Re: [PATCH] audit: Send replies in the proper network namespace.

On 14/02/28, Eric W. Biederman wrote: > > In perverse cases of file descriptor passing the current network > namespace of a process and the network namespace of a socket used by > that socket may differ. Therefore use the network namespace of the > appropiate socket to ensure replies always go to the appropiate > socket. > > Signed-off-by: "Eric W. Biederman" <ebiederm(a)xmission.com&gt; Signed-off-by: Richard Guy Briggs <rgb(a)tricolour.ca&gt;

> --- > > This is an incremental change on top of my previous patch to guarantee > that replies always happen in the appropriate network namespace. > > include/linux/audit.h | 3 ++- > kernel/audit.c | 21 ++++++++++----------- > kernel/auditfilter.c | 7 +++++-- > 3 files changed, 17 insertions(+), 14 deletions(-) > > diff --git a/include/linux/audit.h b/include/linux/audit.h > index aa865a9a4c4f..ec1464df4c60 100644 > --- a/include/linux/audit.h > +++ b/include/linux/audit.h > @@ -43,6 +43,7 @@ struct mq_attr; > struct mqstat; > struct audit_watch; > struct audit_tree; > +struct sk_buff; > > struct audit_krule { > int vers_ops; > @@ -463,7 +464,7 @@ extern int audit_filter_user(int type); > extern int audit_filter_type(int type); > extern int audit_rule_change(int type, __u32 portid, int seq, > void *data, size_t datasz); > -extern int audit_list_rules_send(__u32 portid, int seq); > +extern int audit_list_rules_send(struct sk_buff *request_skb, int seq); > > extern u32 audit_enabled; > #else /* CONFIG_AUDIT */ > diff --git a/kernel/audit.c b/kernel/audit.c > index 1e5756f16f6f..32086bff5564 100644 > --- a/kernel/audit.c > +++ b/kernel/audit.c > @@ -570,9 +570,11 @@ static int audit_send_reply_thread(void *arg) > * Allocates an skb, builds the netlink message, and sends it to the port id. > * No failure notifications. > */ > -static void audit_send_reply(__u32 portid, int seq, int type, int done, > +static void audit_send_reply(struct sk_buff *request_skb, int seq, int type, int done, > int multi, const void *payload, int size) > { > + u32 portid = NETLINK_CB(request_skb).portid; > + struct net *net = sock_net(NETLINK_CB(request_skb).sk); > struct sk_buff *skb; > struct task_struct *tsk; > struct audit_reply *reply = kmalloc(sizeof(struct audit_reply), > @@ -585,7 +587,7 @@ static void audit_send_reply(__u32 portid, int seq, int type, int done, > if (!skb) > goto out; > > - reply->net = get_net(current->nsproxy->net_ns); > + reply->net = get_net(net); > reply->portid = portid; > reply->skb = skb; > > @@ -675,8 +677,7 @@ static int audit_get_feature(struct sk_buff *skb) > > seq = nlmsg_hdr(skb)->nlmsg_seq; > > - audit_send_reply(NETLINK_CB(skb).portid, seq, AUDIT_GET, 0, 0, > - &af, sizeof(af)); > + audit_send_reply(skb, seq, AUDIT_GET, 0, 0, &af, sizeof(af)); > > return 0; > } > @@ -796,8 +797,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) > s.backlog = skb_queue_len(&audit_skb_queue); > s.version = AUDIT_VERSION_LATEST; > s.backlog_wait_time = audit_backlog_wait_time; > - audit_send_reply(NETLINK_CB(skb).portid, seq, AUDIT_GET, 0, 0, > - &s, sizeof(s)); > + audit_send_reply(skb, seq, AUDIT_GET, 0, 0, &s, sizeof(s)); > break; > } > case AUDIT_SET: { > @@ -907,7 +907,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) > seq, data, nlmsg_len(nlh)); > break; > case AUDIT_LIST_RULES: > - err = audit_list_rules_send(NETLINK_CB(skb).portid, seq); > + err = audit_list_rules_send(skb, seq); > break; > case AUDIT_TRIM: > audit_trim_trees(); > @@ -972,8 +972,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) > memcpy(sig_data->ctx, ctx, len); > security_release_secctx(ctx, len); > } > - audit_send_reply(NETLINK_CB(skb).portid, seq, AUDIT_SIGNAL_INFO, > - 0, 0, sig_data, sizeof(*sig_data) + len); > + audit_send_reply(skb, seq, AUDIT_SIGNAL_INFO, 0, 0, > + sig_data, sizeof(*sig_data) + len); > kfree(sig_data); > break; > case AUDIT_TTY_GET: { > @@ -985,8 +985,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) > s.log_passwd = tsk->signal->audit_tty_log_passwd; > spin_unlock(&tsk->sighand->siglock); > > - audit_send_reply(NETLINK_CB(skb).portid, seq, > - AUDIT_TTY_GET, 0, 0, &s, sizeof(s)); > + audit_send_reply(skb, seq, AUDIT_TTY_GET, 0, 0, &s, sizeof(s)); > break; > } > case AUDIT_TTY_SET: { > diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c > index a5e3d73d73e4..e8d1c7c515d7 100644 > --- a/kernel/auditfilter.c > +++ b/kernel/auditfilter.c > @@ -30,6 +30,7 @@ > #include <linux/slab.h> > #include <linux/security.h> > #include <net/net_namespace.h> > +#include <net/sock.h> > #include "audit.h" > > /* > @@ -1069,8 +1070,10 @@ int audit_rule_change(int type, __u32 portid, int seq, void *data, > * @portid: target portid for netlink audit messages > * @seq: netlink audit message sequence (serial) number > */ > -int audit_list_rules_send(__u32 portid, int seq) > +int audit_list_rules_send(struct sk_buff *request_skb, int seq) > { > + u32 portid = NETLINK_CB(request_skb).portid; > + struct net *net = sock_net(NETLINK_CB(request_skb).sk); > struct task_struct *tsk; > struct audit_netlink_list *dest; > int err = 0; > @@ -1084,7 +1087,7 @@ int audit_list_rules_send(__u32 portid, int seq) > dest = kmalloc(sizeof(struct audit_netlink_list), GFP_KERNEL); > if (!dest) > return -ENOMEM; > - dest->net = get_net(current->nsproxy->net_ns); > + dest->net = get_net(net); > dest->portid = portid; > skb_queue_head_init(&dest->q); > > -- > 1.7.5.4 > - RGB -- Richard Guy Briggs <rbriggs(a)redhat.com&gt; Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat Remote, Ottawa, Canada Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545