Re: logging changes in tty logging status

On Thu, Nov 14, 2013 at 09:16:15AM -0500, Richard Guy Briggs wrote: Here's a cleaner go at it. I'm still not completely happy with the redundancy and non-standard old/new labels. This is all one command, but changes two values. Should they be in one line, or in two? One would be much simpler. Would it be acceptable to do something like: " op=tty_set-enabled/log_passwd old=0/1 new=1/1 res=1" diff --git a/kernel/audit.c b/kernel/audit.c index 7b0e23a..1e74576 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -827,20 +827,42 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) break; } case AUDIT_TTY_SET: { - struct audit_tty_status s; + struct audit_tty_status s, old; struct task_struct *tsk = current; + struct audit_buffer *ab; + int res = 0; + + spin_lock(&tsk->sighand->siglock); + old.enabled = tsk->signal->audit_tty; + old.log_passwd = tsk->signal->audit_tty_log_passwd; + spin_unlock(&tsk->sighand->siglock); memset(&s, 0, sizeof(s)); /* guard against past and future API changes */ memcpy(&s, data, min(sizeof(s), (size_t)nlh->nlmsg_len)); - if ((s.enabled != 0 && s.enabled != 1) || - (s.log_passwd != 0 && s.log_passwd != 1)) + if ((s.enabled == 0 || s.enabled == 1) && + (s.log_passwd == 0 || s.log_passwd == 1)) + res = 1; + audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE); + audit_log_format(ab, " op=tty_set" + " old.enabled=%d" + " new.enabled=%d" + " old.log_passwd=%d" + " new.log_passwd=%d" + " res=%d", + old.enabled, + s.enabled, + old.log_passwd, + s.log_passwd, + res); + audit_log_end(ab); + if (res) { + spin_lock(&tsk->sighand->siglock); + tsk->signal->audit_tty = s.enabled; + tsk->signal->audit_tty_log_passwd = s.log_passwd; + spin_unlock(&tsk->sighand->siglock); + } else return -EINVAL; - - spin_lock(&tsk->sighand->siglock); - tsk->signal->audit_tty = s.enabled; - tsk->signal->audit_tty_log_passwd = s.log_passwd; - spin_unlock(&tsk->sighand->siglock); break; } default: - RGB -- Richard Guy Briggs <rbriggs(a)redhat.com&gt; Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat Remote, Ottawa, Canada Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545