X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=blobdiff_plain;f=kernel%2Faudit.c;h=7f0699790d469ce218ff4ec91967608275871fb7;hb=96d0821cacd095e25a39dfff5232a45b63ed18dd;hp=f0a003acf6212479618042e258baa44d9856a5d2;hpb=326e9c8ba6a149f47e020719b23b24a14ba740d6;p=linux-2.6

diff --git a/kernel/audit.c b/kernel/audit.c
index f0a003acf6..7f0699790d 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -234,7 +234,7 @@ static int audit_set_rate_limit(int limit, uid_t loginuid)
 	int old		 = audit_rate_limit;
 	audit_rate_limit = limit;
 	audit_log(NULL, AUDIT_CONFIG_CHANGE, 
-			"audit_rate_limit=%d old=%d by auid %u",
+			"audit_rate_limit=%d old=%d by auid=%u",
 			audit_rate_limit, old, loginuid);
 	return old;
 }
@@ -244,7 +244,7 @@ static int audit_set_backlog_limit(int limit, uid_t loginuid)
 	int old		 = audit_backlog_limit;
 	audit_backlog_limit = limit;
 	audit_log(NULL, AUDIT_CONFIG_CHANGE,
-			"audit_backlog_limit=%d old=%d by auid %u",
+			"audit_backlog_limit=%d old=%d by auid=%u",
 			audit_backlog_limit, old, loginuid);
 	return old;
 }
@@ -256,7 +256,7 @@ static int audit_set_enabled(int state, uid_t loginuid)
 		return -EINVAL;
 	audit_enabled = state;
 	audit_log(NULL, AUDIT_CONFIG_CHANGE,
-			"audit_enabled=%d old=%d by auid %u",
+			"audit_enabled=%d old=%d by auid=%u",
 			audit_enabled, old, loginuid);
 	return old;
 }
@@ -270,7 +270,7 @@ static int audit_set_failure(int state, uid_t loginuid)
 		return -EINVAL;
 	audit_failure = state;
 	audit_log(NULL, AUDIT_CONFIG_CHANGE,
-			"audit_failure=%d old=%d by auid %u",
+			"audit_failure=%d old=%d by auid=%u",
 			audit_failure, old, loginuid);
 	return old;
 }
@@ -424,7 +424,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 			int old   = audit_pid;
 			audit_pid = status_get->pid;
 			audit_log(NULL, AUDIT_CONFIG_CHANGE,
-				"audit_pid=%d old=%d by auid %u",
+				"audit_pid=%d old=%d by auid=%u",
 				  audit_pid, old, loginuid);
 		}
 		if (status_get->mask & AUDIT_STATUS_RATE_LIMIT)
@@ -514,7 +514,8 @@ static int __init audit_init(void)
 {
 	printk(KERN_INFO "audit: initializing netlink socket (%s)\n",
 	       audit_default ? "enabled" : "disabled");
-	audit_sock = netlink_kernel_create(NETLINK_AUDIT, audit_receive);
+	audit_sock = netlink_kernel_create(NETLINK_AUDIT, 0, audit_receive,
+					   THIS_MODULE);
 	if (!audit_sock)
 		audit_panic("cannot initialize netlink socket");
 
@@ -597,6 +598,47 @@ err:
 	return NULL;
 }
 
+/* Compute a serial number for the audit record.  Audit records are
+ * written to user-space as soon as they are generated, so a complete
+ * audit record may be written in several pieces.  The timestamp of the
+ * record and this serial number are used by the user-space tools to
+ * determine which pieces belong to the same audit record.  The
+ * (timestamp,serial) tuple is unique for each syscall and is live from
+ * syscall entry to syscall exit.
+ *
+ * Atomic values are only guaranteed to be 24-bit, so we count down.
+ *
+ * NOTE: Another possibility is to store the formatted records off the
+ * audit context (for those records that have a context), and emit them
+ * all at syscall exit.  However, this could delay the reporting of
+ * significant errors until syscall exit (or never, if the system
+ * halts). */
+unsigned int audit_serial(void)
+{
+	static atomic_t serial = ATOMIC_INIT(0xffffff);
+	unsigned int a, b;
+
+	do {
+		a = atomic_read(&serial);
+		if (atomic_dec_and_test(&serial))
+			atomic_set(&serial, 0xffffff);
+		b = atomic_read(&serial);
+	} while (b != a - 1);
+
+	return 0xffffff - b;
+}
+
+static inline void audit_get_stamp(struct audit_context *ctx, 
+				   struct timespec *t, unsigned int *serial)
+{
+	if (ctx)
+		auditsc_get_stamp(ctx, t, serial);
+	else {
+		*t = CURRENT_TIME;
+		*serial = audit_serial();
+	}
+}
+
 /* Obtain an audit buffer.  This routine does locking to obtain the
  * audit buffer, but then no locking is required for calls to
  * audit_log_*format.  If the tsk is a task that is currently in a
@@ -630,10 +672,7 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, int type)
 		return NULL;
 	}
 
-	if (!audit_get_stamp(ab->ctx, &t, &serial)) {
-		t = CURRENT_TIME;
-		serial = 0;
-	}
+	audit_get_stamp(ab->ctx, &t, &serial);
 
 	audit_log_format(ab, "audit(%lu.%03lu:%u): ",
 			 t.tv_sec, t.tv_nsec/1000000, serial);