Add audit uid to netlink credentials

Most audit control messages are sent over netlink.In order to properly
log the identity of the sender of audit control messages, we would like
to add the loginuid to the netlink_creds structure, as per the attached
patch.

Signed-off-by: Serge Hallyn <serue@us.ibm.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 5fabe8481011311e2f4cb4b46ba69da18c53dcf3..19f214230fec90b31c79d3c02c753582b6a0cc37 100644 (file)
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -184,7 +184,7 @@ extern void audit_inode(const char *name, const struct inode *inode);
 
                                /* Private API (for audit.c only) */
 extern int  audit_receive_filter(int type, int pid, int uid, int seq,
-                                void *data);
+                                void *data, uid_t loginuid);
 extern void audit_get_stamp(struct audit_context *ctx,
                            struct timespec *t, unsigned int *serial);
 extern int  audit_set_loginuid(struct audit_context *ctx, uid_t loginuid);

diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index f731abdc1a29a9cd1d5290d6a8121414377e88df..b2738ac8bc999f30c0840f318c5da73d95214fed 100644 (file)
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -110,6 +110,7 @@ struct netlink_skb_parms
        __u32                   dst_pid;
        __u32                   dst_groups;
        kernel_cap_t            eff_cap;
+       __u32                   loginuid;       /* Login (audit) uid */
 };
 
 #define NETLINK_CB(skb)                (*(struct netlink_skb_parms*)&((skb)->cb))

diff --git a/kernel/audit.c b/kernel/audit.c
index 58c7d7e472996f5987d574df2e260fe9b1dec861..587d3b2eba7fb1506dbe277ed3967ccffdd24a80 100644 (file)
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -239,36 +239,36 @@ void audit_log_lost(const char *message)
 
 }
 
-static int audit_set_rate_limit(int limit)
+static int audit_set_rate_limit(int limit, uid_t loginuid)
 {
        int old          = audit_rate_limit;
        audit_rate_limit = limit;
-       audit_log(current->audit_context, "audit_rate_limit=%d old=%d",
-                 audit_rate_limit, old);
+       audit_log(NULL, "audit_rate_limit=%d old=%d by auid %u",
+                       audit_rate_limit, old, loginuid);
        return old;
 }
 
-static int audit_set_backlog_limit(int limit)
+static int audit_set_backlog_limit(int limit, uid_t loginuid)
 {
        int old          = audit_backlog_limit;
        audit_backlog_limit = limit;
-       audit_log(current->audit_context, "audit_backlog_limit=%d old=%d",
-                 audit_backlog_limit, old);
+       audit_log(NULL, "audit_backlog_limit=%d old=%d by auid %u",
+                       audit_backlog_limit, old, loginuid);
        return old;
 }
 
-static int audit_set_enabled(int state)
+static int audit_set_enabled(int state, uid_t loginuid)
 {
        int old          = audit_enabled;
        if (state != 0 && state != 1)
                return -EINVAL;
        audit_enabled = state;
-       audit_log(current->audit_context, "audit_enabled=%d old=%d",
-                 audit_enabled, old);
+       audit_log(NULL, "audit_enabled=%d old=%d by auid %u",
+                 audit_enabled, old, loginuid);
        return old;
 }
 
-static int audit_set_failure(int state)
+static int audit_set_failure(int state, uid_t loginuid)
 {
        int old          = audit_failure;
        if (state != AUDIT_FAIL_SILENT
@@ -276,8 +276,8 @@ static int audit_set_failure(int state)
            && state != AUDIT_FAIL_PANIC)
                return -EINVAL;
        audit_failure = state;
-       audit_log(current->audit_context, "audit_failure=%d old=%d",
-                 audit_failure, old);
+       audit_log(NULL, "audit_failure=%d old=%d by auid %u",
+                 audit_failure, old, loginuid);
        return old;
 }
 
@@ -344,6 +344,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
        int                     err;
        struct audit_buffer     *ab;
        u16                     msg_type = nlh->nlmsg_type;
+       uid_t                   loginuid; /* loginuid of sender */
 
        err = audit_netlink_ok(NETLINK_CB(skb).eff_cap, msg_type);
        if (err)
@@ -351,6 +352,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 
        pid  = NETLINK_CREDS(skb)->pid;
        uid  = NETLINK_CREDS(skb)->uid;
+       loginuid = NETLINK_CB(skb).loginuid;
        seq  = nlh->nlmsg_seq;
        data = NLMSG_DATA(nlh);
 
@@ -371,34 +373,36 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                        return -EINVAL;
                status_get   = (struct audit_status *)data;
                if (status_get->mask & AUDIT_STATUS_ENABLED) {
-                       err = audit_set_enabled(status_get->enabled);
+                       err = audit_set_enabled(status_get->enabled, loginuid);
                        if (err < 0) return err;
                }
                if (status_get->mask & AUDIT_STATUS_FAILURE) {
-                       err = audit_set_failure(status_get->failure);
+                       err = audit_set_failure(status_get->failure, loginuid);
                        if (err < 0) return err;
                }
                if (status_get->mask & AUDIT_STATUS_PID) {
                        int old   = audit_pid;
                        audit_pid = status_get->pid;
-                       audit_log(current->audit_context,
-                                 "audit_pid=%d old=%d", audit_pid, old);
+                       audit_log(NULL, "audit_pid=%d old=%d by auid %u",
+                                 audit_pid, old, loginuid);
                }
                if (status_get->mask & AUDIT_STATUS_RATE_LIMIT)
-                       audit_set_rate_limit(status_get->rate_limit);
+                       audit_set_rate_limit(status_get->rate_limit, loginuid);
                if (status_get->mask & AUDIT_STATUS_BACKLOG_LIMIT)
-                       audit_set_backlog_limit(status_get->backlog_limit);
+                       audit_set_backlog_limit(status_get->backlog_limit,
+                                                       loginuid);
                break;
        case AUDIT_USER:
                ab = audit_log_start(NULL);
                if (!ab)
                        break;  /* audit_panic has been called */
                audit_log_format(ab,
-                                "user pid=%d uid=%d length=%d msg='%.1024s'",
+                                "user pid=%d uid=%d length=%d loginuid=%u"
+                                " msg='%.1024s'",
                                 pid, uid,
                                 (int)(nlh->nlmsg_len
                                       - ((char *)data - (char *)nlh)),
-                                (char *)data);
+                                loginuid, (char *)data);
                ab->type = AUDIT_USER;
                ab->pid  = pid;
                audit_log_end(ab);
@@ -411,7 +415,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
        case AUDIT_LIST:
 #ifdef CONFIG_AUDITSYSCALL
                err = audit_receive_filter(nlh->nlmsg_type, NETLINK_CB(skb).pid,
-                                          uid, seq, data);
+                                          uid, seq, data, loginuid);
 #else
                err = -EOPNOTSUPP;
 #endif

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 9ff2c1b1033e082a2c1ef7622b7b56a9143ed1cf..66148f81d7836fb66f44bca5dd97173903d378be 100644 (file)
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -251,7 +251,8 @@ static int audit_copy_rule(struct audit_rule *d, struct audit_rule *s)
        return 0;
 }
 
-int audit_receive_filter(int type, int pid, int uid, int seq, void *data)
+int audit_receive_filter(int type, int pid, int uid, int seq, void *data,
+                                                       uid_t loginuid)
 {
        u32                flags;
        struct audit_entry *entry;
@@ -286,6 +287,7 @@ int audit_receive_filter(int type, int pid, int uid, int seq, void *data)
                        err = audit_add_rule(entry, &audit_entlist);
                if (!err && (flags & AUDIT_AT_EXIT))
                        err = audit_add_rule(entry, &audit_extlist);
+               audit_log(NULL, "auid %u added an audit rule\n", loginuid);
                break;
        case AUDIT_DEL:
                flags =((struct audit_rule *)data)->flags;
@@ -295,6 +297,7 @@ int audit_receive_filter(int type, int pid, int uid, int seq, void *data)
                        err = audit_del_rule(data, &audit_entlist);
                if (!err && (flags & AUDIT_AT_EXIT))
                        err = audit_del_rule(data, &audit_extlist);
+               audit_log(NULL, "auid %u removed an audit rule\n", loginuid);
                break;
        default:
                return -EINVAL;

diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 29a5fd231eac9a97bb247162e8a8fc20a8163cea..cb64cff3e339491664a3d299edf19e5406ff5aef 100644 (file)
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -905,6 +905,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
        NETLINK_CB(skb).groups  = nlk->groups;
        NETLINK_CB(skb).dst_pid = dst_pid;
        NETLINK_CB(skb).dst_groups = dst_groups;
+       NETLINK_CB(skb).loginuid = audit_get_loginuid(current->audit_context);
        memcpy(NETLINK_CREDS(skb), &siocb->scm->creds, sizeof(struct ucred));
 
        /* What can I do? Netlink is asynchronous, so that