGINUID_SET to AUDIT_LOGINUID.

    This broke userspace by not returning the same information that was sent and
    expected.

    The rule:
    auditctl -a exit,never -F auid=-1
    gives:
    auditctl -l
    LIST_RULES: exit,never f24=0 syscall=all
    when it should give:
    LIST_RULES: exit,never auid=-1 (0xffffffff) syscall=all

    Tag it so that it is reported the same way it was set. Create a new
    private flags audit_krule field (pflags) to store it that won't interact with
    the public one from the API.

    Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
    Signed-off-by: Paul Moore <pmoore@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    include/linux/audit.h | 4 ++++
    kernel/auditfilter.c | 10 ++++++++++
    2 files changed, 14 insertions(+)

    --- a/include/linux/audit.h
    +++ b/include/linux/audit.h
    @@ -47,6 +47,7 @@ struct sk_buff;

    struct audit_krule {
    int vers_ops;
    + u32 pflags;
    u32 flags;
    u32 listnr;
    u32 action;
    @@ -64,6 +65,9 @@ struct audit_krule {
    u64 prio;
    };

    +/* Flag to indicate legacy AUDIT_LOGINUID unset usage */
    +#define AUDIT_LOGINUID_LEGACY 0x1
    +
    struct audit_field {
    u32 type;
    u32 val;
    --- a/kernel/auditfilter.c
    +++ b/kernel/auditfilter.c
    @@ -429,6 +429,7 @@ static struct audit_entry *audit_data_to
    if ((f->type == AUDIT_LOGINUID) && (f->val == AUDIT_UID_UNSET)) {
    f->type = AUDIT_LOGINUID_SET;
    f->val = 0;
    + entry->rule.pflags |= AUDIT_LOGINUID_LEGACY;
    }

    err = audit_field_valid(entry, f);
    @@ -604,6 +605,13 @@ static struct audit_rule_data *audit_kru
    data->buflen += data->values[i] =
    audit_pack_string(&bufp, krule->filterkey);
    break;
    + case AUDIT_LOGINUID_SET:
    + if (krule->pflags & AUDIT_LOGINUID_LEGACY && !f->val) {
    + data->fields[i] = AUDIT_LOGINUID;
    + data->values[i] = AUDIT_UID_UNSET;
    + break;
    + }
    + /* fallthrough if set */
    default:
    data->values[i] = f->val;
    }
    @@ -620,6 +628,7 @@ static int audit_compare_rule(struct aud
    int i;

    if (a->flags != b->flags ||
    + a->pflags != b->pflags ||
    a->listnr != b->listnr ||
    a->action != b->action ||
    a->field_count != b->field_count)
    @@ -738,6 +747,7 @@ struct audit_entry *audit_dupe_rule(stru
    new = &entry->rule;
    new->vers_ops = old->vers_ops;
    new->flags = old->flags;
    + new->pflags = old->pflags;
    new->listnr = old->listnr;
    new->action = old->action;
    for (i = 0; i < AUDIT_BITMASK_SIZE; i++)



    \
     
     \ /
      Last update: 2015-01-07 03:21    [W:6.040 / U:0.168 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site