Re: [PATCH] -V2 Allow ppid filtering on syscall auditing
On Thu, Sep 28, 2006 at 04:03:06PM -0400, Eric Paris wrote:
After some looking I did not see a way to get into audit_log_exit
without having set the ppid. So I am dropping the set from there and
only doing it at the beginning.
Please comment/ack/nak as soon as possible.
@@ -1116,6 +1115,7 @@ void audit_syscall_entry(int arch, int m
context->arch = arch;
context->major = major;
+ context->ppid = sys_getppid();
Ehh... That's one hell of an overhead to be had ;-/ How about this?
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index fb83c5c..fd77ce4 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -278,8 +278,11 @@ static int audit_filter_rules(struct tas
result = audit_comparator(tsk->pid, f->op, f->val);
break;
case AUDIT_PPID:
- if (ctx)
+ if (ctx) {
+ if (!ctx->ppid)
+ ctx->ppid = sys_getppid();
result = audit_comparator(ctx->ppid, f->op, f->val);
+ }
break;
case AUDIT_UID:
result = audit_comparator(tsk->uid, f->op, f->val);
@@ -795,7 +798,8 @@ static void audit_log_exit(struct audit_
/* tsk == current */
context->pid = tsk->pid;
- context->ppid = sys_getppid(); /* sic. tsk == current in all cases */
+ if (!context->ppid)
+ context->ppid = sys_getppid();
context->uid = tsk->uid;
context->gid = tsk->gid;
context->euid = tsk->euid;
@@ -1132,6 +1136,7 @@ #endif
context->ctime = CURRENT_TIME;
context->in_syscall = 1;
context->auditable = !!(state == AUDIT_RECORD_CONTEXT);
+ context->ppid = 0;
}
/**