audit: Remove the unused uid parameter from audit_receive_filter

[~andy/linux] / kernel / audit.c

diff --git a/kernel/audit.c b/kernel/audit.c
index 4a3f28d2ca65239db79eee58b0e85366aa98669f..a31e31bba2d373e44e18cd452b6dc49429c67d80 100644 (file)
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -61,6 +61,7 @@
 #include <linux/netlink.h>
 #include <linux/freezer.h>
 #include <linux/tty.h>
+#include <linux/pid_namespace.h>
 
 #include "audit.h"
 
@@ -467,24 +468,6 @@ static int kauditd_thread(void *dummy)
        return 0;
 }
 
-static int audit_prepare_user_tty(pid_t pid, uid_t loginuid, u32 sessionid)
-{
-       struct task_struct *tsk;
-       int err;
-
-       rcu_read_lock();
-       tsk = find_task_by_vpid(pid);
-       if (!tsk) {
-               rcu_read_unlock();
-               return -ESRCH;
-       }
-       get_task_struct(tsk);
-       rcu_read_unlock();
-       err = tty_audit_push_task(tsk, loginuid, sessionid);
-       put_task_struct(tsk);
-       return err;
-}
-
 int audit_send_list(void *_dest)
 {
        struct audit_netlink_list *dest = _dest;
@@ -588,6 +571,11 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
 {
        int err = 0;
 
+       /* Only support the initial namespaces for now. */
+       if ((current_user_ns() != &init_user_ns) ||
+           (task_active_pid_ns(current) != &init_pid_ns))
+               return -EPERM;
+
        switch (msg_type) {
        case AUDIT_GET:
        case AUDIT_LIST:
@@ -738,11 +726,11 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                if (!audit_enabled && msg_type != AUDIT_USER_AVC)
                        return 0;
 
-               err = audit_filter_user(&NETLINK_CB(skb));
+               err = audit_filter_user();
                if (err == 1) {
                        err = 0;
                        if (msg_type == AUDIT_USER_TTY) {
-                               err = audit_prepare_user_tty(pid, loginuid,
+                               err = tty_audit_push_task(current, loginuid,
                                                             sessionid);
                                if (err)
                                        break;
@@ -763,7 +751,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                                        size--;
                                audit_log_n_untrustedstring(ab, data, size);
                        }
-                       audit_set_pid(ab, pid);
+                       audit_set_pid(ab, NETLINK_CB(skb).pid);
                        audit_log_end(ab);
                }
                break;
@@ -783,7 +771,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                /* fallthrough */
        case AUDIT_LIST:
                err = audit_receive_filter(msg_type, NETLINK_CB(skb).pid,
-                                          uid, seq, data, nlmsg_len(nlh),
+                                          seq, data, nlmsg_len(nlh),
                                           loginuid, sessionid, sid);
                break;
        case AUDIT_ADD_RULE:
@@ -802,7 +790,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                /* fallthrough */
        case AUDIT_LIST_RULES:
                err = audit_receive_filter(msg_type, NETLINK_CB(skb).pid,
-                                          uid, seq, data, nlmsg_len(nlh),
+                                          seq, data, nlmsg_len(nlh),
                                           loginuid, sessionid, sid);
                break;
        case AUDIT_TRIM:
@@ -878,41 +866,29 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                break;
        case AUDIT_TTY_GET: {
                struct audit_tty_status s;
-               struct task_struct *tsk;
-               unsigned long flags;
-
-               rcu_read_lock();
-               tsk = find_task_by_vpid(pid);
-               if (tsk && lock_task_sighand(tsk, &flags)) {
-                       s.enabled = tsk->signal->audit_tty != 0;
-                       unlock_task_sighand(tsk, &flags);
-               } else
-                       err = -ESRCH;
-               rcu_read_unlock();
-
-               if (!err)
-                       audit_send_reply(NETLINK_CB(skb).pid, seq,
-                                        AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
+               struct task_struct *tsk = current;
+
+               spin_lock_irq(&tsk->sighand->siglock);
+               s.enabled = tsk->signal->audit_tty != 0;
+               spin_unlock_irq(&tsk->sighand->siglock);
+
+               audit_send_reply(NETLINK_CB(skb).pid, seq,
+                                AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
                break;
        }
        case AUDIT_TTY_SET: {
                struct audit_tty_status *s;
-               struct task_struct *tsk;
-               unsigned long flags;
+               struct task_struct *tsk = current;
 
                if (nlh->nlmsg_len < sizeof(struct audit_tty_status))
                        return -EINVAL;
                s = data;
                if (s->enabled != 0 && s->enabled != 1)
                        return -EINVAL;
-               rcu_read_lock();
-               tsk = find_task_by_vpid(pid);
-               if (tsk && lock_task_sighand(tsk, &flags)) {
-                       tsk->signal->audit_tty = s->enabled != 0;
-                       unlock_task_sighand(tsk, &flags);
-               } else
-                       err = -ESRCH;
-               rcu_read_unlock();
+
+               spin_lock_irq(&tsk->sighand->siglock);
+               tsk->signal->audit_tty = s->enabled != 0;
+               spin_unlock_irq(&tsk->sighand->siglock);
                break;
        }
        default:
@@ -1455,6 +1431,27 @@ void audit_log_key(struct audit_buffer *ab, char *key)
                audit_log_format(ab, "(null)");
 }
 
+/**
+ * audit_log_link_denied - report a link restriction denial
+ * @operation: specific link opreation
+ * @link: the path that triggered the restriction
+ */
+void audit_log_link_denied(const char *operation, struct path *link)
+{
+       struct audit_buffer *ab;
+
+       ab = audit_log_start(current->audit_context, GFP_KERNEL,
+                            AUDIT_ANOM_LINK);
+       audit_log_format(ab, "op=%s action=denied", operation);
+       audit_log_format(ab, " pid=%d comm=", current->pid);
+       audit_log_untrustedstring(ab, current->comm);
+       audit_log_d_path(ab, " path=", link);
+       audit_log_format(ab, " dev=");
+       audit_log_untrustedstring(ab, link->dentry->d_inode->i_sb->s_id);
+       audit_log_format(ab, " ino=%lu", link->dentry->d_inode->i_ino);
+       audit_log_end(ab);
+}
+
 /**
  * audit_log_end - end one audit record
  * @ab: the audit_buffer