lkml.org 
[lkml]   [2022]   [Sep]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v38 34/39] audit: multiple subject lsm values for netlabel
    Date
    Refactor audit_log_task_context(), creating a new
    audit_log_subject_context(). This is used in netlabel auditing
    to provide multiple subject security contexts as necessary.

    Acked-by: Paul Moore <paul@paul-moore.com>
    Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
    ---
    include/linux/audit.h | 7 +++++++
    kernel/audit.c | 26 ++++++++++++++++----------
    net/netlabel/netlabel_user.c | 7 +------
    3 files changed, 24 insertions(+), 16 deletions(-)

    diff --git a/include/linux/audit.h b/include/linux/audit.h
    index edb919722448..87ba6fe7f1a2 100644
    --- a/include/linux/audit.h
    +++ b/include/linux/audit.h
    @@ -188,6 +188,8 @@ extern void audit_log_path_denied(int type,
    const char *operation);
    extern void audit_log_lost(const char *message);

    +extern int audit_log_subject_context(struct audit_buffer *ab,
    + struct lsmblob *blob);
    extern int audit_log_task_context(struct audit_buffer *ab);
    extern void audit_log_task_info(struct audit_buffer *ab);

    @@ -248,6 +250,11 @@ static inline void audit_log_key(struct audit_buffer *ab, char *key)
    { }
    static inline void audit_log_path_denied(int type, const char *operation)
    { }
    +static inline int audit_log_subject_context(struct audit_buffer *ab,
    + struct lsmblob *blob)
    +{
    + return 0;
    +}
    static inline int audit_log_task_context(struct audit_buffer *ab)
    {
    return 0;
    diff --git a/kernel/audit.c b/kernel/audit.c
    index fb182f7e9d18..a611130f83cb 100644
    --- a/kernel/audit.c
    +++ b/kernel/audit.c
    @@ -2226,20 +2226,17 @@ static void audit_buffer_aux_end(struct audit_buffer *ab)
    ab->skb = skb_peek(&ab->skb_list);
    }

    -int audit_log_task_context(struct audit_buffer *ab)
    +int audit_log_subject_context(struct audit_buffer *ab, struct lsmblob *blob)
    {
    int i;
    int error;
    - struct lsmblob blob;
    struct lsmcontext context;

    - security_current_getsecid_subj(&blob);
    - if (!lsmblob_is_set(&blob))
    + if (!lsmblob_is_set(blob))
    return 0;

    if (!lsm_multiple_contexts()) {
    - error = security_secid_to_secctx(&blob, &context,
    - LSMBLOB_FIRST);
    + error = security_secid_to_secctx(blob, &context, LSMBLOB_FIRST);
    if (error) {
    if (error != -EINVAL)
    goto error_path;
    @@ -2254,15 +2251,15 @@ int audit_log_task_context(struct audit_buffer *ab)
    if (error)
    goto error_path;
    for (i = 0; i < LSMBLOB_ENTRIES; i++) {
    - if (blob.secid[i] == 0)
    + if (blob->secid[i] == 0)
    continue;
    - error = security_secid_to_secctx(&blob, &context, i);
    + error = security_secid_to_secctx(blob, &context, i);
    if (error) {
    audit_log_format(ab, "%ssubj_%s=?",
    i ? " " : "",
    lsm_slot_to_name(i));
    if (error != -EINVAL)
    - audit_panic("error in audit_log_task_context");
    + audit_panic("error in audit_log_subject_context");
    } else {
    audit_log_format(ab, "%ssubj_%s=%s",
    i ? " " : "",
    @@ -2277,9 +2274,18 @@ int audit_log_task_context(struct audit_buffer *ab)
    return 0;

    error_path:
    - audit_panic("error in audit_log_task_context");
    + audit_panic("error in audit_log_subject_context");
    return error;
    }
    +EXPORT_SYMBOL(audit_log_subject_context);
    +
    +int audit_log_task_context(struct audit_buffer *ab)
    +{
    + struct lsmblob blob;
    +
    + security_current_getsecid_subj(&blob);
    + return audit_log_subject_context(ab, &blob);
    +}
    EXPORT_SYMBOL(audit_log_task_context);

    void audit_log_d_path_exe(struct audit_buffer *ab,
    diff --git a/net/netlabel/netlabel_user.c b/net/netlabel/netlabel_user.c
    index 1941877fd16f..42812bdfc31a 100644
    --- a/net/netlabel/netlabel_user.c
    +++ b/net/netlabel/netlabel_user.c
    @@ -84,7 +84,6 @@ struct audit_buffer *netlbl_audit_start_common(int type,
    struct netlbl_audit *audit_info)
    {
    struct audit_buffer *audit_buf;
    - struct lsmcontext context;
    struct lsmblob blob;

    if (audit_enabled == AUDIT_OFF)
    @@ -99,11 +98,7 @@ struct audit_buffer *netlbl_audit_start_common(int type,
    audit_info->sessionid);

    lsmblob_init(&blob, audit_info->secid);
    - if (audit_info->secid != 0 &&
    - security_secid_to_secctx(&blob, &context, LSMBLOB_FIRST) == 0) {
    - audit_log_format(audit_buf, " subj=%s", context.context);
    - security_release_secctx(&context);
    - }
    + audit_log_subject_context(audit_buf, &blob);

    return audit_buf;
    }
    --
    2.37.3
    \
     
     \ /
      Last update: 2022-09-27 22:15    [W:4.104 / U:0.316 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site