August 2007 - Linux-audit - Linux-Audit List Archives

[PATCH] audit=0 appears not to completely disable auditing

by Steve Grubb

Hi, There was a bz, 231371, reporting that current upstream kernels do not completely disable auditing when boot with audit=0 and the audit daemon not configured to run. You can reproduce the problem by: service auditd stop auditctl -e 0 auditctl -w /etc/passwd and you'd get an event in syslog: Mar 9 15:43:04 localhost kernel: audit(1173472984.321:982): auid=4294967295 subj=user_u:system_r:auditctl_t:s0 op=add rule key=(null) list=4 res=1 The patch below solves this problem by checking audit_enabled before creating an audit event. Signed-off-by: Steve Grubb <sgrubb(a)redhat.com> diff -urp linux-2.6.18.x86_64.orig/kernel/audit.c linux-2.6.18.x86_64/kernel/audit.c --- linux-2.6.18.x86_64.orig/kernel/audit.c 2007-03-09 14:08:18.000000000 -0500 +++ linux-2.6.18.x86_64/kernel/audit.c 2007-03-09 14:06:59.000000000 -0500 @@ -238,46 +238,50 @@ void audit_log_lost(const char *message) static int audit_set_rate_limit(int limit, uid_t loginuid, u32 sid) { - int old = audit_rate_limit; + if (audit_enabled) { + int old = audit_rate_limit; - if (sid) { - char *ctx = NULL; - u32 len; - int rc; - if ((rc = selinux_ctxid_to_string(sid, &ctx, &len))) - return rc; - else - audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, + if (sid) { + char *ctx = NULL; + u32 len; + int rc; + if ((rc = selinux_ctxid_to_string(sid, &ctx, &len))) + return rc; + else + audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, "audit_rate_limit=%d old=%d by auid=%u subj=%s", - limit, old, loginuid, ctx); - kfree(ctx); - } else - audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, - "audit_rate_limit=%d old=%d by auid=%u", - limit, old, loginuid); + limit, old, loginuid, ctx); + kfree(ctx); + } else + audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, + "audit_rate_limit=%d old=%d by auid=%u", + limit, old, loginuid); + } audit_rate_limit = limit; return 0; } static int audit_set_backlog_limit(int limit, uid_t loginuid, u32 sid) { - int old = audit_backlog_limit; + if (audit_enabled) { + int old = audit_backlog_limit; - if (sid) { - char *ctx = NULL; - u32 len; - int rc; - if ((rc = selinux_ctxid_to_string(sid, &ctx, &len))) - return rc; - else - audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, + if (sid) { + char *ctx = NULL; + u32 len; + int rc; + if ((rc = selinux_ctxid_to_string(sid, &ctx, &len))) + return rc; + else + audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, "audit_backlog_limit=%d old=%d by auid=%u subj=%s", - limit, old, loginuid, ctx); - kfree(ctx); - } else - audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, - "audit_backlog_limit=%d old=%d by auid=%u", - limit, old, loginuid); + limit, old, loginuid, ctx); + kfree(ctx); + } else + audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, + "audit_backlog_limit=%d old=%d by auid=%u", + limit, old, loginuid); + } audit_backlog_limit = limit; return 0; } @@ -289,21 +293,23 @@ static int audit_set_enabled(int state, if (state != 0 && state != 1) return -EINVAL; - if (sid) { - char *ctx = NULL; - u32 len; - int rc; - if ((rc = selinux_ctxid_to_string(sid, &ctx, &len))) - return rc; - else - audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, + if (audit_enabled || state) { + if (sid) { + char *ctx = NULL; + u32 len; + int rc; + if ((rc = selinux_ctxid_to_string(sid, &ctx, &len))) + return rc; + else + audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, "audit_enabled=%d old=%d by auid=%u subj=%s", - state, old, loginuid, ctx); - kfree(ctx); - } else - audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, - "audit_enabled=%d old=%d by auid=%u", - state, old, loginuid); + state, old, loginuid, ctx); + kfree(ctx); + } else + audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, + "audit_enabled=%d old=%d by auid=%u", + state, old, loginuid); + } audit_enabled = state; return 0; } @@ -317,21 +323,23 @@ static int audit_set_failure(int state, && state != AUDIT_FAIL_PANIC) return -EINVAL; - if (sid) { - char *ctx = NULL; - u32 len; - int rc; - if ((rc = selinux_ctxid_to_string(sid, &ctx, &len))) - return rc; - else - audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, + if (audit_enabled) { + if (sid) { + char *ctx = NULL; + u32 len; + int rc; + if ((rc = selinux_ctxid_to_string(sid, &ctx, &len))) + return rc; + else + audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, "audit_failure=%d old=%d by auid=%u subj=%s", - state, old, loginuid, ctx); - kfree(ctx); - } else - audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, - "audit_failure=%d old=%d by auid=%u", - state, old, loginuid); + state, old, loginuid, ctx); + kfree(ctx); + } else + audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, + "audit_failure=%d old=%d by auid=%u", + state, old, loginuid); + } audit_failure = state; return 0; } @@ -536,22 +544,26 @@ static int audit_receive_msg(struct sk_b if (err < 0) return err; } if (status_get->mask & AUDIT_STATUS_PID) { - int old = audit_pid; - if (sid) { - if ((err = selinux_ctxid_to_string( - sid, &ctx, &len))) - return err; - else + if (audit_enabled) { + int old = audit_pid; + if (sid) { + if ((err = selinux_ctxid_to_string( + sid, &ctx, &len))) + return err; + else + audit_log(NULL, GFP_KERNEL, + AUDIT_CONFIG_CHANGE, + "audit_pid=%d old=%d by auid=%u subj=%s", + status_get->pid, old, + loginuid, ctx); + kfree(ctx); + } else audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, - "audit_pid=%d old=%d by auid=%u subj=%s", - status_get->pid, old, - loginuid, ctx); - kfree(ctx); - } else - audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, "audit_pid=%d old=%d by auid=%u", - status_get->pid, old, loginuid); + status_get->pid, old, + loginuid); + } audit_pid = status_get->pid; } if (status_get->mask & AUDIT_STATUS_RATE_LIMIT) diff -urp linux-2.6.18.x86_64.orig/kernel/auditfilter.c linux-2.6.18.x86_64/kernel/auditfilter.c --- linux-2.6.18.x86_64.orig/kernel/auditfilter.c 2007-03-09 14:08:18.000000000 -0500 +++ linux-2.6.18.x86_64/kernel/auditfilter.c 2007-03-09 14:05:54.000000000 -0500 @@ -95,6 +95,8 @@ extern struct inotify_handle *audit_ih; /* Inotify events we care about. */ #define AUDIT_IN_WATCH IN_MOVE|IN_CREATE|IN_DELETE|IN_DELETE_SELF|IN_MOVE_SELF +extern int audit_enabled; + void audit_free_parent(struct inotify_watch *i_watch) { struct audit_parent *parent; @@ -897,7 +899,6 @@ static void audit_update_watch(struct au struct audit_watch *owatch, *nwatch, *nextw; struct audit_krule *r, *nextr; struct audit_entry *oentry, *nentry; - struct audit_buffer *ab; mutex_lock(&audit_filter_mutex); list_for_each_entry_safe(owatch, nextw, &parent->watches, wlist) { @@ -937,13 +938,18 @@ static void audit_update_watch(struct au call_rcu(&oentry->rcu, audit_free_rule_rcu); } - ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE); - audit_log_format(ab, "op=updated rules specifying path="); - audit_log_untrustedstring(ab, owatch->path); - audit_log_format(ab, " with dev=%u ino=%lu\n", dev, ino); - audit_log_format(ab, " list=%d res=1", r->listnr); - audit_log_end(ab); - + if (audit_enabled) { + struct audit_buffer *ab; + ab = audit_log_start(NULL, GFP_KERNEL, + AUDIT_CONFIG_CHANGE); + audit_log_format(ab, + "op=updated rules specifying path="); + audit_log_untrustedstring(ab, owatch->path); + audit_log_format(ab, " with dev=%u ino=%lu\n", + dev, ino); + audit_log_format(ab, " list=%d res=1", r->listnr); + audit_log_end(ab); + } audit_remove_watch(owatch); goto add_watch_to_parent; /* event applies to a single watch */ } @@ -962,25 +968,28 @@ static void audit_remove_parent_watches( struct audit_watch *w, *nextw; struct audit_krule *r, *nextr; struct audit_entry *e; - struct audit_buffer *ab; mutex_lock(&audit_filter_mutex); parent->flags |= AUDIT_PARENT_INVALID; list_for_each_entry_safe(w, nextw, &parent->watches, wlist) { list_for_each_entry_safe(r, nextr, &w->rules, rlist) { e = container_of(r, struct audit_entry, rule); - - ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE); - audit_log_format(ab, "op=remove rule path="); - audit_log_untrustedstring(ab, w->path); - if (r->filterkey) { - audit_log_format(ab, " key="); - audit_log_untrustedstring(ab, r->filterkey); - } else - audit_log_format(ab, " key=(null)"); - audit_log_format(ab, " list=%d res=1", r->listnr); - audit_log_end(ab); - + if (audit_enabled) { + struct audit_buffer *ab; + ab = audit_log_start(NULL, GFP_KERNEL, + AUDIT_CONFIG_CHANGE); + audit_log_format(ab, "op=remove rule path="); + audit_log_untrustedstring(ab, w->path); + if (r->filterkey) { + audit_log_format(ab, " key="); + audit_log_untrustedstring(ab, + r->filterkey); + } else + audit_log_format(ab, " key=(null)"); + audit_log_format(ab, " list=%d res=1", + r->listnr); + audit_log_end(ab); + } list_del(&r->rlist); list_del_rcu(&e->list); call_rcu(&e->rcu, audit_free_rule_rcu); @@ -1409,6 +1418,9 @@ static void audit_log_rule_change(uid_t { struct audit_buffer *ab; + if (!audit_enabled) + return; + ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE); if (!ab) return;

17 years, 11 months

4
5
0 / 0

Why aren't SYSCALLS being logged in CentOS kernel (any ideas?)

by Robert Evans

Hi, I'm using CentOS, kernel 2.6.18-8.el5. I've compiled audit-1.5.6-1 and I'm getting USER_AUTH events (logins, su, etc...) but I'm not seeing any syscall events. My test audit.rules works fine in RHEL4, Suse10 and Fedora, but doesn't seem to generate any syscall events in CentOS 5. For testing purposes, I'm using the following in audit.rules: # Log execute failures -a exit,always -S execve -F success!=1 -F exit!=-2 -F exit!=-20 -F exit!=-17 -F exit!=-6 # Log administrative functions -a exit,always -S reboot -S clock_settime -S settimeofday -S adjtimex -S setdomainname -S sethostname -S reboot -S mount -S umount2 -a exit,always -S swapon -S swapoff -S create_module -S delete_module -S quotactl -F success!=1 # Log Read/Write functions -a exit,always -S open -S creat -S link -S symlink -S truncate -S ftruncate -S mknod -S rename -F success!=1 -F exit!=-2 -F exit!=-20 -F exit!=-17 -F exit!=-6 # Log file removal failures -a exit,always -S unlink -S rmdir -F success!=1 -F exit!=-2 -F exit!=-20 -F exit!=-17 -F exit!=-6 # Log file modification failures -a exit,always -S chmod -S chown -S lchown -S fchmod -S fchown -F success!=1 -F exit!=-2 -F exit!=-20 -F exit!=-17 -F exit!=-6 # Add watches for reboot stuff... -w /sbin/init -p x -k runlevel -w /sbin/telinit -p x -k runlevel -w /sbin/halt -p x -k runlevel -w /sbin/poweroff -p x -k runlevel -w /sbin/reboot -p x -k runlevel -w /sbin/shutdown -p x -k runlevel Any ideas? Bob

18 years

2
4
0 / 0

[PATCH][RFC] V3 Remove SELinux dependencies from linux-audit via LSM

by Casey Schaufler

From: Casey Schaufler <casey(a)schaufler-ca.com> This patch interposes LSM interfaces between the audit system and SELinux. This helps make SELinux a cleaner LSM and clarifies the interfaces provided by the audit system. The audit system no longer requires SELinux functions or data structures, making it available for use by other LSMs. The audit system interfaces should now be useful to any LSM that can provide secids and text string representations that match them. The audit system uses secids only to map to those strings and treats them as opaque data otherwise. Audit rule information that is specific to an LSM is maintained through a void *. The SELinux code uses LSM interfaces to access the audit system, with the exception of audit_rule_update_callout(), which is intended to be called at the descretion of an LSM to update the LSM specific rules. The LSM interface includes six new entries, four for audit and two that supply secids from the LSM to networking and audit subsystems. Also, there were several cases where SELinux code was being called where LSM interfaces were more appropriate. These uses have been repaired and the SELinux interfaces are no longer exported. These changes expose the secid as an LSM interface. SELinux already uses secids. Other LSMs that expect to interface with audit, xfrm, and USB will have to support the notion of secids. Smack has been adjusted to support this scheme. This patch is relative to 2.6.23-rc4. It will not apply to 2.6.22. Signed-off-by: Casey Schaufler <casey(a)schaufler-ca.com> --- I have approached the elimination of secids from three different directions and while I would accept the changes required I would not expect all parties to buy into them because of the code disruption. The approach I am putting forward has the advantage of directly addressing the issue at hand, which is to make it possible for an LSM that is not SELinux to use the audit system. As I've suggested elsewhere, maybe cleaning up the LSM interface is a task for Linux 3.0. include/linux/audit.h | 55 +++++++++- include/linux/security.h | 113 +++++++++++++++++++++ include/linux/selinux.h | 138 -------------------------- kernel/audit.c | 43 +++----- kernel/audit.h | 41 ------- kernel/auditfilter.c | 70 ++++--------- kernel/auditsc.c | 45 ++++---- net/netlink/af_netlink.c | 3 security/selinux/exports.c | 42 ------- security/selinux/hooks.c | 51 +++++++++ security/selinux/include/security.h | 38 +++++++ security/selinux/ss/services.c | 19 +-- 12 files changed, 323 insertions(+), 335 deletions(-) diff -uprN -X linux-2.6.23-rc4-base/Documentation/dontdiff linux-2.6.23-rc4-base/include/linux/audit.h linux-2.6.23-rc4-audit/include/linux/audit.h --- linux-2.6.23-rc4-base/include/linux/audit.h 2007-08-26 23:51:46.000000000 -0700 +++ linux-2.6.23-rc4-audit/include/linux/audit.h 2007-08-27 00:52:10.000000000 -0700 @@ -333,20 +333,63 @@ struct audit_rule { /* for AUDIT_LIST, #ifdef __KERNEL__ #include <linux/sched.h> -struct audit_sig_info { - uid_t uid; - pid_t pid; - char ctx[0]; -}; - struct audit_buffer; struct audit_context; +struct audit_parent; struct inode; struct netlink_skb_parms; struct linux_binprm; struct mq_attr; struct mqstat; +struct audit_sig_info { + uid_t uid; + pid_t pid; + char ctx[0]; +}; + +struct audit_watch { + atomic_t count; /* reference count */ + char *path; /* insertion path */ + dev_t dev; /* associated superblock device */ + unsigned long ino; /* associated inode number */ + struct audit_parent *parent; /* associated parent */ + struct list_head wlist; /* entry in parent->watches list */ + struct list_head rules; /* associated rules */ +}; + +struct audit_field { + u32 type; + u32 val; + u32 op; + char *se_str; + void *se_rule; +}; + +struct audit_krule { + int vers_ops; + u32 flags; + u32 listnr; + u32 action; + u32 mask[AUDIT_BITMASK_SIZE]; + u32 buflen; /* for data alloc on list rules */ + u32 field_count; + char *filterkey; /* ties events to rules */ + struct audit_field *fields; + struct audit_field *arch_f; /* quick access to arch field */ + struct audit_field *inode_f; /* quick access to an inode field */ + struct audit_watch *watch; /* associated watch */ + struct list_head rlist; /* entry in audit_watch.rules list */ +}; + +struct audit_entry { + struct list_head list; + struct rcu_head rcu; + struct audit_krule rule; +}; + +extern int audit_rule_update_callout(void); + #define AUDITSC_INVALID 0 #define AUDITSC_SUCCESS 1 #define AUDITSC_FAILURE 2 diff -uprN -X linux-2.6.23-rc4-base/Documentation/dontdiff linux-2.6.23-rc4-base/include/linux/security.h linux-2.6.23-rc4-audit/include/linux/security.h --- linux-2.6.23-rc4-base/include/linux/security.h 2007-08-26 23:51:46.000000000 -0700 +++ linux-2.6.23-rc4-audit/include/linux/security.h 2007-08-29 20:24:19.000000000 -0700 @@ -35,6 +35,7 @@ #include <net/flow.h> struct ctl_table; +struct audit_krule; /* * These functions are in security/capability.c and are used @@ -1138,6 +1139,8 @@ struct request_sock; * @name contains the name of the security module being unstacked. * @ops contains a pointer to the struct security_operations of the module to unstack. * + * Hooks for the export of secids + * * @secid_to_secctx: * Convert secid to security context. * @secid contains the security ID. @@ -1148,6 +1151,38 @@ struct request_sock; * @secdata contains the security context. * @seclen contains the length of the security context. * + * @inode_getsecid: + * get the secid associated with the inode + * @inode contains a pointer to the inode + * @secid contains a pointer to the location to store the result + * + * @ipc_getsecid: + * get the secid associated with the ipc object + * @inode contains a pointer to the ipc object + * @secid contains a pointer to the location to store the result + * + * Security hooks for the audit system + * + * @audit_rule_supplied: + * identify audit rules interesting to this LSM + * @rule contains a pointer to the rule in question + * @audit_rule_match: + * checks if the LSM would have a record generated + * @sid contains the secid in question + * @field contains what to check + * @op contains the operation + * @rule contains a pointer to the audit rule + * @actx contains a pointer to the audit context + * @audit_rule_init: + * establish an audit rule + * @field contains the action of interest + * @op contains the operation + * @rulestr contains a pointer to the rule string + * @rule contains a pointer to receive the result + * @audit_rule_free: + * reclaim the rule + * @rule the data to free + * * This is the main security structure. */ struct security_operations { @@ -1331,6 +1366,14 @@ struct security_operations { int (*setprocattr)(struct task_struct *p, char *name, void *value, size_t size); int (*secid_to_secctx)(u32 secid, char **secdata, u32 *seclen); void (*release_secctx)(char *secdata, u32 seclen); + void (*inode_getsecid) (const struct inode *inode, u32 *secid); + void (*ipc_getsecid) (const struct kern_ipc_perm *p, u32 *secid); + int (*audit_rule_supplied) (struct audit_krule *rule); + int (*audit_rule_match) (u32 sid, u32 field, u32 op, void *rule, + struct audit_context *actx); + int (*audit_rule_init) (u32 field, u32 op, char *rulestr, void **rule); + void (*audit_rule_free) (void *rule); + #ifdef CONFIG_SECURITY_NETWORK int (*unix_stream_connect) (struct socket * sock, @@ -2132,6 +2175,43 @@ static inline void security_release_secc return security_ops->release_secctx(secdata, seclen); } +static inline void security_inode_getsecid(const struct inode *inode, + u32 *secid) +{ + security_ops->inode_getsecid(inode, secid); + return; +} + +static inline void security_ipc_getsecid(struct kern_ipc_perm *p, u32 *secid) +{ + security_ops->ipc_getsecid(p, secid); + return; +} + +static inline int security_audit_rule_supplied(struct audit_krule *rule) +{ + return security_ops->audit_rule_supplied(rule); +} + +static inline int security_audit_rule_match(u32 sid, u32 field, u32 op, + void *rule, + struct audit_context *actx) +{ + return security_ops->audit_rule_match(sid, field, op, rule, actx); +} + +static inline int security_audit_rule_init(u32 field, u32 op, char *rulestr, + void **rule) +{ + return security_ops->audit_rule_init(field, op, rulestr, rule); +} + +static inline void security_audit_rule_free(void *rule) +{ + security_ops->audit_rule_free(rule); + return; +} + /* prototypes */ extern int security_init (void); extern int register_security (struct security_operations *ops); @@ -2813,6 +2893,39 @@ static inline int security_secid_to_secc static inline void security_release_secctx(char *secdata, u32 seclen) { } + +static inline void security_inode_getsecid(const struct inode *inode, + u32 *secid); +{ +} + +static inline void security_ipc_getsecid(struct kern_ipc_perm *p, u32 *secid) +{ +} + +static inline int security_audit_rule_supplied(struct audit_krule *rule) +{ + return 0; +} + +static inline int security_audit_rule_match(u32 sid, u32 field, u32 op, + void *rule, + struct audit_context *actx) +{ + return; +} + +static inline int security_audit_rule_init(u32 field, u32 op, char *rulestr, + void **rule) +{ + return 0; +} + +static inline void security_audit_rule_free(void *rule) +{ + return; +} + #endif /* CONFIG_SECURITY */ #ifdef CONFIG_SECURITY_NETWORK diff -uprN -X linux-2.6.23-rc4-base/Documentation/dontdiff linux-2.6.23-rc4-base/include/linux/selinux.h linux-2.6.23-rc4-audit/include/linux/selinux.h --- linux-2.6.23-rc4-base/include/linux/selinux.h 2007-07-08 16:32:17.000000000 -0700 +++ linux-2.6.23-rc4-audit/include/linux/selinux.h 2007-08-27 00:52:10.000000000 -0700 @@ -14,101 +14,9 @@ #ifndef _LINUX_SELINUX_H #define _LINUX_SELINUX_H -struct selinux_audit_rule; -struct audit_context; -struct inode; -struct kern_ipc_perm; - #ifdef CONFIG_SECURITY_SELINUX /** - * selinux_audit_rule_init - alloc/init an selinux audit rule structure. - * @field: the field this rule refers to - * @op: the operater the rule uses - * @rulestr: the text "target" of the rule - * @rule: pointer to the new rule structure returned via this - * - * Returns 0 if successful, -errno if not. On success, the rule structure - * will be allocated internally. The caller must free this structure with - * selinux_audit_rule_free() after use. - */ -int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, - struct selinux_audit_rule **rule); - -/** - * selinux_audit_rule_free - free an selinux audit rule structure. - * @rule: pointer to the audit rule to be freed - * - * This will free all memory associated with the given rule. - * If @rule is NULL, no operation is performed. - */ -void selinux_audit_rule_free(struct selinux_audit_rule *rule); - -/** - * selinux_audit_rule_match - determine if a context ID matches a rule. - * @sid: the context ID to check - * @field: the field this rule refers to - * @op: the operater the rule uses - * @rule: pointer to the audit rule to check against - * @actx: the audit context (can be NULL) associated with the check - * - * Returns 1 if the context id matches the rule, 0 if it does not, and - * -errno on failure. - */ -int selinux_audit_rule_match(u32 sid, u32 field, u32 op, - struct selinux_audit_rule *rule, - struct audit_context *actx); - -/** - * selinux_audit_set_callback - set the callback for policy reloads. - * @callback: the function to call when the policy is reloaded - * - * This sets the function callback function that will update the rules - * upon policy reloads. This callback should rebuild all existing rules - * using selinux_audit_rule_init(). - */ -void selinux_audit_set_callback(int (*callback)(void)); - -/** - * selinux_sid_to_string - map a security context ID to a string - * @sid: security context ID to be converted. - * @ctx: address of context string to be returned - * @ctxlen: length of returned context string. - * - * Returns 0 if successful, -errno if not. On success, the context - * string will be allocated internally, and the caller must call - * kfree() on it after use. - */ -int selinux_sid_to_string(u32 sid, char **ctx, u32 *ctxlen); - -/** - * selinux_get_inode_sid - get the inode's security context ID - * @inode: inode structure to get the sid from. - * @sid: pointer to security context ID to be filled in. - * - * Returns nothing - */ -void selinux_get_inode_sid(const struct inode *inode, u32 *sid); - -/** - * selinux_get_ipc_sid - get the ipc security context ID - * @ipcp: ipc structure to get the sid from. - * @sid: pointer to security context ID to be filled in. - * - * Returns nothing - */ -void selinux_get_ipc_sid(const struct kern_ipc_perm *ipcp, u32 *sid); - -/** - * selinux_get_task_sid - return the SID of task - * @tsk: the task whose SID will be returned - * @sid: pointer to security context ID to be filled in. - * - * Returns nothing - */ -void selinux_get_task_sid(struct task_struct *tsk, u32 *sid); - -/** * selinux_string_to_sid - map a security context string to a security ID * @str: the security context string to be mapped * @sid: ID value returned via this. @@ -132,52 +40,6 @@ int selinux_relabel_packet_permission(u3 #else -static inline int selinux_audit_rule_init(u32 field, u32 op, - char *rulestr, - struct selinux_audit_rule **rule) -{ - return -ENOTSUPP; -} - -static inline void selinux_audit_rule_free(struct selinux_audit_rule *rule) -{ - return; -} - -static inline int selinux_audit_rule_match(u32 sid, u32 field, u32 op, - struct selinux_audit_rule *rule, - struct audit_context *actx) -{ - return 0; -} - -static inline void selinux_audit_set_callback(int (*callback)(void)) -{ - return; -} - -static inline int selinux_sid_to_string(u32 sid, char **ctx, u32 *ctxlen) -{ - *ctx = NULL; - *ctxlen = 0; - return 0; -} - -static inline void selinux_get_inode_sid(const struct inode *inode, u32 *sid) -{ - *sid = 0; -} - -static inline void selinux_get_ipc_sid(const struct kern_ipc_perm *ipcp, u32 *sid) -{ - *sid = 0; -} - -static inline void selinux_get_task_sid(struct task_struct *tsk, u32 *sid) -{ - *sid = 0; -} - static inline int selinux_string_to_sid(const char *str, u32 *sid) { *sid = 0; diff -uprN -X linux-2.6.23-rc4-base/Documentation/dontdiff linux-2.6.23-rc4-base/kernel/audit.c linux-2.6.23-rc4-audit/kernel/audit.c --- linux-2.6.23-rc4-base/kernel/audit.c 2007-08-26 23:51:47.000000000 -0700 +++ linux-2.6.23-rc4-audit/kernel/audit.c 2007-08-27 00:52:10.000000000 -0700 @@ -55,7 +55,6 @@ #include <net/netlink.h> #include <linux/skbuff.h> #include <linux/netlink.h> -#include <linux/selinux.h> #include <linux/inotify.h> #include <linux/freezer.h> #include <linux/tty.h> @@ -253,12 +252,12 @@ static int audit_set_rate_limit(int limi if (sid) { char *ctx = NULL; u32 len; - if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) { + if ((rc = security_secid_to_secctx(sid, &ctx, &len)) == 0) { audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, "audit_rate_limit=%d old=%d by auid=%u" " subj=%s res=%d", limit, old, loginuid, ctx, res); - kfree(ctx); + security_release_secctx(ctx, len); } else res = 0; /* Something weird, deny request */ } @@ -288,12 +287,12 @@ static int audit_set_backlog_limit(int l if (sid) { char *ctx = NULL; u32 len; - if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) { + if ((rc = security_secid_to_secctx(sid, &ctx, &len)) == 0) { audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, "audit_backlog_limit=%d old=%d by auid=%u" " subj=%s res=%d", limit, old, loginuid, ctx, res); - kfree(ctx); + security_release_secctx(ctx, len); } else res = 0; /* Something weird, deny request */ } @@ -326,12 +325,12 @@ static int audit_set_enabled(int state, if (sid) { char *ctx = NULL; u32 len; - if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) { + if ((rc = security_secid_to_secctx(sid, &ctx, &len)) == 0) { audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, "audit_enabled=%d old=%d by auid=%u" " subj=%s res=%d", state, old, loginuid, ctx, res); - kfree(ctx); + security_release_secctx(ctx, len); } else res = 0; /* Something weird, deny request */ } @@ -366,12 +365,12 @@ static int audit_set_failure(int state, if (sid) { char *ctx = NULL; u32 len; - if ((rc = selinux_sid_to_string(sid, &ctx, &len)) == 0) { + if ((rc = security_secid_to_secctx(sid, &ctx, &len)) == 0) { audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, "audit_failure=%d old=%d by auid=%u" " subj=%s res=%d", state, old, loginuid, ctx, res); - kfree(ctx); + security_release_secctx(ctx, len); } else res = 0; /* Something weird, deny request */ } @@ -619,7 +618,7 @@ static int audit_receive_msg(struct sk_b if (status_get->mask & AUDIT_STATUS_PID) { int old = audit_pid; if (sid) { - if ((err = selinux_sid_to_string( + if ((err = security_secid_to_secctx( sid, &ctx, &len))) return err; else @@ -628,7 +627,7 @@ static int audit_receive_msg(struct sk_b "audit_pid=%d old=%d by auid=%u subj=%s", status_get->pid, old, loginuid, ctx); - kfree(ctx); + security_release_secctx(ctx, len); } else audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, "audit_pid=%d old=%d by auid=%u", @@ -662,7 +661,7 @@ static int audit_receive_msg(struct sk_b "user pid=%d uid=%u auid=%u", pid, uid, loginuid); if (sid) { - if (selinux_sid_to_string( + if (security_secid_to_secctx( sid, &ctx, &len)) { audit_log_format(ab, " ssid=%u", sid); @@ -670,7 +669,7 @@ static int audit_receive_msg(struct sk_b } else audit_log_format(ab, " subj=%s", ctx); - kfree(ctx); + security_release_secctx(ctx, len); } if (msg_type != AUDIT_USER_TTY) audit_log_format(ab, " msg='%.1024s'", @@ -700,7 +699,7 @@ static int audit_receive_msg(struct sk_b "pid=%d uid=%u auid=%u", pid, uid, loginuid); if (sid) { - if (selinux_sid_to_string( + if (security_secid_to_secctx( sid, &ctx, &len)) { audit_log_format(ab, " ssid=%u", sid); @@ -708,7 +707,7 @@ static int audit_receive_msg(struct sk_b } else audit_log_format(ab, " subj=%s", ctx); - kfree(ctx); + security_release_secctx(ctx, len); } audit_log_format(ab, " audit_enabled=%d res=0", audit_enabled); @@ -734,7 +733,7 @@ static int audit_receive_msg(struct sk_b "pid=%d uid=%u auid=%u", pid, uid, loginuid); if (sid) { - if (selinux_sid_to_string( + if (security_secid_to_secctx( sid, &ctx, &len)) { audit_log_format(ab, " ssid=%u", sid); @@ -742,7 +741,7 @@ static int audit_receive_msg(struct sk_b } else audit_log_format(ab, " subj=%s", ctx); - kfree(ctx); + security_release_secctx(ctx, len); } audit_log_format(ab, " audit_enabled=%d res=0", audit_enabled); @@ -757,18 +756,18 @@ static int audit_receive_msg(struct sk_b loginuid, sid); break; case AUDIT_SIGNAL_INFO: - err = selinux_sid_to_string(audit_sig_sid, &ctx, &len); + err = security_secid_to_secctx(audit_sig_sid, &ctx, &len); if (err) return err; sig_data = kmalloc(sizeof(*sig_data) + len, GFP_KERNEL); if (!sig_data) { - kfree(ctx); + security_release_secctx(ctx, len); return -ENOMEM; } sig_data->uid = audit_sig_uid; sig_data->pid = audit_sig_pid; memcpy(sig_data->ctx, ctx, len); - kfree(ctx); + security_release_secctx(ctx, len); audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_SIGNAL_INFO, 0, 0, sig_data, sizeof(*sig_data) + len); kfree(sig_data); @@ -887,10 +886,6 @@ static int __init audit_init(void) audit_initialized = 1; audit_enabled = audit_default; - /* Register the callback with selinux. This callback will be invoked - * when a new policy is loaded. */ - selinux_audit_set_callback(&selinux_audit_rule_update); - audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized"); #ifdef CONFIG_AUDITSYSCALL diff -uprN -X linux-2.6.23-rc4-base/Documentation/dontdiff linux-2.6.23-rc4-base/kernel/auditfilter.c linux-2.6.23-rc4-audit/kernel/auditfilter.c --- linux-2.6.23-rc4-base/kernel/auditfilter.c 2007-08-26 23:51:47.000000000 -0700 +++ linux-2.6.23-rc4-audit/kernel/auditfilter.c 2007-08-27 00:52:10.000000000 -0700 @@ -28,7 +28,7 @@ #include <linux/netlink.h> #include <linux/sched.h> #include <linux/inotify.h> -#include <linux/selinux.h> +#include <linux/security.h> #include "audit.h" /* @@ -38,7 +38,7 @@ * Synchronizes writes and blocking reads of audit's filterlist * data. Rcu is used to traverse the filterlist and access * contents of structs audit_entry, audit_watch and opaque - * selinux rules during filtering. If modified, these structures + * LSM rules during filtering. If modified, these structures * must be copied and replace their counterparts in the filterlist. * An audit_parent struct is not accessed during filtering, so may * be written directly provided audit_filter_mutex is held. @@ -138,7 +138,7 @@ static inline void audit_free_rule(struc for (i = 0; i < e->rule.field_count; i++) { struct audit_field *f = &e->rule.fields[i]; kfree(f->se_str); - selinux_audit_rule_free(f->se_rule); + security_audit_rule_free(f->se_rule); } kfree(e->rule.fields); kfree(e->rule.filterkey); @@ -595,12 +595,12 @@ static struct audit_entry *audit_data_to goto exit_free; entry->rule.buflen += f->val; - err = selinux_audit_rule_init(f->type, f->op, str, + err = security_audit_rule_init(f->type, f->op, str, &f->se_rule); /* Keep currently invalid fields around in case they * become valid after a policy reload. */ if (err == -EINVAL) { - printk(KERN_WARNING "audit rule for selinux " + printk(KERN_WARNING "audit rule for LSM " "\'%s\' is invalid\n", str); err = 0; } @@ -839,10 +839,10 @@ out: return new; } -/* Duplicate selinux field information. The se_rule is opaque, so must be - * re-initialized. */ -static inline int audit_dupe_selinux_field(struct audit_field *df, - struct audit_field *sf) +/* Duplicate security module field information. + * The se_rule is opaque, so must be re-initialized. */ +static inline int audit_dupe_security_field(struct audit_field *df, + struct audit_field *sf) { int ret = 0; char *se_str; @@ -854,12 +854,12 @@ static inline int audit_dupe_selinux_fie df->se_str = se_str; /* our own (refreshed) copy of se_rule */ - ret = selinux_audit_rule_init(df->type, df->op, df->se_str, - &df->se_rule); + ret = security_audit_rule_init(df->type, df->op, df->se_str, + &df->se_rule); /* Keep currently invalid fields around in case they * become valid after a policy reload. */ if (ret == -EINVAL) { - printk(KERN_WARNING "audit rule for selinux \'%s\' is " + printk(KERN_WARNING "audit rule for LSM \'%s\' is " "invalid\n", df->se_str); ret = 0; } @@ -868,7 +868,7 @@ static inline int audit_dupe_selinux_fie } /* Duplicate an audit rule. This will be a deep copy with the exception - * of the watch - that pointer is carried over. The selinux specific fields + * of the watch - that pointer is carried over. The LSM specific fields * will be updated in the copy. The point is to be able to replace the old * rule with the new rule in the filterlist, then free the old rule. * The rlist element is undefined; list manipulations are handled apart from @@ -913,8 +913,8 @@ static struct audit_entry *audit_dupe_ru case AUDIT_OBJ_TYPE: case AUDIT_OBJ_LEV_LOW: case AUDIT_OBJ_LEV_HIGH: - err = audit_dupe_selinux_field(&new->fields[i], - &old->fields[i]); + err = audit_dupe_security_field(&new->fields[i], + &old->fields[i]); break; case AUDIT_FILTERKEY: fk = kstrdup(old->filterkey, GFP_KERNEL); @@ -1456,11 +1456,11 @@ static void audit_log_rule_change(uid_t if (sid) { char *ctx = NULL; u32 len; - if (selinux_sid_to_string(sid, &ctx, &len)) + if (security_secid_to_secctx(sid, &ctx, &len)) audit_log_format(ab, " ssid=%u", sid); else audit_log_format(ab, " subj=%s", ctx); - kfree(ctx); + security_release_secctx(ctx, len); } audit_log_format(ab, " op=%s rule key=", action); if (rule->filterkey) @@ -1702,38 +1702,12 @@ unlock_and_return: return result; } -/* Check to see if the rule contains any selinux fields. Returns 1 if there - are selinux fields specified in the rule, 0 otherwise. */ -static inline int audit_rule_has_selinux(struct audit_krule *rule) -{ - int i; - - for (i = 0; i < rule->field_count; i++) { - struct audit_field *f = &rule->fields[i]; - switch (f->type) { - case AUDIT_SUBJ_USER: - case AUDIT_SUBJ_ROLE: - case AUDIT_SUBJ_TYPE: - case AUDIT_SUBJ_SEN: - case AUDIT_SUBJ_CLR: - case AUDIT_OBJ_USER: - case AUDIT_OBJ_ROLE: - case AUDIT_OBJ_TYPE: - case AUDIT_OBJ_LEV_LOW: - case AUDIT_OBJ_LEV_HIGH: - return 1; - } - } - - return 0; -} - /* This function will re-initialize the se_rule field of all applicable rules. - * It will traverse the filter lists serarching for rules that contain selinux + * It will traverse the filter lists serarching for rules that contain LSM * specific filter fields. When such a rule is found, it is copied, the - * selinux field is re-initialized, and the old rule is replaced with the + * LSM field is re-initialized, and the old rule is replaced with the * updated rule. */ -int selinux_audit_rule_update(void) +int audit_rule_update_callout(void) { struct audit_entry *entry, *n, *nentry; struct audit_watch *watch; @@ -1744,7 +1718,7 @@ int selinux_audit_rule_update(void) for (i = 0; i < AUDIT_NR_FILTERS; i++) { list_for_each_entry_safe(entry, n, &audit_filter_list[i], list) { - if (!audit_rule_has_selinux(&entry->rule)) + if (!security_audit_rule_supplied(&entry->rule)) continue; watch = entry->rule.watch; @@ -1754,7 +1728,7 @@ int selinux_audit_rule_update(void) * return value */ if (!err) err = PTR_ERR(nentry); - audit_panic("error updating selinux filters"); + audit_panic("error updating LSM filters"); if (watch) list_del(&entry->rule.rlist); list_del_rcu(&entry->list); diff -uprN -X linux-2.6.23-rc4-base/Documentation/dontdiff linux-2.6.23-rc4-base/kernel/audit.h linux-2.6.23-rc4-audit/kernel/audit.h --- linux-2.6.23-rc4-base/kernel/audit.h 2007-08-26 23:51:47.000000000 -0700 +++ linux-2.6.23-rc4-audit/kernel/audit.h 2007-08-27 00:52:10.000000000 -0700 @@ -55,46 +55,6 @@ enum audit_state { /* Rule lists */ struct audit_parent; -struct audit_watch { - atomic_t count; /* reference count */ - char *path; /* insertion path */ - dev_t dev; /* associated superblock device */ - unsigned long ino; /* associated inode number */ - struct audit_parent *parent; /* associated parent */ - struct list_head wlist; /* entry in parent->watches list */ - struct list_head rules; /* associated rules */ -}; - -struct audit_field { - u32 type; - u32 val; - u32 op; - char *se_str; - struct selinux_audit_rule *se_rule; -}; - -struct audit_krule { - int vers_ops; - u32 flags; - u32 listnr; - u32 action; - u32 mask[AUDIT_BITMASK_SIZE]; - u32 buflen; /* for data alloc on list rules */ - u32 field_count; - char *filterkey; /* ties events to rules */ - struct audit_field *fields; - struct audit_field *arch_f; /* quick access to arch field */ - struct audit_field *inode_f; /* quick access to an inode field */ - struct audit_watch *watch; /* associated watch */ - struct list_head rlist; /* entry in audit_watch.rules list */ -}; - -struct audit_entry { - struct list_head list; - struct rcu_head rcu; - struct audit_krule rule; -}; - extern int audit_pid; #define AUDIT_INODE_BUCKETS 32 @@ -128,7 +88,6 @@ struct inotify_watch; extern void audit_free_parent(struct inotify_watch *); extern void audit_handle_ievent(struct inotify_watch *, u32, u32, u32, const char *, struct inode *); -extern int selinux_audit_rule_update(void); #ifdef CONFIG_AUDITSYSCALL extern int __audit_signal_info(int sig, struct task_struct *t); diff -uprN -X linux-2.6.23-rc4-base/Documentation/dontdiff linux-2.6.23-rc4-base/kernel/auditsc.c linux-2.6.23-rc4-audit/kernel/auditsc.c --- linux-2.6.23-rc4-base/kernel/auditsc.c 2007-08-26 23:51:47.000000000 -0700 +++ linux-2.6.23-rc4-audit/kernel/auditsc.c 2007-08-27 00:52:10.000000000 -0700 @@ -62,7 +62,6 @@ #include <linux/security.h> #include <linux/list.h> #include <linux/tty.h> -#include <linux/selinux.h> #include <linux/binfmts.h> #include <linux/highmem.h> #include <linux/syscalls.h> @@ -397,10 +396,10 @@ static int audit_filter_rules(struct tas logged upon error */ if (f->se_rule) { if (need_sid) { - selinux_get_task_sid(tsk, &sid); + security_task_getsecid(tsk, &sid); need_sid = 0; } - result = selinux_audit_rule_match(sid, f->type, + result = security_audit_rule_match(sid, f->type, f->op, f->se_rule, ctx); @@ -416,12 +415,12 @@ static int audit_filter_rules(struct tas if (f->se_rule) { /* Find files that match */ if (name) { - result = selinux_audit_rule_match( + result = security_audit_rule_match( name->osid, f->type, f->op, f->se_rule, ctx); } else if (ctx) { for (j = 0; j < ctx->name_count; j++) { - if (selinux_audit_rule_match( + if (security_audit_rule_match( ctx->names[j].osid, f->type, f->op, f->se_rule, ctx)) { @@ -437,7 +436,7 @@ static int audit_filter_rules(struct tas aux = aux->next) { if (aux->type == AUDIT_IPC) { struct audit_aux_data_ipcctl *axi = (void *)aux; - if (selinux_audit_rule_match(axi->osid, f->type, f->op, f->se_rule, ctx)) { + if (security_audit_rule_match(axi->osid, f->type, f->op, f->se_rule, ctx)) { ++result; break; } @@ -744,11 +743,11 @@ void audit_log_task_context(struct audit int error; u32 sid; - selinux_get_task_sid(current, &sid); + security_task_getsecid(current, &sid); if (!sid) return; - error = selinux_sid_to_string(sid, &ctx, &len); + error = security_secid_to_secctx(sid, &ctx, &len); if (error) { if (error != -EINVAL) goto error_path; @@ -756,7 +755,7 @@ void audit_log_task_context(struct audit } audit_log_format(ab, " subj=%s", ctx); - kfree(ctx); + security_release_secctx(ctx, len); return; error_path: @@ -808,7 +807,7 @@ static int audit_log_pid_context(struct if (!ab) return 1; - if (selinux_sid_to_string(sid, &s, &len)) { + if (security_secid_to_secctx(sid, &s, &len)) { audit_log_format(ab, "opid=%d obj=(none)", pid); rc = 1; } else @@ -990,14 +989,14 @@ static void audit_log_exit(struct audit_ if (axi->osid != 0) { char *ctx = NULL; u32 len; - if (selinux_sid_to_string( + if (security_secid_to_secctx( axi->osid, &ctx, &len)) { audit_log_format(ab, " osid=%u", axi->osid); call_panic = 1; } else audit_log_format(ab, " obj=%s", ctx); - kfree(ctx); + security_release_secctx(ctx, len); } break; } @@ -1106,13 +1105,13 @@ static void audit_log_exit(struct audit_ if (n->osid != 0) { char *ctx = NULL; u32 len; - if (selinux_sid_to_string( + if (security_secid_to_secctx( n->osid, &ctx, &len)) { audit_log_format(ab, " osid=%u", n->osid); call_panic = 2; } else audit_log_format(ab, " obj=%s", ctx); - kfree(ctx); + security_release_secctx(ctx, len); } audit_log_end(ab); @@ -1394,7 +1393,7 @@ static void audit_copy_inode(struct audi name->uid = inode->i_uid; name->gid = inode->i_gid; name->rdev = inode->i_rdev; - selinux_get_inode_sid(inode, &name->osid); + security_inode_getsecid(inode, &name->osid); } /** @@ -1812,7 +1811,7 @@ int __audit_ipc_obj(struct kern_ipc_perm ax->uid = ipcp->uid; ax->gid = ipcp->gid; ax->mode = ipcp->mode; - selinux_get_ipc_sid(ipcp, &ax->osid); + security_ipc_getsecid(ipcp, &ax->osid); ax->d.type = AUDIT_IPC; ax->d.next = context->aux; @@ -1972,7 +1971,7 @@ void __audit_ptrace(struct task_struct * struct audit_context *context = current->audit_context; context->target_pid = t->pid; - selinux_get_task_sid(t, &context->target_sid); + security_task_getsecid(t, &context->target_sid); } /** @@ -1999,7 +1998,7 @@ int __audit_signal_info(int sig, struct audit_sig_uid = ctx->loginuid; else audit_sig_uid = tsk->uid; - selinux_get_task_sid(tsk, &audit_sig_sid); + security_task_getsecid(tsk, &audit_sig_sid); } if (!audit_signals || audit_dummy_context()) return 0; @@ -2009,7 +2008,7 @@ int __audit_signal_info(int sig, struct * in audit_context */ if (!ctx->target_pid) { ctx->target_pid = t->tgid; - selinux_get_task_sid(t, &ctx->target_sid); + security_task_getsecid(t, &ctx->target_sid); return 0; } @@ -2026,7 +2025,7 @@ int __audit_signal_info(int sig, struct BUG_ON(axp->pid_count >= AUDIT_AUX_PIDS); axp->target_pid[axp->pid_count] = t->tgid; - selinux_get_task_sid(t, &axp->target_sid[axp->pid_count]); + security_task_getsecid(t, &axp->target_sid[axp->pid_count]); axp->pid_count++; return 0; @@ -2054,16 +2053,16 @@ void audit_core_dumps(long signr) audit_log_format(ab, "auid=%u uid=%u gid=%u", audit_get_loginuid(current->audit_context), current->uid, current->gid); - selinux_get_task_sid(current, &sid); + security_task_getsecid(current, &sid); if (sid) { char *ctx = NULL; u32 len; - if (selinux_sid_to_string(sid, &ctx, &len)) + if (security_secid_to_secctx(sid, &ctx, &len)) audit_log_format(ab, " ssid=%u", sid); else audit_log_format(ab, " subj=%s", ctx); - kfree(ctx); + security_release_secctx(ctx, len); } audit_log_format(ab, " pid=%d comm=", current->pid); audit_log_untrustedstring(ab, current->comm); diff -uprN -X linux-2.6.23-rc4-base/Documentation/dontdiff linux-2.6.23-rc4-base/net/netlink/af_netlink.c linux-2.6.23-rc4-audit/net/netlink/af_netlink.c --- linux-2.6.23-rc4-base/net/netlink/af_netlink.c 2007-08-26 23:51:49.000000000 -0700 +++ linux-2.6.23-rc4-audit/net/netlink/af_netlink.c 2007-08-27 00:52:10.000000000 -0700 @@ -54,7 +54,6 @@ #include <linux/mm.h> #include <linux/types.h> #include <linux/audit.h> -#include <linux/selinux.h> #include <linux/mutex.h> #include <net/sock.h> @@ -1190,7 +1189,7 @@ static int netlink_sendmsg(struct kiocb NETLINK_CB(skb).pid = nlk->pid; NETLINK_CB(skb).dst_group = dst_group; NETLINK_CB(skb).loginuid = audit_get_loginuid(current->audit_context); - selinux_get_task_sid(current, &(NETLINK_CB(skb).sid)); + security_task_getsecid(current, &(NETLINK_CB(skb).sid)); memcpy(NETLINK_CREDS(skb), &siocb->scm->creds, sizeof(struct ucred)); /* What can I do? Netlink is asynchronous, so that diff -uprN -X linux-2.6.23-rc4-base/Documentation/dontdiff linux-2.6.23-rc4-base/security/selinux/exports.c linux-2.6.23-rc4-audit/security/selinux/exports.c --- linux-2.6.23-rc4-base/security/selinux/exports.c 2007-07-08 16:32:17.000000000 -0700 +++ linux-2.6.23-rc4-audit/security/selinux/exports.c 2007-08-27 00:52:10.000000000 -0700 @@ -21,48 +21,6 @@ #include "security.h" #include "objsec.h" -int selinux_sid_to_string(u32 sid, char **ctx, u32 *ctxlen) -{ - if (selinux_enabled) - return security_sid_to_context(sid, ctx, ctxlen); - else { - *ctx = NULL; - *ctxlen = 0; - } - - return 0; -} - -void selinux_get_inode_sid(const struct inode *inode, u32 *sid) -{ - if (selinux_enabled) { - struct inode_security_struct *isec = inode->i_security; - *sid = isec->sid; - return; - } - *sid = 0; -} - -void selinux_get_ipc_sid(const struct kern_ipc_perm *ipcp, u32 *sid) -{ - if (selinux_enabled) { - struct ipc_security_struct *isec = ipcp->security; - *sid = isec->sid; - return; - } - *sid = 0; -} - -void selinux_get_task_sid(struct task_struct *tsk, u32 *sid) -{ - if (selinux_enabled) { - struct task_security_struct *tsec = tsk->security; - *sid = tsec->sid; - return; - } - *sid = 0; -} - int selinux_string_to_sid(char *str, u32 *sid) { if (selinux_enabled) diff -uprN -X linux-2.6.23-rc4-base/Documentation/dontdiff linux-2.6.23-rc4-base/security/selinux/hooks.c linux-2.6.23-rc4-audit/security/selinux/hooks.c --- linux-2.6.23-rc4-base/security/selinux/hooks.c 2007-08-26 23:51:49.000000000 -0700 +++ linux-2.6.23-rc4-audit/security/selinux/hooks.c 2007-08-27 00:52:10.000000000 -0700 @@ -2722,6 +2722,13 @@ static int selinux_file_receive(struct f /* task security operations */ +static void selinux_get_task_sid(struct task_struct *tsk, u32 *sid) +{ + struct task_security_struct *tsec = tsk->security; + *sid = tsec->sid; + return; +} + static int selinux_task_create(unsigned long clone_flags) { int rc; @@ -3688,6 +3695,13 @@ out: return err; } +static void selinux_get_inode_sid(const struct inode *inode, u32 *sid) +{ + struct inode_security_struct *isec = inode->i_security; + *sid = isec->sid; + return; +} + static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid) { u32 peer_secid = SECSID_NULL; @@ -4020,6 +4034,13 @@ static int selinux_netlink_recv(struct s SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad); } +static void selinux_get_ipc_sid(const struct kern_ipc_perm *ipcp, u32 *sid) +{ + struct ipc_security_struct *isec = ipcp->security; + *sid = isec->sid; + return; +} + static int ipc_alloc_security(struct task_struct *task, struct kern_ipc_perm *perm, u16 sclass) @@ -4661,6 +4682,30 @@ static void selinux_release_secctx(char kfree(secdata); } +static int selinux_audit_rule_supplied(struct audit_krule *rule) +{ + int i; + + for (i = 0; i < rule->field_count; i++) { + struct audit_field *f = &rule->fields[i]; + switch (f->type) { + case AUDIT_SUBJ_USER: + case AUDIT_SUBJ_ROLE: + case AUDIT_SUBJ_TYPE: + case AUDIT_SUBJ_SEN: + case AUDIT_SUBJ_CLR: + case AUDIT_OBJ_USER: + case AUDIT_OBJ_ROLE: + case AUDIT_OBJ_TYPE: + case AUDIT_OBJ_LEV_LOW: + case AUDIT_OBJ_LEV_HIGH: + return 1; + } + } + + return 0; +} + #ifdef CONFIG_KEYS static int selinux_key_alloc(struct key *k, struct task_struct *tsk, @@ -4843,6 +4888,12 @@ static struct security_operations selinu .secid_to_secctx = selinux_secid_to_secctx, .release_secctx = selinux_release_secctx, + .inode_getsecid = selinux_get_inode_sid, + .ipc_getsecid = selinux_get_ipc_sid, + .audit_rule_supplied = selinux_audit_rule_supplied, + .audit_rule_match = selinux_audit_rule_match, + .audit_rule_init = selinux_audit_rule_init, + .audit_rule_free = selinux_audit_rule_free, .unix_stream_connect = selinux_socket_unix_stream_connect, .unix_may_send = selinux_socket_unix_may_send, diff -uprN -X linux-2.6.23-rc4-base/Documentation/dontdiff linux-2.6.23-rc4-base/security/selinux/include/security.h linux-2.6.23-rc4-audit/security/selinux/include/security.h --- linux-2.6.23-rc4-base/security/selinux/include/security.h 2007-08-26 23:51:50.000000000 -0700 +++ linux-2.6.23-rc4-audit/security/selinux/include/security.h 2007-08-27 00:52:10.000000000 -0700 @@ -129,5 +129,43 @@ static inline int security_netlbl_sid_to const char *security_get_initial_sid_context(u32 sid); +/** + * selinux_audit_rule_init - alloc/init an selinux audit rule structure. + * @field: the field this rule refers to + * @op: the operater the rule uses + * @rulestr: the text "target" of the rule + * @vpp: pointer to the new rule structure returned via this + * + * Returns 0 if successful, -errno if not. On success, the rule structure + * will be allocated internally. The caller must free this structure with + * selinux_audit_rule_free() after use. + */ +int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vpp); + +/** + * selinux_audit_rule_free - free an selinux audit rule structure. + * @vp: pointer to the audit rule to be freed + * + * This will free all memory associated with the given rule. + * If @rule is NULL, no operation is performed. + */ +void selinux_audit_rule_free(void *vp); + +struct audit_context; +/** + * selinux_audit_rule_match - determine if a context ID matches a rule. + * @sid: the context ID to check + * @field: the field this rule refers to + * @op: the operater the rule uses + * @vp: pointer to the audit rule to check against + * @actx: the audit context (can be NULL) associated with the check + * + * Returns 1 if the context id matches the rule, 0 if it does not, and + * -errno on failure. + */ +int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *vp, + struct audit_context *actx); + + #endif /* _SELINUX_SECURITY_H_ */ diff -uprN -X linux-2.6.23-rc4-base/Documentation/dontdiff linux-2.6.23-rc4-base/security/selinux/ss/services.c linux-2.6.23-rc4-audit/security/selinux/ss/services.c --- linux-2.6.23-rc4-base/security/selinux/ss/services.c 2007-08-26 23:51:50.000000000 -0700 +++ linux-2.6.23-rc4-audit/security/selinux/ss/services.c 2007-08-27 00:52:10.000000000 -0700 @@ -2107,17 +2107,19 @@ struct selinux_audit_rule { struct context au_ctxt; }; -void selinux_audit_rule_free(struct selinux_audit_rule *rule) +void selinux_audit_rule_free(void *vp) { + struct selinux_audit_rule *rule = (struct selinux_audit_rule*)vp; + if (rule) { context_destroy(&rule->au_ctxt); kfree(rule); } } -int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, - struct selinux_audit_rule **rule) +int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vpp) { + struct selinux_audit_rule **rule = (struct selinux_audit_rule**)vpp; struct selinux_audit_rule *tmprule; struct role_datum *roledatum; struct type_datum *typedatum; @@ -2208,10 +2210,10 @@ int selinux_audit_rule_init(u32 field, u return rc; } -int selinux_audit_rule_match(u32 sid, u32 field, u32 op, - struct selinux_audit_rule *rule, +int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *vp, struct audit_context *actx) { + struct selinux_audit_rule *rule = (struct selinux_audit_rule*)vp; struct context *ctxt; struct mls_level *level; int match = 0; @@ -2320,7 +2322,7 @@ out: return match; } -static int (*aurule_callback)(void) = NULL; +static int (*aurule_callback)(void) = audit_rule_update_callout; static int aurule_avc_callback(u32 event, u32 ssid, u32 tsid, u16 class, u32 perms, u32 *retained) @@ -2345,11 +2347,6 @@ static int __init aurule_init(void) } __initcall(aurule_init); -void selinux_audit_set_callback(int (*callback)(void)) -{ - aurule_callback = callback; -} - #ifdef CONFIG_NETLABEL /* * NetLabel cache structure

18 years

1
0
0 / 0

Audit rules keys

by Henning, Arthur C. (CSL)

Using system-config-audit getting key (-k) configuration errors when saving changes. [root@localhost ~]# Stopping auditd: [ OK ] Starting auditd: [ OK ] key option needs a watch or syscall given prior to it There was an error in line 9 of /etc/audit/audit.rules cat /etc/audit/audit.rules -e 1 -f 2 -b 8192 -r 0 -D -a entry,always -S adjtimex -S settimeofday -a entry,always -S clock_settime -a entry,always -k kill -S kill -a exit,always -k system-locale -S sethostname -a exit,always -F exit=-13 -k creation -S creat -S mkdir -S mknod -S link -S symlink -a exit,always -F exit=-13 -k creation -S mkdirat -S mknodat -S linkat -S symlinkat If I remove the key from line 9 and save, get error reported line 10, etc. Started with NISPOM.rules contrib file. Art Henning (CSL) Enterprise IT Solutions Northrop Grumman Corp art.henning(a)ngc.com

18 years

4
5
0 / 0

audit 1.6 released

by Steve Grubb

Hi, I've just released a new version of the audit daemon. It can be downloaded from http://people.redhat.com/sgrubb/audit It will also be in rawhide soon. The Changelog is: - Adding perm field should not set syscall added flag in auditctl - Fix segfault when aureport -if option is used - Fix auditctl to better check keys on rule lines - Add support for audit by TTY and other new event types - Auditd config option for group permission of audit logs - Swig messed up a variable in ppc's libaudit python bindings causing crashes. (#251327) - New audit event dispatcher - Update syscall tables for 2.6.23 kernel This release introduces a new multi-threaded event dispatcher. Its working according to my testing, but still needs some work to fill out all the features. Right now, it only runs internal plugins. They are af_unix and syslog. -Steve

18 years

1
0
0 / 0

[PATCH] dist target fixes

by John D. Ramsdell

Steve, I discovered a few more files that are being mistakenly omitted when using the dist target. John Only in b/audit-1.5.6: ab.diff Only in b/audit-1.5.6: ac.diff Only in b/audit-1.5.6: aclocal.m4 Only in b/audit-1.5.6/audisp: Makefile Only in b/audit-1.5.6/audisp: Makefile.in Only in b/audit-1.5.6: audit-1.5.6.tar.gz Only in b/audit-1.5.6/auparse: .deps Only in b/audit-1.5.6/auparse: Makefile Only in b/audit-1.5.6/auparse: Makefile.in Only in b/audit-1.5.6/auparse/test: .deps Only in b/audit-1.5.6/auparse/test: Makefile diff -ur a/audit-1.5.6/auparse/test/Makefile.am b/audit-1.5.6/auparse/test/Makefile.am --- a/audit-1.5.6/auparse/test/Makefile.am 2007-05-17 15:26:49.000000000 -0400 +++ b/audit-1.5.6/auparse/test/Makefile.am 2007-07-30 07:20:28.000000000 -0400 @@ -50,6 +50,4 @@ ../../bindings/python/build/*/auparse.so: ../../bindings/python/auparse_python.c cd ../../bindings/python && make - - - +EXTRA_DIST = auparse_test.py auparse_test.ref diff -ur a/audit-1.5.6/auparse/test/Makefile.in b/audit-1.5.6/auparse/test/Makefile.in --- a/audit-1.5.6/auparse/test/Makefile.in 2007-07-25 14:23:12.000000000 -0400 +++ b/audit-1.5.6/auparse/test/Makefile.in 2007-07-30 07:54:28.000000000 -0400 @@ -213,6 +213,7 @@ auparse_test_LDFLAGS = -static auparse_test_LDADD = -L../.libs/ -L../../lib/.libs -lauparse -laudit auparse_test_DEPENDENCIES = ../.libs/libauparse.a ../*.c ../*.h +EXTRA_DIST = auparse_test.py auparse_test.ref all: all-am .SUFFIXES: Only in b/audit-1.5.6: autom4te.cache Only in b/audit-1.5.6/bindings: Makefile Only in b/audit-1.5.6/bindings: Makefile.in Only in b/audit-1.5.6/bindings/python: Makefile Only in b/audit-1.5.6/bindings/python: Makefile.in Only in b/audit-1.5.6: b.txt Only in b/audit-1.5.6: config.h Only in b/audit-1.5.6: config.h.in Only in b/audit-1.5.6: config.log Only in b/audit-1.5.6: config.status Only in b/audit-1.5.6: configure Only in b/audit-1.5.6: c.txt Only in b/audit-1.5.6/docs: Makefile Only in b/audit-1.5.6/docs: Makefile.in Only in b/audit-1.5.6/init.d: Makefile diff -ur a/audit-1.5.6/init.d/Makefile.am b/audit-1.5.6/init.d/Makefile.am --- a/audit-1.5.6/init.d/Makefile.am 2007-07-25 14:10:53.000000000 -0400 +++ b/audit-1.5.6/init.d/Makefile.am 2007-07-30 07:25:54.000000000 -0400 @@ -22,7 +22,7 @@ CONFIG_CLEAN_FILES = Makefile.in *.rej *.orig EXTRA_DIST = auditd.init auditd.sysconfig auditd.conf audit.rules \ - auditd.cron libaudit.conf + auditd.cron libaudit.conf audispd.conf libconfig = libaudit.conf dispconfig = audispd.conf dispconfigdir = $(sysconfdir)/audisp Only in b/audit-1.5.6/init.d: Makefile.am~ Only in b/audit-1.5.6/init.d: Makefile.in Only in b/audit-1.5.6/lib: .deps Only in b/audit-1.5.6/lib: Makefile Only in b/audit-1.5.6/lib: Makefile.in Only in b/audit-1.5.6: libtool Only in b/audit-1.5.6: Makefile diff -ur a/audit-1.5.6/Makefile.am b/audit-1.5.6/Makefile.am --- a/audit-1.5.6/Makefile.am 2007-06-27 06:19:18.000000000 -0400 +++ b/audit-1.5.6/Makefile.am 2007-07-30 07:53:45.000000000 -0400 @@ -21,9 +21,14 @@ # Rickard E. (Rik) Faith <faith(a)redhat.com> # -SUBDIRS = lib auparse src/mt src audisp swig bindings init.d docs system-config-audit -EXTRA_DIST = ChangeLog AUTHORS NEWS README sample.rules contrib/capp.rules contrib/nispom.rules contrib/lspp.rules contrib/skeleton.c README-install audit.spec -CONFIG_CLEAN_FILES = Makefile.in aclocal.m4* config.h.* configure debug*.list config/* +SUBDIRS = lib auparse src/mt src audisp swig bindings init.d docs \ +system-config-audit +EXTRA_DIST = ChangeLog AUTHORS NEWS README sample.rules \ +contrib/capp.rules contrib/nispom.rules contrib/lspp.rules \ +contrib/skeleton.c contrib/avc_snap contrib/avc_syslog \ +system-config-audit.lang README-install audit.spec +CONFIG_CLEAN_FILES = Makefile.in aclocal.m4* config.h.* configure \ +debug*.list config/* clean-generic: rm -rf autom4te*.cache Only in b/audit-1.5.6: Makefile.am~ Only in b/audit-1.5.6: Makefile.in Only in b/audit-1.5.6: oaudit-1.5.6.tar.gz Only in b/audit-1.5.6/src: Makefile Only in b/audit-1.5.6/src: Makefile.in Only in b/audit-1.5.6/src/mt: audit_logging.c Only in b/audit-1.5.6/src/mt: deprecated.c Only in b/audit-1.5.6/src/mt: libaudit.c Only in b/audit-1.5.6/src/mt: libaudit.h Only in b/audit-1.5.6/src/mt: lookup_table.c Only in b/audit-1.5.6/src/mt: Makefile Only in b/audit-1.5.6/src/mt: Makefile.in Only in b/audit-1.5.6/src/mt: message.c Only in b/audit-1.5.6/src/mt: netlink.c Only in b/audit-1.5.6/src/mt: private.h Only in b/audit-1.5.6: stamp-h1 Only in b/audit-1.5.6/swig: audit.py Only in b/audit-1.5.6/swig: audit_wrap.c Only in b/audit-1.5.6/swig: .deps Only in b/audit-1.5.6/swig: Makefile Only in b/audit-1.5.6/swig: Makefile.in Only in b/audit-1.5.6/system-config-audit: config.log Only in b/audit-1.5.6/system-config-audit: config.status Only in b/audit-1.5.6/system-config-audit: intltool-extract Only in b/audit-1.5.6/system-config-audit: intltool-merge Only in b/audit-1.5.6/system-config-audit: intltool-update Only in b/audit-1.5.6/system-config-audit: libtool Only in b/audit-1.5.6/system-config-audit: m4.txt Only in b/audit-1.5.6/system-config-audit: Makefile diff -ur a/audit-1.5.6/system-config-audit/Makefile.am b/audit-1.5.6/system-config-audit/Makefile.am --- a/audit-1.5.6/system-config-audit/Makefile.am 2007-07-25 14:25:05.000000000 -0400 +++ b/audit-1.5.6/system-config-audit/Makefile.am 2007-07-30 07:49:09.000000000 -0400 @@ -58,11 +58,21 @@ CLEANFILES = $(applications_DATA) $(bin_SCRIPTS) $(nodist_pkgdata_PYTHON) \ admin/system-config-audit-server.console DISTCLEANFILES = intltool-extract intltool-merge intltool-update -EXTRA_DIST = admin/intltool-extract.in admin/intltool-merge.in \ - admin/intltool-update.in admin/system-config-audit-server.console.in \ - admin/system-config-audit-server.pam \ - src/settings.py.in src/system-config-audit.in \ - system-config-audit.desktop.in +EXTRA_DIST = admin/intltool-extract.in admin/intltool-merge.in \ + admin/intltool-update.in \ + admin/system-config-audit-server.console.in \ + admin/system-config-audit-server.pam src/settings.py.in \ + src/system-config-audit.in system-config-audit.desktop.in \ + m4/codeset.m4 m4/gettext.m4 m4/glibc21.m4 m4/glibc2.m4 \ + m4/iconv.m4 m4/intdiv0.m4 m4/intldir.m4 m4/intl.m4 \ + m4/intmax.m4 m4/inttypes_h.m4 m4/inttypes.m4 \ + m4/inttypes-pri.m4 m4/isc-posix.m4 m4/lcmessage.m4 \ + m4/lib-ld.m4 m4/lib-link.m4 m4/lib-prefix.m4 m4/lock.m4 \ + m4/longdouble.m4 m4/longlong.m4 m4/nls.m4 m4/po.m4 \ + m4/printf-posix.m4 m4/progtest.m4 m4/signed.m4 m4/size_max.m4 \ + m4/stdint_h.m4 m4/uintmax_t.m4 m4/ulonglong.m4 \ + m4/visibility.m4 m4/wchar_t.m4 m4/wint_t.m4 m4/xsize.m4 + src_system_config_audit_server_SOURCES = src/server.c src/server.h src_system_config_audit_server_CPPFLAGS = $(AM_CPPFLAGS) \ Only in b/audit-1.5.6/system-config-audit: Makefile.am~ diff -ur a/audit-1.5.6/system-config-audit/Makefile.in b/audit-1.5.6/system-config-audit/Makefile.in --- a/audit-1.5.6/system-config-audit/Makefile.in 2007-07-25 14:23:56.000000000 -0400 +++ b/audit-1.5.6/system-config-audit/Makefile.in 2007-07-30 07:50:07.000000000 -0400 @@ -314,12 +314,21 @@ CLEANFILES = $(applications_DATA) $(bin_SCRIPTS) $(nodist_pkgdata_PYTHON) \ admin/system-config-audit-server.console -DISTCLEANFILES = intltool-extract intltool-merge intltool-update src/.libs -EXTRA_DIST = admin/intltool-extract.in admin/intltool-merge.in \ - admin/intltool-update.in admin/system-config-audit-server.console.in \ - admin/system-config-audit-server.pam \ - src/settings.py.in src/system-config-audit.in \ - system-config-audit.desktop.in +DISTCLEANFILES = intltool-extract intltool-merge intltool-update +EXTRA_DIST = admin/intltool-extract.in admin/intltool-merge.in \ + admin/intltool-update.in \ + admin/system-config-audit-server.console.in \ + admin/system-config-audit-server.pam src/settings.py.in \ + src/system-config-audit.in system-config-audit.desktop.in \ + m4/codeset.m4 m4/gettext.m4 m4/glibc21.m4 m4/glibc2.m4 \ + m4/iconv.m4 m4/intdiv0.m4 m4/intldir.m4 m4/intl.m4 \ + m4/intmax.m4 m4/inttypes_h.m4 m4/inttypes.m4 \ + m4/inttypes-pri.m4 m4/isc-posix.m4 m4/lcmessage.m4 \ + m4/lib-ld.m4 m4/lib-link.m4 m4/lib-prefix.m4 m4/lock.m4 \ + m4/longdouble.m4 m4/longlong.m4 m4/nls.m4 m4/po.m4 \ + m4/printf-posix.m4 m4/progtest.m4 m4/signed.m4 m4/size_max.m4 \ + m4/stdint_h.m4 m4/uintmax_t.m4 m4/ulonglong.m4 \ + m4/visibility.m4 m4/wchar_t.m4 m4/wint_t.m4 m4/xsize.m4 src_system_config_audit_server_SOURCES = src/server.c src/server.h src_system_config_audit_server_CPPFLAGS = $(AM_CPPFLAGS) \ Only in b/audit-1.5.6/system-config-audit/po: Makefile Only in b/audit-1.5.6/system-config-audit/po: Makefile.in Only in b/audit-1.5.6/system-config-audit/po: POTFILES Only in b/audit-1.5.6/system-config-audit/po: stamp-it Only in b/audit-1.5.6/system-config-audit/src: config.h Only in b/audit-1.5.6/system-config-audit/src: .deps Only in b/audit-1.5.6/system-config-audit/src: stamp-h1

18 years

3
10
0 / 0

Re: [PATCH] improved xfrm_audit_log() patch

by Joy Latten

On Tue, 2007-08-07 at 18:32 -0700, David Miller wrote: >From: Joy Latten <latten(a)austin.ibm.com> >Date: Thu, 2 Aug 2007 15:56:47 -0500 > >> @@ -426,10 +426,15 @@ struct xfrm_audit >> }; >> >> #ifdef CONFIG_AUDITSYSCALL >> -extern void xfrm_audit_log(uid_t auid, u32 secid, int type, int result, >> - struct xfrm_policy *xp, struct xfrm_state *x); >> +extern void xfrm_audit_log(struct xfrm_audit audit_info, int result, >> + __be32 flowid, struct xfrm_policy *xp, >> + struct xfrm_state *x, char *buf); > >Passing audit_info as an aggregate argument puts them into >previous argument registers, or if they are not enough it >goes either partially of wholly onto the stack, depending >upon architecture. > >In fact you've made the argument register usage worse than >in your previous revision. :-/ > >Perhaps you meant to pass "struct xfrm_audit *" instead? Revised patch to pass pointer to struct xfrm_audit. Sorry, I missed that. Signed-off-by: Joy Latten <latten(a)austin.ibm.com> diff -urpN linux-2.6.22/include/linux/audit.h linux-2.6.22.patch/include/linux/audit.h --- linux-2.6.22/include/linux/audit.h 2007-08-14 18:13:53.000000000 -0500 +++ linux-2.6.22.patch/include/linux/audit.h 2007-08-14 19:08:42.000000000 -0500 @@ -112,6 +112,7 @@ #define AUDIT_MAC_IPSEC_DELSA 1412 /* Delete a XFRM state */ #define AUDIT_MAC_IPSEC_ADDSPD 1413 /* Add a XFRM policy */ #define AUDIT_MAC_IPSEC_DELSPD 1414 /* Delete a XFRM policy */ +#define AUDIT_MAC_IPSEC_EVENT 1415 /* Audit IPSec events */ #define AUDIT_FIRST_KERN_ANOM_MSG 1700 #define AUDIT_LAST_KERN_ANOM_MSG 1799 diff -urpN linux-2.6.22/include/net/xfrm.h linux-2.6.22.patch/include/net/xfrm.h --- linux-2.6.22/include/net/xfrm.h 2007-08-14 18:13:53.000000000 -0500 +++ linux-2.6.22.patch/include/net/xfrm.h 2007-08-14 19:08:42.000000000 -0500 @@ -426,10 +426,15 @@ struct xfrm_audit }; #ifdef CONFIG_AUDITSYSCALL -extern void xfrm_audit_log(uid_t auid, u32 secid, int type, int result, - struct xfrm_policy *xp, struct xfrm_state *x); +extern void xfrm_audit_log(struct xfrm_audit *audit_info, int result, + __be32 flowid, struct xfrm_policy *xp, + struct xfrm_state *x, char *buf); + +extern void xfrm_get_auditinfo(struct sk_buff *skb, + struct xfrm_audit *audit_info); #else -#define xfrm_audit_log(a,s,t,r,p,x) do { ; } while (0) +#define xfrm_audit_log(a,r,f,p,s,b) do { ; } while (0) +#define xfrm_get_auditinfo(s, a) do { ; } while (0) #endif /* CONFIG_AUDITSYSCALL */ static inline void xfrm_pol_hold(struct xfrm_policy *policy) diff -urpN linux-2.6.22/net/key/af_key.c linux-2.6.22.patch/net/key/af_key.c --- linux-2.6.22/net/key/af_key.c 2007-08-14 18:13:53.000000000 -0500 +++ linux-2.6.22.patch/net/key/af_key.c 2007-08-14 19:08:42.000000000 -0500 @@ -1450,6 +1450,7 @@ static int pfkey_add(struct sock *sk, st struct xfrm_state *x; int err; struct km_event c; + struct xfrm_audit audit_info; x = pfkey_msg2xfrm_state(hdr, ext_hdrs); if (IS_ERR(x)) @@ -1461,8 +1462,8 @@ static int pfkey_add(struct sock *sk, st else err = xfrm_state_update(x); - xfrm_audit_log(audit_get_loginuid(current->audit_context), 0, - AUDIT_MAC_IPSEC_ADDSA, err ? 0 : 1, NULL, x); + xfrm_get_auditinfo(0, &audit_info); + xfrm_audit_log(&audit_info, err ? 0 : 1, 0, 0, x, "SAD-add"); if (err < 0) { x->km.state = XFRM_STATE_DEAD; @@ -1487,6 +1488,7 @@ static int pfkey_delete(struct sock *sk, struct xfrm_state *x; struct km_event c; int err; + struct xfrm_audit audit_info; if (!ext_hdrs[SADB_EXT_SA-1] || !present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1], @@ -1515,8 +1517,9 @@ static int pfkey_delete(struct sock *sk, c.event = XFRM_MSG_DELSA; km_state_notify(x, &c); out: - xfrm_audit_log(audit_get_loginuid(current->audit_context), 0, - AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x); + xfrm_get_auditinfo(0, &audit_info); + xfrm_audit_log(&audit_info, err ? 0 : 1, 0, 0, x, "SAD-delete"); + xfrm_state_put(x); return err; @@ -1691,8 +1694,7 @@ static int pfkey_flush(struct sock *sk, if (proto == 0) return -EINVAL; - audit_info.loginuid = audit_get_loginuid(current->audit_context); - audit_info.secid = 0; + xfrm_get_auditinfo(0, &audit_info); err = xfrm_state_flush(proto, &audit_info); if (err) return err; @@ -2182,6 +2184,7 @@ static int pfkey_spdadd(struct sock *sk, struct xfrm_policy *xp; struct km_event c; struct sadb_x_sec_ctx *sec_ctx; + struct xfrm_audit audit_info; if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1], ext_hdrs[SADB_EXT_ADDRESS_DST-1]) || @@ -2268,8 +2271,8 @@ static int pfkey_spdadd(struct sock *sk, err = xfrm_policy_insert(pol->sadb_x_policy_dir-1, xp, hdr->sadb_msg_type != SADB_X_SPDUPDATE); - xfrm_audit_log(audit_get_loginuid(current->audit_context), 0, - AUDIT_MAC_IPSEC_ADDSPD, err ? 0 : 1, xp, NULL); + xfrm_get_auditinfo(0, &audit_info); + xfrm_audit_log(&audit_info, err ? 0 : 1, 0, xp, 0, "SPD-add"); if (err) goto out; @@ -2301,6 +2304,7 @@ static int pfkey_spddelete(struct sock * struct xfrm_selector sel; struct km_event c; struct sadb_x_sec_ctx *sec_ctx; + struct xfrm_audit audit_info; if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1], ext_hdrs[SADB_EXT_ADDRESS_DST-1]) || @@ -2352,8 +2356,8 @@ static int pfkey_spddelete(struct sock * if (xp == NULL) return -ENOENT; - xfrm_audit_log(audit_get_loginuid(current->audit_context), 0, - AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL); + xfrm_get_auditinfo(0, &audit_info); + xfrm_audit_log(&audit_info, err ? 0 : 1, 0, xp, 0, "SPD-delete"); if (err) goto out; @@ -2613,8 +2617,10 @@ static int pfkey_spdget(struct sock *sk, return -ENOENT; if (delete) { - xfrm_audit_log(audit_get_loginuid(current->audit_context), 0, - AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL); + struct xfrm_audit audit_info; + + xfrm_get_auditinfo(0, &audit_info); + xfrm_audit_log(&audit_info, err ? 0 : 1, 0, xp, 0, "SPD-delete"); if (err) goto out; @@ -2691,8 +2697,7 @@ static int pfkey_spdflush(struct sock *s struct xfrm_audit audit_info; int err; - audit_info.loginuid = audit_get_loginuid(current->audit_context); - audit_info.secid = 0; + xfrm_get_auditinfo(0, &audit_info); err = xfrm_policy_flush(XFRM_POLICY_TYPE_MAIN, &audit_info); if (err) return err; diff -urpN linux-2.6.22/net/xfrm/xfrm_policy.c linux-2.6.22.patch/net/xfrm/xfrm_policy.c --- linux-2.6.22/net/xfrm/xfrm_policy.c 2007-08-14 18:14:51.000000000 -0500 +++ linux-2.6.22.patch/net/xfrm/xfrm_policy.c 2007-08-14 19:08:42.000000000 -0500 @@ -850,10 +850,8 @@ xfrm_policy_flush_secctx_check(u8 type, continue; err = security_xfrm_policy_delete(pol); if (err) { - xfrm_audit_log(audit_info->loginuid, - audit_info->secid, - AUDIT_MAC_IPSEC_DELSPD, 0, - pol, NULL); + xfrm_audit_log(audit_info, 0, 0, + pol, 0, "SPD-delete"); return err; } } @@ -865,10 +863,8 @@ xfrm_policy_flush_secctx_check(u8 type, continue; err = security_xfrm_policy_delete(pol); if (err) { - xfrm_audit_log(audit_info->loginuid, - audit_info->secid, - AUDIT_MAC_IPSEC_DELSPD, - 0, pol, NULL); + xfrm_audit_log(audit_info, 0, 0, + pol, 0, "SPD-delete"); return err; } } @@ -909,8 +905,7 @@ int xfrm_policy_flush(u8 type, struct xf hlist_del(&pol->byidx); write_unlock_bh(&xfrm_policy_lock); - xfrm_audit_log(audit_info->loginuid, audit_info->secid, - AUDIT_MAC_IPSEC_DELSPD, 1, pol, NULL); + xfrm_audit_log(audit_info, 1, 0, pol, 0, "SPD-delete"); xfrm_policy_kill(pol); killed++; @@ -930,10 +925,8 @@ int xfrm_policy_flush(u8 type, struct xf hlist_del(&pol->byidx); write_unlock_bh(&xfrm_policy_lock); - xfrm_audit_log(audit_info->loginuid, - audit_info->secid, - AUDIT_MAC_IPSEC_DELSPD, 1, - pol, NULL); + xfrm_audit_log(audit_info, 1, 0, pol, 0, + "SPD-delete"); xfrm_policy_kill(pol); killed++; @@ -2151,114 +2144,88 @@ int xfrm_bundle_ok(struct xfrm_policy *p EXPORT_SYMBOL(xfrm_bundle_ok); #ifdef CONFIG_AUDITSYSCALL -/* Audit addition and deletion of SAs and ipsec policy */ +/* Audit ipsec events */ -void xfrm_audit_log(uid_t auid, u32 sid, int type, int result, - struct xfrm_policy *xp, struct xfrm_state *x) +void xfrm_get_auditinfo(struct sk_buff *skb, struct xfrm_audit *audit_info) { + if (skb) { + audit_info->secid = NETLINK_CB(skb).sid; + audit_info->loginuid = NETLINK_CB(skb).loginuid; + } else { + audit_info->loginuid = + audit_get_loginuid(current->audit_context); + audit_info->secid = 0; + } +} + +EXPORT_SYMBOL(xfrm_get_auditinfo); + +static void do_xfrm_audit_log(struct audit_buffer *audit_buf, + u16 family, xfrm_address_t saddr, + xfrm_address_t daddr, struct xfrm_sec_ctx *sctx, + __be32 spi) +{ + if (sctx) + audit_log_format(audit_buf, + " sec_alg=%u sec_doi=%u sec_obj=%s", + sctx->ctx_alg, sctx->ctx_doi, sctx->ctx_str); + + switch(family) { + case AF_INET: + audit_log_format(audit_buf, + " src=" NIPQUAD_FMT " dst=" NIPQUAD_FMT, + NIPQUAD(saddr.a4), NIPQUAD(daddr.a4)); + break; + case AF_INET6: + audit_log_format(audit_buf, " src=" NIP6_FMT " dst=" NIP6_FMT, + NIP6(*((struct in6_addr *)&saddr.a6)), + NIP6(*((struct in6_addr *)&daddr.a6))); + break; + } + + if (spi) + audit_log_format(audit_buf, " spi=%lu(0x%lx)", + (unsigned long)ntohl(spi), + (unsigned long)ntohl(spi)); +} +void xfrm_audit_log(struct xfrm_audit *audit_info, int result, + __be32 flowlabel, struct xfrm_policy *xp, + struct xfrm_state *x, char *buf) +{ char *secctx; u32 secctx_len; - struct xfrm_sec_ctx *sctx = NULL; struct audit_buffer *audit_buf; - int family; extern int audit_enabled; if (audit_enabled == 0) return; - BUG_ON((type == AUDIT_MAC_IPSEC_ADDSA || - type == AUDIT_MAC_IPSEC_DELSA) && !x); - BUG_ON((type == AUDIT_MAC_IPSEC_ADDSPD || - type == AUDIT_MAC_IPSEC_DELSPD) && !xp); - - audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC, type); + audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC, + AUDIT_MAC_IPSEC_EVENT); if (audit_buf == NULL) return; - switch(type) { - case AUDIT_MAC_IPSEC_ADDSA: - audit_log_format(audit_buf, "SAD add: auid=%u", auid); - break; - case AUDIT_MAC_IPSEC_DELSA: - audit_log_format(audit_buf, "SAD delete: auid=%u", auid); - break; - case AUDIT_MAC_IPSEC_ADDSPD: - audit_log_format(audit_buf, "SPD add: auid=%u", auid); - break; - case AUDIT_MAC_IPSEC_DELSPD: - audit_log_format(audit_buf, "SPD delete: auid=%u", auid); - break; - default: - return; - } + audit_log_format(audit_buf, "op=%s auid=%u", buf, audit_info->loginuid); - if (sid != 0 && - security_secid_to_secctx(sid, &secctx, &secctx_len) == 0) { + if (audit_info->secid != 0 && + security_secid_to_secctx(audit_info->secid, &secctx, + &secctx_len) == 0) audit_log_format(audit_buf, " subj=%s", secctx); - security_release_secctx(secctx, secctx_len); - } else + else audit_log_task_context(audit_buf); - if (xp) { - family = xp->selector.family; - if (xp->security) - sctx = xp->security; - } else { - family = x->props.family; - if (x->security) - sctx = x->security; - } - - if (sctx) - audit_log_format(audit_buf, - " sec_alg=%u sec_doi=%u sec_obj=%s", - sctx->ctx_alg, sctx->ctx_doi, sctx->ctx_str); - - switch(family) { - case AF_INET: - { - struct in_addr saddr, daddr; - if (xp) { - saddr.s_addr = xp->selector.saddr.a4; - daddr.s_addr = xp->selector.daddr.a4; - } else { - saddr.s_addr = x->props.saddr.a4; - daddr.s_addr = x->id.daddr.a4; - } - audit_log_format(audit_buf, - " src=%u.%u.%u.%u dst=%u.%u.%u.%u", - NIPQUAD(saddr), NIPQUAD(daddr)); - } - break; - case AF_INET6: - { - struct in6_addr saddr6, daddr6; - if (xp) { - memcpy(&saddr6, xp->selector.saddr.a6, - sizeof(struct in6_addr)); - memcpy(&daddr6, xp->selector.daddr.a6, - sizeof(struct in6_addr)); - } else { - memcpy(&saddr6, x->props.saddr.a6, - sizeof(struct in6_addr)); - memcpy(&daddr6, x->id.daddr.a6, - sizeof(struct in6_addr)); - } - audit_log_format(audit_buf, - " src=" NIP6_FMT " dst=" NIP6_FMT, - NIP6(saddr6), NIP6(daddr6)); - } - break; - } + if (xp) + do_xfrm_audit_log(audit_buf, xp->selector.family, + xp->selector.saddr, xp->selector.daddr, + xp->security, 0); if (x) - audit_log_format(audit_buf, " spi=%lu(0x%lx) protocol=%s", - (unsigned long)ntohl(x->id.spi), - (unsigned long)ntohl(x->id.spi), - x->id.proto == IPPROTO_AH ? "AH" : - (x->id.proto == IPPROTO_ESP ? - "ESP" : "IPCOMP")); + do_xfrm_audit_log(audit_buf, x->props.family, x->props.saddr, + x->id.daddr, x->security, x->id.spi); + + if (flowlabel) + audit_log_format(audit_buf, " flowlabel=%u", flowlabel); audit_log_format(audit_buf, " res=%u", result); audit_log_end(audit_buf); diff -urpN linux-2.6.22/net/xfrm/xfrm_state.c linux-2.6.22.patch/net/xfrm/xfrm_state.c --- linux-2.6.22/net/xfrm/xfrm_state.c 2007-08-14 18:14:51.000000000 -0500 +++ linux-2.6.22.patch/net/xfrm/xfrm_state.c 2007-08-14 19:08:42.000000000 -0500 @@ -239,6 +239,7 @@ static void xfrm_timer_handler(unsigned long next = LONG_MAX; int warn = 0; int err = 0; + struct xfrm_audit audit_info; spin_lock(&x->lock); if (x->km.state == XFRM_STATE_DEAD) @@ -301,8 +302,9 @@ expired: if (!err && x->id.spi) km_state_expired(x, 1, 0); - xfrm_audit_log(audit_get_loginuid(current->audit_context), 0, - AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x); + + xfrm_get_auditinfo(0, &audit_info); + xfrm_audit_log(&audit_info, err ? 0 : 1, 0, 0, x, "SAD-delete"); out: spin_unlock(&x->lock); @@ -403,11 +405,8 @@ xfrm_state_flush_secctx_check(u8 proto, hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) { if (xfrm_id_proto_match(x->id.proto, proto) && (err = security_xfrm_state_delete(x)) != 0) { - xfrm_audit_log(audit_info->loginuid, - audit_info->secid, - AUDIT_MAC_IPSEC_DELSA, - 0, NULL, x); - + xfrm_audit_log(audit_info, 0, 0, 0, x, + "SAD-delete"); return err; } } @@ -443,10 +442,8 @@ restart: spin_unlock_bh(&xfrm_state_lock); err = xfrm_state_delete(x); - xfrm_audit_log(audit_info->loginuid, - audit_info->secid, - AUDIT_MAC_IPSEC_DELSA, - err ? 0 : 1, NULL, x); + xfrm_audit_log(audit_info, err ? 0 : 1, 0, + 0, x, "SAD-delete"); xfrm_state_put(x); spin_lock_bh(&xfrm_state_lock); diff -urpN linux-2.6.22/net/xfrm/xfrm_user.c linux-2.6.22.patch/net/xfrm/xfrm_user.c --- linux-2.6.22/net/xfrm/xfrm_user.c 2007-08-14 18:13:54.000000000 -0500 +++ linux-2.6.22.patch/net/xfrm/xfrm_user.c 2007-08-14 19:09:14.000000000 -0500 @@ -447,6 +447,7 @@ static int xfrm_add_sa(struct sk_buff *s struct xfrm_state *x; int err; struct km_event c; + struct xfrm_audit audit_info; err = verify_newsa_info(p, xfrma); if (err) @@ -462,8 +463,8 @@ static int xfrm_add_sa(struct sk_buff *s else err = xfrm_state_update(x); - xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid, - AUDIT_MAC_IPSEC_ADDSA, err ? 0 : 1, NULL, x); + xfrm_get_auditinfo(skb, &audit_info); + xfrm_audit_log(&audit_info, err ? 0 : 1, 0, 0, x, "SAD-add"); if (err < 0) { x->km.state = XFRM_STATE_DEAD; @@ -521,6 +522,7 @@ static int xfrm_del_sa(struct sk_buff *s int err = -ESRCH; struct km_event c; struct xfrm_usersa_id *p = NLMSG_DATA(nlh); + struct xfrm_audit audit_info; x = xfrm_user_state_lookup(p, xfrma, &err); if (x == NULL) @@ -545,8 +547,8 @@ static int xfrm_del_sa(struct sk_buff *s km_state_notify(x, &c); out: - xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid, - AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x); + xfrm_get_auditinfo(skb, &audit_info); + xfrm_audit_log(&audit_info, err ? 0 : 1, 0, 0, x, "SAD-delete"); xfrm_state_put(x); return err; } @@ -1137,6 +1139,7 @@ static int xfrm_add_policy(struct sk_buf struct km_event c; int err; int excl; + struct xfrm_audit audit_info; err = verify_newpolicy_info(p); if (err) @@ -1155,8 +1158,8 @@ static int xfrm_add_policy(struct sk_buf * a type XFRM_MSG_UPDPOLICY - JHS */ excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY; err = xfrm_policy_insert(p->dir, xp, excl); - xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid, - AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL); + xfrm_get_auditinfo(skb, &audit_info); + xfrm_audit_log(&audit_info, err ? 0 : 1, 0, xp, 0, "SPD-add"); if (err) { security_xfrm_policy_free(xp); @@ -1401,8 +1404,11 @@ static int xfrm_get_policy(struct sk_buf MSG_DONTWAIT); } } else { - xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid, - AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL); + struct xfrm_audit audit_info; + + xfrm_get_auditinfo(skb, &audit_info); + xfrm_audit_log(&audit_info, err ? 0 : 1, 0, + xp, 0, "SPD-delete"); if (err != 0) goto out; @@ -1427,8 +1433,7 @@ static int xfrm_flush_sa(struct sk_buff struct xfrm_audit audit_info; int err; - audit_info.loginuid = NETLINK_CB(skb).loginuid; - audit_info.secid = NETLINK_CB(skb).sid; + xfrm_get_auditinfo(skb, &audit_info); err = xfrm_state_flush(p->proto, &audit_info); if (err) return err; @@ -1590,8 +1595,7 @@ static int xfrm_flush_policy(struct sk_b if (err) return err; - audit_info.loginuid = NETLINK_CB(skb).loginuid; - audit_info.secid = NETLINK_CB(skb).sid; + xfrm_get_auditinfo(skb, &audit_info); err = xfrm_policy_flush(type, &audit_info); if (err) return err; @@ -1649,10 +1653,11 @@ static int xfrm_add_pol_expire(struct sk read_unlock(&xp->lock); err = 0; if (up->hard) { - xfrm_policy_delete(xp, p->dir); - xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid, - AUDIT_MAC_IPSEC_DELSPD, 1, xp, NULL); + struct xfrm_audit audit_info; + xfrm_policy_delete(xp, p->dir); + xfrm_get_auditinfo(skb, &audit_info); + xfrm_audit_log(&audit_info, 1, 0, xp, 0, "SPD-delete"); } else { // reset the timers here? printk("Dont know what to do with soft policy expire\n"); @@ -1685,9 +1690,11 @@ static int xfrm_add_sa_expire(struct sk_ km_state_expired(x, ue->hard, current->pid); if (ue->hard) { + struct xfrm_audit audit_info; + __xfrm_state_delete(x); - xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid, - AUDIT_MAC_IPSEC_DELSA, 1, NULL, x); + xfrm_get_auditinfo(skb, &audit_info); + xfrm_audit_log(&audit_info, 1, 0, 0, x, "SAD-delete"); } err = 0; out:

18 years

2
6
0 / 0

[Announce] RHEL5 LSPP/EAL4 Certification Testsuite has been released again

by Subrata Modak

The Red Hat Enterprise Linux 5 LSPP/EAL4 Certification Testsuite (rhel5_ibm_eal4_cert_suite2.tgz) has been released again and can be found at http://ltp.sourceforge.net/ or http://sourceforge.net/project/showfiles.php?group_id=3382. More details about this testsuite can be found @'lspp/README' inside the package. Regards & Thanks-- Subrata Modak

18 years

2
1
0 / 0

linux pam audit

by Thomas Wang

Hi all, Is it possible to redirect the log messages of a certain PAM Service into a special file. I have for example a PAM service "cdsrv" whose messages are all going to /var/log/messages. But i want all the messages of the PAM service "cdsrv" (and only these) in a file /var/log/cdsrv.log. Is that possible, some magic with /etc/syslog.conf maybe? Thanks in advance, tom

18 years

2
1
0 / 0

Auditing failed kill events

by Henning, Arthur C. (CSL)

RHEL kernel 2.6.18-8.el5xen Audit 1.5.6-1.i386 Audit.rules entry: -a entry,always -S kill Attempt to kill a process which is not owned by that user. $ kill -9 nnnn bash: kill: (nnnn) - Operation not permitted $ Get log entry of the failed attempt # ausearch -i -sv no type=SYSCALL msg=audit(08/21/2007 09:40:36.832:1458) : arch=i386 syscall=kill success=no exit=-1(Operation not permitted) a0=f8c a1=9 a2=f8c a3=f8c items=0 ppid=3391 pid=3402 auid=art uid=art gid=art euid=art suid=art fsuid=art egid=art sgid=art fsgid=art tty=pts2 comm=bash exe=/bin/bash subj=user_u:system_r:unconfined_t:s0 key=(null) Is there a way to indentify the process which the user attempted to kill? Or by whom the process is owned? The ppid and pid reported are those of the user attempting to kill a process. Art Henning (CSL) Enterprise IT Solutions Northrop Grumman Corp art.henning(a)ngc.com

18 years

7
15
0 / 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Linux-audit August 2007