Merge branch 'audit.b39' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit...

* 'audit.b39' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current:
  [PATCH] get rid of AVC_PATH postponed treatment
  [PATCH] allow audit filtering on bit & operations
  [PATCH] audit: fix broken class-based syscall audit
  [PATCH] Make IPC mode consistent

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 8ca7ca0b47f0ebecd6be51ad1c2ed4529cd12bc7..4bbd8601b8f04980f2f3adf7bd8aaadf053e02cb 100644 (file)
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -161,7 +161,7 @@
  * are currently used in an audit field constant understood by the kernel.
  * If you are adding a new #define AUDIT_<whatever>, please ensure that
  * AUDIT_UNUSED_BITS is updated if need be. */
-#define AUDIT_UNUSED_BITS      0x0FFFFC00
+#define AUDIT_UNUSED_BITS      0x07FFFC00
 
 
 /* Rule fields */
@@ -213,25 +213,29 @@
 #define AUDIT_NEGATE                   0x80000000
 
 /* These are the supported operators.
- *     4  2  1
- *     =  >  <
- *     -------
- *     0  0  0         0       nonsense
- *     0  0  1         1       <
- *     0  1  0         2       >
- *     0  1  1         3       !=
- *     1  0  0         4       =
- *     1  0  1         5       <=
- *     1  1  0         6       >=
- *     1  1  1         7       all operators
+ *     4  2  1  8
+ *     =  >  <  ?
+ *     ----------
+ *     0  0  0  0      00      nonsense
+ *     0  0  0  1      08      &  bit mask
+ *     0  0  1  0      10      <
+ *     0  1  0  0      20      >
+ *     0  1  1  0      30      !=
+ *     1  0  0  0      40      =
+ *     1  0  0  1      48      &=  bit test
+ *     1  0  1  0      50      <=
+ *     1  1  0  0      60      >=
+ *     1  1  1  1      78      all operators
  */
+#define AUDIT_BIT_MASK                 0x08000000
 #define AUDIT_LESS_THAN                        0x10000000
 #define AUDIT_GREATER_THAN             0x20000000
 #define AUDIT_NOT_EQUAL                        0x30000000
 #define AUDIT_EQUAL                    0x40000000
+#define AUDIT_BIT_TEST                 (AUDIT_BIT_MASK|AUDIT_EQUAL)
 #define AUDIT_LESS_THAN_OR_EQUAL       (AUDIT_LESS_THAN|AUDIT_EQUAL)
 #define AUDIT_GREATER_THAN_OR_EQUAL    (AUDIT_GREATER_THAN|AUDIT_EQUAL)
-#define AUDIT_OPERATORS                        (AUDIT_EQUAL|AUDIT_NOT_EQUAL)
+#define AUDIT_OPERATORS                        (AUDIT_EQUAL|AUDIT_NOT_EQUAL|AUDIT_BIT_MASK)
 
 /* Status symbols */
                                /* Mask values */
@@ -407,7 +411,6 @@ extern int audit_bprm(struct linux_binprm *bprm);
 extern int audit_socketcall(int nargs, unsigned long *args);
 extern int audit_sockaddr(int len, void *addr);
 extern int __audit_fd_pair(int fd1, int fd2);
-extern int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt);
 extern int audit_set_macxattr(const char *name);
 extern int __audit_mq_open(int oflag, mode_t mode, struct mq_attr __user *u_attr);
 extern int __audit_mq_timedsend(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec __user *u_abs_timeout);
@@ -487,7 +490,6 @@ extern int audit_signals;
 #define audit_socketcall(n,a) ({ 0; })
 #define audit_fd_pair(n,a) ({ 0; })
 #define audit_sockaddr(len, addr) ({ 0; })
-#define audit_avc_path(dentry, mnt) ({ 0; })
 #define audit_set_macxattr(n) do { ; } while (0)
 #define audit_mq_open(o,m,a) ({ 0; })
 #define audit_mq_timedsend(d,l,p,t) ({ 0; })

diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index 1bf093dcffe03e9f97dc4a8e91b4a99bd6f11b32..359645cff5b2cd662ea209458203eef6b1e96976 100644 (file)
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -304,7 +304,7 @@ int __init audit_register_class(int class, unsigned *list)
 
 int audit_match_class(int class, unsigned syscall)
 {
-       if (unlikely(syscall >= AUDIT_BITMASK_SIZE * sizeof(__u32)))
+       if (unlikely(syscall >= AUDIT_BITMASK_SIZE * 32))
                return 0;
        if (unlikely(class >= AUDIT_SYSCALL_CLASSES || !classes[class]))
                return 0;
@@ -456,6 +456,13 @@ static struct audit_entry *audit_rule_to_entry(struct audit_rule *rule)
                case AUDIT_DEVMINOR:
                case AUDIT_EXIT:
                case AUDIT_SUCCESS:
+                       /* bit ops are only useful on syscall args */
+                       if (f->op == AUDIT_BIT_MASK ||
+                                               f->op == AUDIT_BIT_TEST) {
+                               err = -EINVAL;
+                               goto exit_free;
+                       }
+                       break;
                case AUDIT_ARG0:
                case AUDIT_ARG1:
                case AUDIT_ARG2:
@@ -1566,6 +1573,10 @@ int audit_comparator(const u32 left, const u32 op, const u32 right)
                return (left > right);
        case AUDIT_GREATER_THAN_OR_EQUAL:
                return (left >= right);
+       case AUDIT_BIT_MASK:
+               return (left & right);
+       case AUDIT_BIT_TEST:
+               return ((left & right) == right);
        }
        BUG();
        return 0;

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 145cbb79c4b93bbd1dff40bdd0d2a0a63aa06fd6..bde1124d590891d42f4fced9ecf0f15a80fe8297 100644 (file)
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -173,12 +173,6 @@ struct audit_aux_data_fd_pair {
        int     fd[2];
 };
 
-struct audit_aux_data_path {
-       struct audit_aux_data   d;
-       struct dentry           *dentry;
-       struct vfsmount         *mnt;
-};
-
 struct audit_aux_data_pids {
        struct audit_aux_data   d;
        pid_t                   target_pid[AUDIT_AUX_PIDS];
@@ -654,12 +648,6 @@ static inline void audit_free_aux(struct audit_context *context)
        struct audit_aux_data *aux;
 
        while ((aux = context->aux)) {
-               if (aux->type == AUDIT_AVC_PATH) {
-                       struct audit_aux_data_path *axi = (void *)aux;
-                       dput(axi->dentry);
-                       mntput(axi->mnt);
-               }
-
                context->aux = aux->next;
                kfree(aux);
        }
@@ -995,7 +983,7 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
                case AUDIT_IPC: {
                        struct audit_aux_data_ipcctl *axi = (void *)aux;
                        audit_log_format(ab, 
-                                "ouid=%u ogid=%u mode=%x",
+                                "ouid=%u ogid=%u mode=%#o",
                                 axi->uid, axi->gid, axi->mode);
                        if (axi->osid != 0) {
                                char *ctx = NULL;
@@ -1014,7 +1002,7 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
                case AUDIT_IPC_SET_PERM: {
                        struct audit_aux_data_ipcctl *axi = (void *)aux;
                        audit_log_format(ab,
-                               "qbytes=%lx ouid=%u ogid=%u mode=%x",
+                               "qbytes=%lx ouid=%u ogid=%u mode=%#o",
                                axi->qbytes, axi->uid, axi->gid, axi->mode);
                        break; }
 
@@ -1038,11 +1026,6 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
                        audit_log_hex(ab, axs->a, axs->len);
                        break; }
 
-               case AUDIT_AVC_PATH: {
-                       struct audit_aux_data_path *axi = (void *)aux;
-                       audit_log_d_path(ab, "path=", axi->dentry, axi->mnt);
-                       break; }
-
                case AUDIT_FD_PAIR: {
                        struct audit_aux_data_fd_pair *axs = (void *)aux;
                        audit_log_format(ab, "fd0=%d fd1=%d", axs->fd[0], axs->fd[1]);
@@ -1990,36 +1973,6 @@ void __audit_ptrace(struct task_struct *t)
        selinux_get_task_sid(t, &context->target_sid);
 }
 
-/**
- * audit_avc_path - record the granting or denial of permissions
- * @dentry: dentry to record
- * @mnt: mnt to record
- *
- * Returns 0 for success or NULL context or < 0 on error.
- *
- * Called from security/selinux/avc.c::avc_audit()
- */
-int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt)
-{
-       struct audit_aux_data_path *ax;
-       struct audit_context *context = current->audit_context;
-
-       if (likely(!context))
-               return 0;
-
-       ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
-       if (!ax)
-               return -ENOMEM;
-
-       ax->dentry = dget(dentry);
-       ax->mnt = mntget(mnt);
-
-       ax->d.type = AUDIT_AVC_PATH;
-       ax->d.next = context->aux;
-       context->aux = (void *)ax;
-       return 0;
-}
-
 /**
  * audit_signal_info - record signal info for shutting down audit subsystem
  * @sig: signal value

diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index ecd06738453190dc4d2a596a7d25493ed98d170b..0e69adf63bdbffa522039f1df111ccb0dcbaca99 100644 (file)
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -570,10 +570,12 @@ void avc_audit(u32 ssid, u32 tsid,
                case AVC_AUDIT_DATA_FS:
                        if (a->u.fs.dentry) {
                                struct dentry *dentry = a->u.fs.dentry;
-                               if (a->u.fs.mnt)
-                                       audit_avc_path(dentry, a->u.fs.mnt);
-                               audit_log_format(ab, " name=");
-                               audit_log_untrustedstring(ab, dentry->d_name.name);
+                               if (a->u.fs.mnt) {
+                                       audit_log_d_path(ab, "path=", dentry, a->u.fs.mnt);
+                               } else {
+                                       audit_log_format(ab, " name=");
+                                       audit_log_untrustedstring(ab, dentry->d_name.name);
+                               }
                                inode = dentry->d_inode;
                        } else if (a->u.fs.inode) {
                                struct dentry *dentry;
@@ -624,9 +626,8 @@ void avc_audit(u32 ssid, u32 tsid,
                                case AF_UNIX:
                                        u = unix_sk(sk);
                                        if (u->dentry) {
-                                               audit_avc_path(u->dentry, u->mnt);
-                                               audit_log_format(ab, " name=");
-                                               audit_log_untrustedstring(ab, u->dentry->d_name.name);
+                                               audit_log_d_path(ab, "path=",
+                                                                u->dentry, u->mnt);
                                                break;
                                        }
                                        if (!u->addr)