On some devices, the cmdline and task info vary. For instance, on Android, the cmdline is set to the package name, and the task info is the name of the VM, which is not very helpful. The additional cmdline output only runs if the audit feature Signed-off-by: William Roberts <wroberts(a)tresys.com&gt; --- This will apply to Richard's tree on branch audit-for-next. This requires eparis's generic get/set patches. fs/proc/base.c | 2 +- include/linux/proc_fs.h | 1 + include/uapi/linux/audit.h | 4 +++- kernel/audit.c | 38 +++++++++++++++++++++++++++++++++++++- 4 files changed, 42 insertions(+), 3 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 03c8d74..cb1ba2f 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -200,7 +200,7 @@ static int proc_root_link(struct dentry *dentry, struct path *path) return result; } -static int proc_pid_cmdline(struct task_struct *task, char * buffer) +int proc_pid_cmdline(struct task_struct *task, char *buffer) { int res = 0; unsigned int len; diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h index 608e60a..2f386b3 100644 --- a/include/linux/proc_fs.h +++ b/include/linux/proc_fs.h @@ -41,6 +41,7 @@ extern void *proc_get_parent_data(const struct inode *); extern void proc_remove(struct proc_dir_entry *); extern void remove_proc_entry(const char *, struct proc_dir_entry *); extern int remove_proc_subtree(const char *, struct proc_dir_entry *); +extern int proc_pid_cmdline(struct task_struct *, char *); #else /* CONFIG_PROC_FS */ diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h index e2f0d99..5d77124 100644 --- a/include/uapi/linux/audit.h +++ b/include/uapi/linux/audit.h @@ -388,7 +388,9 @@ struct audit_features { #define AUDIT_FEATURE_ONLY_UNSET_LOGINUID 0 #define AUDIT_FEATURE_LOGINUID_IMMUTABLE 1 -#define AUDIT_LAST_FEATURE AUDIT_FEATURE_LOGINUID_IMMUTABLE +#define AUDIT_FEATURE_CMDLINE_OUTPUT 2 +#define AUDIT_LAST_FEATURE AUDIT_FEATURE_CMDLINE_OUTPUT + #define audit_feature_valid(x) ((x) >= 0 && (x) <= AUDIT_LAST_FEATURE) #define AUDIT_FEATURE_TO_MASK(x) (1 << ((x) & 31)) /* mask for __u32 */ diff --git a/kernel/audit.c b/kernel/audit.c index 8378c5e..bf4b1af 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -63,6 +63,7 @@ #include <linux/freezer.h> #include <linux/tty.h> #include <linux/pid_namespace.h> +#include <linux/proc_fs.h> #include "audit.h" @@ -144,9 +145,10 @@ static struct audit_features af = {.vers = AUDIT_FEATURE_VERSION, .features = 0, .lock = 0,}; -static char *audit_feature_names[2] = { +static char *audit_feature_names[3] = { "only_unset_loginuid", "loginuid_immutable", + "audit_output_cmdline", }; @@ -1691,6 +1693,39 @@ error_path: } EXPORT_SYMBOL(audit_log_task_context); +static void audit_log_add_cmdline(struct audit_buffer *ab, + struct task_struct *tsk) +{ + int len; + unsigned long page; + + /* Ensure that the feature is set */ + if (!is_audit_feature_set(AUDIT_FEATURE_CMDLINE_OUTPUT)) + return; + + /* Get the process cmdline */ + page = __get_free_page(GFP_TEMPORARY); + if (!page) + return; + + len = proc_pid_cmdline(tsk, (char *)page); + if (len <= 0) { + free_page(page); + return; + } + + /* + * Ensure NULL terminated! Application could + * could be using setproctitle(3). + */ + ((char *)page)[len-1] = '\0'; + + audit_log_format(ab, " cmdline="); + audit_log_untrustedstring(ab, (char *)page); + + free_page(page); +} + void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk) { const struct cred *cred; @@ -1739,6 +1774,7 @@ void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk) up_read(&mm->mmap_sem); } audit_log_task_context(ab); + audit_log_add_cmdline(ab, tsk); } EXPORT_SYMBOL(audit_log_task_info); -- 1.7.9.5