AUDIT: Avoid sleeping function in SElinux AVC audit.

This patch changes the SELinux AVC to defer logging of paths to the audit
framework upon syscall exit, by saving a reference to the (dentry,vfsmount)
pair in an auxiliary audit item on the current audit context for processing
by audit_log_exit.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 17ea5d522d814d0f4957ea755d317ada78b4c644..4b7caf0c6e1011b0d4e3de2ab5172ba4dab677c8 100644 (file)
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -69,6 +69,7 @@
 
 #define AUDIT_AVC              1400    /* SE Linux avc denial or grant */
 #define AUDIT_SELINUX_ERR      1401    /* Internal SE Linux Errors */
+#define AUDIT_AVC_PATH         1402    /* dentry, vfsmount pair from avc */
 
 #define AUDIT_KERNEL           2000    /* Asynchronous audit record. NOT A REQUEST. */
 
@@ -225,6 +226,7 @@ extern uid_t audit_get_loginuid(struct audit_context *ctx);
 extern int audit_ipc_perms(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode);
 extern int audit_socketcall(int nargs, unsigned long *args);
 extern int audit_sockaddr(int len, void *addr);
+extern int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt);
 extern void audit_signal_info(int sig, struct task_struct *t);
 #else
 #define audit_alloc(t) ({ 0; })
@@ -240,6 +242,7 @@ extern void audit_signal_info(int sig, struct task_struct *t);
 #define audit_ipc_perms(q,u,g,m) ({ 0; })
 #define audit_socketcall(n,a) ({ 0; })
 #define audit_sockaddr(len, addr) ({ 0; })
+#define audit_avc_path(dentry, mnt) ({ 0; })
 #define audit_signal_info(s,t) do { ; } while (0)
 #endif
 

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 78d7a13fc86f2629d6c6871584802581657bb597..8dc5b2767145f5b83fa268df2756b467fb36d4fe 100644 (file)
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -34,6 +34,7 @@
 #include <asm/types.h>
 #include <linux/mm.h>
 #include <linux/module.h>
+#include <linux/mount.h>
 #include <linux/socket.h>
 #include <linux/audit.h>
 #include <linux/personality.h>
@@ -124,6 +125,11 @@ struct audit_aux_data_sockaddr {
        char                    a[0];
 };
 
+struct audit_aux_data_path {
+       struct audit_aux_data   d;
+       struct dentry           *dentry;
+       struct vfsmount         *mnt;
+};
 
 /* The per-task audit context. */
 struct audit_context {
@@ -553,6 +559,11 @@ static inline void audit_free_aux(struct audit_context *context)
        struct audit_aux_data *aux;
 
        while ((aux = context->aux)) {
+               if (aux->type == AUDIT_AVC_PATH) {
+                       struct audit_aux_data_path *axi = (void *)aux;
+                       dput(axi->dentry);
+                       mntput(axi->mnt);
+               }
                context->aux = aux->next;
                kfree(aux);
        }
@@ -724,6 +735,14 @@ static void audit_log_exit(struct audit_context *context)
                        audit_log_format(ab, "saddr=");
                        audit_log_hex(ab, axs->a, axs->len);
                        break; }
+
+               case AUDIT_AVC_PATH: {
+                       struct audit_aux_data_path *axi = (void *)aux;
+                       audit_log_d_path(ab, "path=", axi->dentry, axi->mnt);
+                       dput(axi->dentry);
+                       mntput(axi->mnt);
+                       break; }
+
                }
                audit_log_end(ab);
 
@@ -1124,6 +1143,27 @@ int audit_sockaddr(int len, void *a)
        return 0;
 }
 
+int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt)
+{
+       struct audit_aux_data_path *ax;
+       struct audit_context *context = current->audit_context;
+
+       if (likely(!context))
+               return 0;
+
+       ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
+       if (!ax)
+               return -ENOMEM;
+
+       ax->dentry = dget(dentry);
+       ax->mnt = mntget(mnt);
+
+       ax->d.type = AUDIT_AVC_PATH;
+       ax->d.next = context->aux;
+       context->aux = (void *)ax;
+       return 0;
+}
+
 void audit_signal_info(int sig, struct task_struct *t)
 {
        extern pid_t audit_sig_pid;

diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index 62b963aca27587b9d147fec666d2f4de6ff3a6c9..0fbc3e98c5ea354a08e643283cc8813e7dc4655c 100644 (file)
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -573,13 +573,10 @@ void avc_audit(u32 ssid, u32 tsid,
                case AVC_AUDIT_DATA_FS:
                        if (a->u.fs.dentry) {
                                struct dentry *dentry = a->u.fs.dentry;
-                               if (a->u.fs.mnt) {
-                                       audit_log_d_path(ab, "path=", dentry,
-                                                       a->u.fs.mnt);
-                               } else {
-                                       audit_log_format(ab, " name=%s",
-                                                        dentry->d_name.name);
-                               }
+                               if (a->u.fs.mnt)
+                                       audit_avc_path(dentry, a->u.fs.mnt);
+                               audit_log_format(ab, " name=%s",
+                                                dentry->d_name.name);
                                inode = dentry->d_inode;
                        } else if (a->u.fs.inode) {
                                struct dentry *dentry;
@@ -630,8 +627,10 @@ void avc_audit(u32 ssid, u32 tsid,
                                case AF_UNIX:
                                        u = unix_sk(sk);
                                        if (u->dentry) {
-                                               audit_log_d_path(ab, "path=",
-                                                       u->dentry, u->mnt);
+                                               audit_avc_path(u->dentry, u->mnt);
+                                               audit_log_format(ab, " name=%s",
+                                                                u->dentry->d_name.name);
+
                                                break;
                                        }
                                        if (!u->addr)