Add uid and comm collection to OBJ_PID records. This information was ask for by RHEL users who wanted a better idea where signals were ending up. Signed-off-by: Eric Paris <eparis(a)redhat.com&gt; --- #kill a program running as a different user in a different domain type=OBJ_PID msg=audit(12/10/2007 15:36:54.328:67) : opid=3018 obj=root:system_r:httpd_t:s0-s0:c0.c1023 uid=test comm=loop type=SYSCALL msg=audit(12/10/2007 15:36:54.328:67) : arch=x86_64 syscall=kill success=yes exit=0 a0=bca a1=f a2=0 a3=0 items=0 ppid=2189 pid=2194 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 comm=bash exe=/bin/bash subj=root:system_r:unconfined_t:s0-s0:c0.c1023 key=(null) ## custom program which fork() 2 children, puts them in a grp and kills the grp. type=OBJ_PID msg=audit(12/10/2007 15:29:59.969:38) : opid=2976 obj=root:system_r:unconfined_t:s0-s0:c0.c1023 uid=root comm=tmp type=OBJ_PID msg=audit(12/10/2007 15:29:59.969:38) : opid=2975 obj=root:system_r:unconfined_t:s0-s0:c0.c1023 uid=root comm=tmp type=SYSCALL msg=audit(12/10/2007 15:29:59.969:38) : arch=x86_64 syscall=kill success=yes exit=0 a0=fffff461 a1=9 a2=0 a3=0 items=0 ppid=2194 pid=2974 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 comm=tmp exe=/tmp/tmp subj=root:system_r:unconfined_t:s0-s0:c0.c1023 key=(null) kernel/auditsc.c | 21 ++++++++++++++++++--- 1 files changed, 18 insertions(+), 3 deletions(-) diff --git a/kernel/auditsc.c b/kernel/auditsc.c index bce9ecd..dcedbb0 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -176,7 +176,9 @@ struct audit_aux_data_fd_pair { struct audit_aux_data_pids { struct audit_aux_data d; pid_t target_pid[AUDIT_AUX_PIDS]; + pid_t target_uid[AUDIT_AUX_PIDS]; u32 target_sid[AUDIT_AUX_PIDS]; + char target_comm[AUDIT_AUX_PIDS][TASK_COMM_LEN]; int pid_count; }; @@ -215,7 +217,9 @@ struct audit_context { int arch; pid_t target_pid; + pid_t target_uid; u32 target_sid; + char target_comm[TASK_COMM_LEN]; struct audit_tree_refs *trees, *first_trees; int tree_count; @@ -922,7 +926,7 @@ static void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk } static int audit_log_pid_context(struct audit_context *context, pid_t pid, - u32 sid) + u32 sid, pid_t uid, char *comm) { struct audit_buffer *ab; char *s = NULL; @@ -938,6 +942,8 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid, rc = 1; } else audit_log_format(ab, "opid=%d obj=%s", pid, s); + audit_log_format(ab, " uid=%d comm=", uid); + audit_log_untrustedstring(ab, comm); audit_log_end(ab); kfree(s); @@ -1168,13 +1174,16 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts for (i = 0; i < axs->pid_count; i++) if (audit_log_pid_context(context, axs->target_pid[i], - axs->target_sid[i])) + axs->target_sid[i], + axs->target_uid[i], + axs->target_comm[i])) call_panic = 1; } if (context->target_pid && audit_log_pid_context(context, context->target_pid, - context->target_sid)) + context->target_sid, context->target_uid, + context->target_comm)) call_panic = 1; if (context->pwd && context->pwdmnt) { @@ -2194,6 +2203,8 @@ void __audit_ptrace(struct task_struct *t) context->target_pid = t->pid; selinux_get_task_sid(t, &context->target_sid); + memcpy(context->target_comm, t->comm, TASK_COMM_LEN); + context->target_uid = t->uid; } /** @@ -2231,6 +2242,8 @@ int __audit_signal_info(int sig, struct task_struct *t) if (!ctx->target_pid) { ctx->target_pid = t->tgid; selinux_get_task_sid(t, &ctx->target_sid); + memcpy(ctx->target_comm, t->comm, TASK_COMM_LEN); + ctx->target_uid = t->uid; return 0; } @@ -2248,6 +2261,8 @@ int __audit_signal_info(int sig, struct task_struct *t) axp->target_pid[axp->pid_count] = t->tgid; selinux_get_task_sid(t, &axp->target_sid[axp->pid_count]); + memcpy(axp->target_comm[axp->pid_count], t->comm, TASK_COMM_LEN); + axp->target_uid[axp->pid_count] = t->uid; axp->pid_count++; return 0;