Re: [RFC PATCH ghak59 V1 5/6] audit: move EOE record after kill_trees for exit/free

The EOE record was being issued prior to the pruning of the killed_tree list. Move the EOE record creation out of audit_log_exit() and into its callers __audit_free() and __audit_syscall_exit() so that audit_kill_trees() can be called prior to the EOE record creation and any purged trees CONFIG_CHANGE records included in the syscall record event. See: https://github.com/linux-audit/audit-kernel/issues/50 See: https://github.com/linux-audit/audit-kernel/issues/59 Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; --- kernel/auditsc.c | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 2590c9e..d56aead 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1460,10 +1460,6 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts audit_log_proctitle(tsk, context); - /* Send end of event record to help user space know we are finished */ - ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE); - if (ab) - audit_log_end(ab); if (call_panic) audit_panic("error converting sid to string"); } @@ -1491,6 +1487,14 @@ void __audit_free(struct task_struct *tsk) audit_log_exit(context, tsk); if (!list_empty(&context->killed_trees)) audit_kill_trees(context); + if (context->in_syscall && context->current_state == AUDIT_RECORD_CONTEXT) { + struct audit_buffer *ab; + + /* Send end of event record to help user space know we are finished */ + ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE); + if (ab) + audit_log_end(ab); + } audit_free_context(context); } @@ -1572,13 +1576,19 @@ void __audit_syscall_exit(int success, long return_code) if (context->in_syscall && context->current_state == AUDIT_RECORD_CONTEXT) audit_log_exit(context, current); + if (!list_empty(&context->killed_trees)) + audit_kill_trees(context); + if (context->in_syscall && context->current_state == AUDIT_RECORD_CONTEXT) { + struct audit_buffer *ab; + /* Send end of event record to help user space know we are finished */ + ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE); + if (ab) + audit_log_end(ab); + } context->in_syscall = 0; context->prio = context->state == AUDIT_RECORD_CONTEXT ? ~0ULL : 0; - if (!list_empty(&context->killed_trees)) - audit_kill_trees(context); - audit_free_names(context); unroll_tree_refs(context, NULL, 0); audit_free_aux(context); -- 1.8.3.1