mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Gao feng <gaofeng@cn.fujitsu.com>
To: viro@zeniv.linux.org.uk, eparis@redhat.com,
	ebiederm@xmission.com, sgrubb@redhat.com,
	akpm@linux-foundation.org, serge.hallyn@ubuntu.com,
	davem@davemloft.net
Cc: netdev@vger.kernel.org, containers@lists.linux-foundation.org,
	linux-kernel@vger.kernel.org, linux-audit@redhat.com,
	Gao feng <gaofeng@cn.fujitsu.com>
Subject: [PATCH RFC 39/48] Audit: netlabel: translate audit_log_start to audit_log_start_ns
Date: Tue, 7 May 2013 10:21:00 +0800	[thread overview]
Message-ID: <1367893269-9308-40-git-send-email-gaofeng@cn.fujitsu.com> (raw)
In-Reply-To: <1367893269-9308-1-git-send-email-gaofeng@cn.fujitsu.com>

Now we can log audit message in the user namespace which current
task belongs to.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
---
 net/ipv4/cipso_ipv4.c              | 4 ++--
 net/netlabel/netlabel_domainhash.c | 4 ++--
 net/netlabel/netlabel_unlabeled.c  | 8 ++++----
 net/netlabel/netlabel_user.c       | 8 +++++---
 4 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 667c1d4..b021445 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -532,7 +532,7 @@ doi_add_return:
 		audit_log_format(audit_buf,
 				 " cipso_doi=%u cipso_type=%s res=%u",
 				 doi, type_str, ret_val == 0 ? 1 : 0);
-		audit_log_end(audit_buf);
+		audit_log_end_ns(current_user_ns(), audit_buf);
 	}
 
 	return ret_val;
@@ -622,7 +622,7 @@ doi_remove_return:
 		audit_log_format(audit_buf,
 				 " cipso_doi=%u res=%u",
 				 doi, ret_val == 0 ? 1 : 0);
-		audit_log_end(audit_buf);
+		audit_log_end_ns(current_user_ns(), audit_buf);
 	}
 
 	return ret_val;
diff --git a/net/netlabel/netlabel_domainhash.c b/net/netlabel/netlabel_domainhash.c
index d8d4243..7fab4b8 100644
--- a/net/netlabel/netlabel_domainhash.c
+++ b/net/netlabel/netlabel_domainhash.c
@@ -241,7 +241,7 @@ static void netlbl_domhsh_audit_add(struct netlbl_dom_map *entry,
 			break;
 		}
 		audit_log_format(audit_buf, " res=%u", result == 0 ? 1 : 0);
-		audit_log_end(audit_buf);
+		audit_log_end_ns(current_user_ns(), audit_buf);
 	}
 }
 
@@ -462,7 +462,7 @@ int netlbl_domhsh_remove_entry(struct netlbl_dom_map *entry,
 				 " nlbl_domain=%s res=%u",
 				 entry->domain ? entry->domain : "(default)",
 				 ret_val == 0 ? 1 : 0);
-		audit_log_end(audit_buf);
+		audit_log_end_ns(current_user_ns(), audit_buf);
 	}
 
 	if (ret_val == 0) {
diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
index 8a6c6ea..7708078 100644
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -465,7 +465,7 @@ unlhsh_add_return:
 			security_release_secctx(secctx, secctx_len);
 		}
 		audit_log_format(audit_buf, " res=%u", ret_val == 0 ? 1 : 0);
-		audit_log_end(audit_buf);
+		audit_log_end_ns(current_user_ns(), audit_buf);
 	}
 	return ret_val;
 }
@@ -521,7 +521,7 @@ static int netlbl_unlhsh_remove_addr4(struct net *net,
 			security_release_secctx(secctx, secctx_len);
 		}
 		audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0);
-		audit_log_end(audit_buf);
+		audit_log_end_ns(current_user_ns(), audit_buf);
 	}
 
 	if (entry == NULL)
@@ -582,7 +582,7 @@ static int netlbl_unlhsh_remove_addr6(struct net *net,
 			security_release_secctx(secctx, secctx_len);
 		}
 		audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0);
-		audit_log_end(audit_buf);
+		audit_log_end_ns(current_user_ns(), audit_buf);
 	}
 
 	if (entry == NULL)
@@ -766,7 +766,7 @@ static void netlbl_unlabel_acceptflg_set(u8 value,
 	if (audit_buf != NULL) {
 		audit_log_format(audit_buf,
 				 " unlbl_accept=%u old=%u", value, old_val);
-		audit_log_end(audit_buf);
+		audit_log_end_ns(current_user_ns(), audit_buf);
 	}
 }
 
diff --git a/net/netlabel/netlabel_user.c b/net/netlabel/netlabel_user.c
index 9650c4a..d7550a2 100644
--- a/net/netlabel/netlabel_user.c
+++ b/net/netlabel/netlabel_user.c
@@ -100,16 +100,18 @@ struct audit_buffer *netlbl_audit_start_common(int type,
 	struct audit_buffer *audit_buf;
 	char *secctx;
 	u32 secctx_len;
+	struct user_namespace *ns = current_user_ns();
 
-	if (audit_enabled == 0)
+	if (audit_enabled_ns(ns) == 0)
 		return NULL;
 
-	audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC, type);
+	audit_buf = audit_log_start_ns(ns, current->audit_context,
+				       GFP_ATOMIC, type);
 	if (audit_buf == NULL)
 		return NULL;
 
 	audit_log_format(audit_buf, "netlabel: auid=%u ses=%u",
-			 from_kuid(&init_user_ns, audit_info->loginuid),
+			 from_kuid(ns, audit_info->loginuid),
 			 audit_info->sessionid);
 
 	if (audit_info->secid != 0 &&
-- 
1.8.1.4


  parent reply	other threads:[~2013-05-07  2:23 UTC|newest]

Thread overview: 64+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-05-07  2:20 [PATCH RFC 00/48] Add namespace support for audit Gao feng
2013-05-07  2:20 ` [PATCH RFC 01/48] Audit: make audit kernel side netlink sock per userns Gao feng
2013-05-07  2:20 ` [PATCH RFC 02/48] netlink: Add compare function for netlink_table Gao feng
2013-05-07  2:20 ` [PATCH RFC 03/48] Audit: implement audit self-defined compare function Gao feng
2013-05-07  2:20 ` [PATCH RFC 04/48] Audit: make audit_skb_queue per user namespace Gao feng
2013-05-07  2:20 ` [PATCH RFC 05/48] Audit: make audit_skb_hold_queue " Gao feng
2013-05-07  2:20 ` [PATCH RFC 06/48] Audit: make kauditd_task " Gao feng
2013-05-21  9:15   ` Gao feng
2013-05-07  2:20 ` [PATCH RFC 07/48] Audit: make audit_pid " Gao feng
2013-05-07  2:20 ` [PATCH RFC 08/48] Audit: make audit_nlk_portid per user namesapce Gao feng
2013-05-07  2:20 ` [PATCH RFC 09/48] Audit: make audit_enabled per user namespace Gao feng
2013-05-07 15:44   ` Aristeu Rozanski
2013-05-08  5:22     ` Gao feng
2013-05-07  2:20 ` [PATCH RFC 10/48] Audit: change type of audit_ever_enabled to bool Gao feng
2013-05-08  2:06   ` Matt Helsley
2013-05-08  5:24     ` Gao feng
2013-05-07  2:20 ` [PATCH RFC 11/48] Audit: make audit_ever_enabled per user namespace Gao feng
2013-05-07  2:20 ` [PATCH RFC 12/48] Audit: make audit_initialized " Gao feng
2013-05-07  2:20 ` [PATCH RFC 13/48] Audit: only allow init user namespace to change audit_rate_limit Gao feng
2013-05-07  2:20 ` [PATCH RFC 14/48] Audit: only allow init user namespace to change audit_failure Gao feng
2013-05-07  2:20 ` [PATCH RFC 15/48] Audit: allow to send netlink message to auditd in uninit user namespace Gao feng
2013-05-07  2:20 ` [PATCH RFC 16/48] Audit: user proper user namespace in audit_log_config_change Gao feng
2013-05-07  2:20 ` [PATCH RFC 17/48] Audit: make kauditd_wait per user namespace Gao feng
2013-05-07  2:20 ` [PATCH RFC 18/48] Audit: make audit_backlog_wait " Gao feng
2013-05-07  2:20 ` [PATCH RFC 19/48] Audit: remove duplicate comments Gao feng
2013-05-07  2:20 ` [PATCH RFC 20/48] Audit: introduce new audit logging interface for user namespace Gao feng
2013-05-07  2:20 ` [PATCH RFC 21/48] Audit: pass proper user namespace to audit_log_common_recv_msg Gao feng
2013-05-07  2:20 ` [PATCH RFC 22/48] Audit: Log audit config change in uninit user namespace Gao feng
2013-05-07  2:20 ` [PATCH RFC 23/48] Audit: netfilter: Log xt table replace behavior in proper " Gao feng
2013-05-07  2:20 ` [PATCH RFC 24/48] Audit: xt_AUDIT: Log audit message " Gao feng
2013-05-07  2:20 ` [PATCH RFC 25/48] Audit: send reply message to the auditd " Gao feng
2013-05-07  2:20 ` [PATCH RFC 26/48] Audit: make audit_inode_hash per " Gao feng
2013-05-07  2:20 ` [PATCH RFC 27/48] Audit: make tree_list " Gao feng
2013-05-07  2:20 ` [PATCH RFC 28/48] Audit: make audit filter list " Gao feng
2013-05-07  2:20 ` [PATCH RFC 29/48] Audit: make audit_krule belongs to " Gao feng
2013-05-07  2:20 ` [PATCH RFC 30/48] Audit: reply audit filter list request to proper " Gao feng
2013-05-07  2:20 ` [PATCH RFC 31/48] Audit: pass proper user namespace to audit_filter_syscall Gao feng
2013-05-07  2:20 ` [PATCH RFC 32/48] Audit: pass proper user namespace to audit_filter_inode_name Gao feng
2013-05-07  2:20 ` [PATCH RFC 33/48] Audit: Log filter related audit message to proper user namespace Gao feng
2013-05-07  2:20 ` [PATCH RFC 34/48] Log audit tree related message in " Gao feng
2013-05-07  2:20 ` [PATCH RFC 35/48] Audit: Log task related audit message to " Gao feng
2013-05-07  2:20 ` [PATCH RFC 36/48] Audit: Log watch " Gao feng
2013-05-07  2:20 ` [PATCH RFC 37/48] Audit: translate audit_log_start to audit_log_start_ns Gao feng
2013-05-07  2:20 ` [PATCH RFC 38/48] Audit: tty: " Gao feng
2013-05-07  2:21 ` Gao feng [this message]
2013-05-07  2:21 ` [PATCH RFC 40/48] Audit: ima: " Gao feng
2013-05-07  2:21 ` [PATCH RFC 41/48] Audit: lsm: " Gao feng
2013-05-07  2:21 ` [PATCH RFC 42/48] Audit: selinux: " Gao feng
2013-05-07  2:21 ` [PATCH RFC 43/48] Audit: xfrm: " Gao feng
2013-05-07  2:21 ` [PATCH RFC 44/48] Audit: rename audit_log_start_ns to audit_log_start Gao feng
2013-05-07  2:21 ` [PATCH RFC 45/48] Audit: user audit_enabled_ns to replace audit_enabled Gao feng
2013-05-07  2:21 ` [PATCH RFC 46/48] Audit: rename audit_enabled_ns to audit_enabled Gao feng
2013-05-07  2:21 ` [PATCH RFC 47/48] Audit: make audit_log user namespace awared Gao feng
2013-05-07  2:21 ` [PATCH RFC 48/48] Audit: allow root user of un-init user namespace to set audit Gao feng
2013-05-08 16:55 ` [PATCH RFC 00/48] Add namespace support for audit Eric Paris
2013-05-09  1:13   ` Gao feng
2013-05-21  9:15 ` Gao feng
2013-06-06 21:52   ` Serge Hallyn
2013-06-06 22:47     ` Serge Hallyn
2013-06-10  1:54       ` Gao feng
2013-06-10 21:24         ` Serge E. Hallyn
2013-06-11  5:59           ` Gao feng
2013-06-11 13:49             ` Eric Paris
2013-06-11 14:15               ` Serge E. Hallyn

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1367893269-9308-40-git-send-email-gaofeng@cn.fujitsu.com \
    --to=gaofeng@cn.fujitsu.com \
    --cc=akpm@linux-foundation.org \
    --cc=containers@lists.linux-foundation.org \
    --cc=davem@davemloft.net \
    --cc=ebiederm@xmission.com \
    --cc=eparis@redhat.com \
    --cc=linux-audit@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=serge.hallyn@ubuntu.com \
    --cc=sgrubb@redhat.com \
    --cc=viro@zeniv.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®