From: Gao feng <gaofeng@cn.fujitsu.com>
To: viro@zeniv.linux.org.uk, eparis@redhat.com,
ebiederm@xmission.com, sgrubb@redhat.com,
akpm@linux-foundation.org, serge.hallyn@ubuntu.com,
davem@davemloft.net
Cc: netdev@vger.kernel.org, containers@lists.linux-foundation.org,
linux-kernel@vger.kernel.org, linux-audit@redhat.com,
Gao feng <gaofeng@cn.fujitsu.com>
Subject: [PATCH RFC 47/48] Audit: make audit_log user namespace awared
Date: Tue, 7 May 2013 10:21:08 +0800 [thread overview]
Message-ID: <1367893269-9308-48-git-send-email-gaofeng@cn.fujitsu.com> (raw)
In-Reply-To: <1367893269-9308-1-git-send-email-gaofeng@cn.fujitsu.com>
This patch makes audit_log user namespace awared.
Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
---
include/linux/audit.h | 12 ++++++------
kernel/audit.c | 11 ++++++-----
net/core/dev.c | 12 +++++++-----
security/selinux/avc.c | 3 ++-
security/selinux/hooks.c | 3 ++-
security/selinux/selinuxfs.c | 9 ++++++---
security/selinux/ss/services.c | 24 +++++++++++++++---------
security/smack/smack_lsm.c | 3 ++-
8 files changed, 46 insertions(+), 31 deletions(-)
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 3f5dbe3..3af4d5d 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -395,9 +395,9 @@ static inline void audit_ptrace(struct task_struct *t)
#ifdef CONFIG_AUDIT
/* These are defined in audit.c */
/* Public API */
-extern __printf(4, 5)
-void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
- const char *fmt, ...);
+extern __printf(5, 6)
+void audit_log(struct user_namespace *ns, struct audit_context *ctx,
+ gfp_t gfp_mask, int type, const char *fmt, ...);
extern struct audit_buffer *
audit_log_start(struct user_namespace *ns, struct audit_context *ctx,
@@ -448,9 +448,9 @@ extern int audit_receive_filter(int type, int pid, int seq,
u32 sessionid, u32 sid);
#define audit_enabled(ns) (ns->audit.enabled)
#else /* CONFIG_AUDIT */
-static inline __printf(4, 5)
-void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
- const char *fmt, ...)
+static inline __printf(5, 6)
+void audit_log(struct user_namespace *ns, struct audit_context *ctx,
+ gfp_t gfp_mask, int type, const char *fmt, ...)
{ }
static inline
struct audit_buffer *audit_log_start(struct user_namespace *ns,
diff --git a/kernel/audit.c b/kernel/audit.c
index da1c0ad..59e5cca 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -998,7 +998,8 @@ static int __init audit_init(void)
audit_set_user_ns(&init_user_ns);
- audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized");
+ audit_log(&init_user_ns, NULL, GFP_KERNEL,
+ AUDIT_KERNEL, "initialized");
return 0;
}
@@ -1541,18 +1542,18 @@ void audit_log_end(struct user_namespace *ns, struct audit_buffer *ab)
* audit_log_vformat, and audit_log_end. It may be called
* in any context.
*/
-void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
- const char *fmt, ...)
+void audit_log(struct user_namespace *ns, struct audit_context *ctx,
+ gfp_t gfp_mask, int type, const char *fmt, ...)
{
struct audit_buffer *ab;
va_list args;
- ab = audit_log_start(&init_user_ns, ctx, gfp_mask, type);
+ ab = audit_log_start(ns, ctx, gfp_mask, type);
if (ab) {
va_start(args, fmt);
audit_log_vformat(ab, fmt, args);
va_end(args);
- audit_log_end(&init_user_ns, ab);
+ audit_log_end(ns, ab);
}
}
diff --git a/net/core/dev.c b/net/core/dev.c
index 128ee39..53a4af7 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4455,19 +4455,21 @@ static int __dev_set_promiscuity(struct net_device *dev, int inc)
}
}
if (dev->flags != old_flags) {
+ struct user_namespace *ns = current_user_ns();
pr_info("device %s %s promiscuous mode\n",
dev->name,
dev->flags & IFF_PROMISC ? "entered" : "left");
- if (audit_enabled(current_user_ns())) {
+ if (audit_enabled(ns)) {
current_uid_gid(&uid, &gid);
- audit_log(current->audit_context, GFP_ATOMIC,
+ audit_log(ns, current->audit_context,
+ GFP_ATOMIC,
AUDIT_ANOM_PROMISCUOUS,
"dev=%s prom=%d old_prom=%d auid=%u uid=%u gid=%u ses=%u",
dev->name, (dev->flags & IFF_PROMISC),
(old_flags & IFF_PROMISC),
- from_kuid(&init_user_ns, audit_get_loginuid(current)),
- from_kuid(&init_user_ns, uid),
- from_kgid(&init_user_ns, gid),
+ from_kuid(ns, audit_get_loginuid(current)),
+ from_kuid(ns, uid),
+ from_kgid(ns, gid),
audit_get_sessionid(current));
}
diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index dad36a6..5559be3 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -172,7 +172,8 @@ void __init avc_init(void)
avc_node_cachep = kmem_cache_create("avc_node", sizeof(struct avc_node),
0, SLAB_PANIC, NULL);
- audit_log(current->audit_context, GFP_KERNEL, AUDIT_KERNEL, "AVC INITIALIZED\n");
+ audit_log(current_user_ns(), current->audit_context,
+ GFP_KERNEL, AUDIT_KERNEL, "AVC INITIALIZED\n");
}
int avc_get_hash_stats(char *page)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 3e5a906..ac924af 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4523,7 +4523,8 @@ static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
if (err) {
if (err == -EINVAL) {
- audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
+ audit_log(current_user_ns(), current->audit_context,
+ GFP_KERNEL, AUDIT_SELINUX_ERR,
"SELinux: unrecognized netlink message"
" type=%hu for sclass=%hu\n",
nlh->nlmsg_type, sksec->sclass);
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index ff42773..4969a5d 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -171,7 +171,8 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
length = task_has_security(current, SECURITY__SETENFORCE);
if (length)
goto out;
- audit_log(current->audit_context, GFP_KERNEL, AUDIT_MAC_STATUS,
+ audit_log(current_user_ns(), current->audit_context,
+ GFP_KERNEL, AUDIT_MAC_STATUS,
"enforcing=%d old_enforcing=%d auid=%u ses=%u",
new_value, selinux_enforcing,
from_kuid(&init_user_ns, audit_get_loginuid(current)),
@@ -303,7 +304,8 @@ static ssize_t sel_write_disable(struct file *file, const char __user *buf,
length = selinux_disable();
if (length)
goto out;
- audit_log(current->audit_context, GFP_KERNEL, AUDIT_MAC_STATUS,
+ audit_log(current_user_ns(), current->audit_context,
+ GFP_KERNEL, AUDIT_MAC_STATUS,
"selinux=0 auid=%u ses=%u",
from_kuid(&init_user_ns, audit_get_loginuid(current)),
audit_get_sessionid(current));
@@ -549,7 +551,8 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,
length = count;
out1:
- audit_log(current->audit_context, GFP_KERNEL, AUDIT_MAC_POLICY_LOAD,
+ audit_log(current_user_ns(), current->audit_context,
+ GFP_KERNEL, AUDIT_MAC_POLICY_LOAD,
"policy loaded auid=%u ses=%u",
from_kuid(&init_user_ns, audit_get_loginuid(current)),
audit_get_sessionid(current));
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 9cdd1e5..81c6f71 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -728,7 +728,8 @@ static int security_validtrans_handle_fail(struct context *ocontext,
goto out;
if (context_struct_to_string(tcontext, &t, &tlen))
goto out;
- audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
+ audit_log(current_user_ns(), current->audit_context,
+ GFP_ATOMIC, AUDIT_SELINUX_ERR,
"security_validate_transition: denied for"
" oldcontext=%s newcontext=%s taskcontext=%s tclass=%s",
o, n, t, sym_name(&policydb, SYM_CLASSES, tclass-1));
@@ -875,7 +876,7 @@ int security_bounded_transition(u32 old_sid, u32 new_sid)
&old_name, &length) &&
!context_struct_to_string(new_context,
&new_name, &length)) {
- audit_log(current->audit_context,
+ audit_log(current_user_ns(), current->audit_context,
GFP_ATOMIC, AUDIT_SELINUX_ERR,
"op=security_bounded_transition "
"result=denied "
@@ -1345,7 +1346,8 @@ static int compute_sid_handle_invalid_context(
goto out;
if (context_struct_to_string(newcontext, &n, &nlen))
goto out;
- audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
+ audit_log(current_user_ns(), current->audit_context,
+ GFP_ATOMIC, AUDIT_SELINUX_ERR,
"security_compute_sid: invalid context %s"
" for scontext=%s"
" tcontext=%s"
@@ -2436,8 +2438,8 @@ int security_set_bools(int len, int *values)
for (i = 0; i < len; i++) {
if (!!values[i] != policydb.bool_val_to_struct[i]->state) {
- audit_log(current->audit_context, GFP_ATOMIC,
- AUDIT_MAC_CONFIG_CHANGE,
+ audit_log(current_user_ns(), current->audit_context,
+ GFP_ATOMIC, AUDIT_MAC_CONFIG_CHANGE,
"bool=%s val=%d old_val=%d auid=%u ses=%u",
sym_name(&policydb, SYM_BOOLS, i),
!!values[i],
@@ -2570,7 +2572,8 @@ int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid)
rc = convert_context_handle_invalid_context(&newcon);
if (rc) {
if (!context_struct_to_string(&newcon, &s, &len)) {
- audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
+ audit_log(current_user_ns(), current->audit_context,
+ GFP_ATOMIC, AUDIT_SELINUX_ERR,
"security_sid_mls_copy: invalid context %s", s);
kfree(s);
}
@@ -2941,7 +2944,8 @@ int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule,
int match = 0;
if (!rule) {
- audit_log(actx, GFP_ATOMIC, AUDIT_SELINUX_ERR,
+ audit_log(current_user_ns(), actx,
+ GFP_ATOMIC, AUDIT_SELINUX_ERR,
"selinux_audit_rule_match: missing rule\n");
return -ENOENT;
}
@@ -2949,7 +2953,8 @@ int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule,
read_lock(&policy_rwlock);
if (rule->au_seqno < latest_granting) {
- audit_log(actx, GFP_ATOMIC, AUDIT_SELINUX_ERR,
+ audit_log(current_user_ns(), actx,
+ GFP_ATOMIC, AUDIT_SELINUX_ERR,
"selinux_audit_rule_match: stale rule\n");
match = -ESTALE;
goto out;
@@ -2957,7 +2962,8 @@ int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule,
ctxt = sidtab_search(&sidtab, sid);
if (!ctxt) {
- audit_log(actx, GFP_ATOMIC, AUDIT_SELINUX_ERR,
+ audit_log(current_user_ns(), actx,
+ GFP_ATOMIC, AUDIT_SELINUX_ERR,
"selinux_audit_rule_match: unrecognized SID %d\n",
sid);
match = -ENOENT;
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index d52c780..816d3bb 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -3292,7 +3292,8 @@ static int smack_audit_rule_match(u32 secid, u32 field, u32 op, void *vrule,
char *rule = vrule;
if (!rule) {
- audit_log(actx, GFP_ATOMIC, AUDIT_SELINUX_ERR,
+ audit_log(current_user_ns(), actx,
+ GFP_ATOMIC, AUDIT_SELINUX_ERR,
"Smack: missing rule\n");
return -ENOENT;
}
--
1.8.1.4
next prev parent reply other threads:[~2013-05-07 2:20 UTC|newest]
Thread overview: 64+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-05-07 2:20 [PATCH RFC 00/48] Add namespace support for audit Gao feng
2013-05-07 2:20 ` [PATCH RFC 01/48] Audit: make audit kernel side netlink sock per userns Gao feng
2013-05-07 2:20 ` [PATCH RFC 02/48] netlink: Add compare function for netlink_table Gao feng
2013-05-07 2:20 ` [PATCH RFC 03/48] Audit: implement audit self-defined compare function Gao feng
2013-05-07 2:20 ` [PATCH RFC 04/48] Audit: make audit_skb_queue per user namespace Gao feng
2013-05-07 2:20 ` [PATCH RFC 05/48] Audit: make audit_skb_hold_queue " Gao feng
2013-05-07 2:20 ` [PATCH RFC 06/48] Audit: make kauditd_task " Gao feng
2013-05-21 9:15 ` Gao feng
2013-05-07 2:20 ` [PATCH RFC 07/48] Audit: make audit_pid " Gao feng
2013-05-07 2:20 ` [PATCH RFC 08/48] Audit: make audit_nlk_portid per user namesapce Gao feng
2013-05-07 2:20 ` [PATCH RFC 09/48] Audit: make audit_enabled per user namespace Gao feng
2013-05-07 15:44 ` Aristeu Rozanski
2013-05-08 5:22 ` Gao feng
2013-05-07 2:20 ` [PATCH RFC 10/48] Audit: change type of audit_ever_enabled to bool Gao feng
2013-05-08 2:06 ` Matt Helsley
2013-05-08 5:24 ` Gao feng
2013-05-07 2:20 ` [PATCH RFC 11/48] Audit: make audit_ever_enabled per user namespace Gao feng
2013-05-07 2:20 ` [PATCH RFC 12/48] Audit: make audit_initialized " Gao feng
2013-05-07 2:20 ` [PATCH RFC 13/48] Audit: only allow init user namespace to change audit_rate_limit Gao feng
2013-05-07 2:20 ` [PATCH RFC 14/48] Audit: only allow init user namespace to change audit_failure Gao feng
2013-05-07 2:20 ` [PATCH RFC 15/48] Audit: allow to send netlink message to auditd in uninit user namespace Gao feng
2013-05-07 2:20 ` [PATCH RFC 16/48] Audit: user proper user namespace in audit_log_config_change Gao feng
2013-05-07 2:20 ` [PATCH RFC 17/48] Audit: make kauditd_wait per user namespace Gao feng
2013-05-07 2:20 ` [PATCH RFC 18/48] Audit: make audit_backlog_wait " Gao feng
2013-05-07 2:20 ` [PATCH RFC 19/48] Audit: remove duplicate comments Gao feng
2013-05-07 2:20 ` [PATCH RFC 20/48] Audit: introduce new audit logging interface for user namespace Gao feng
2013-05-07 2:20 ` [PATCH RFC 21/48] Audit: pass proper user namespace to audit_log_common_recv_msg Gao feng
2013-05-07 2:20 ` [PATCH RFC 22/48] Audit: Log audit config change in uninit user namespace Gao feng
2013-05-07 2:20 ` [PATCH RFC 23/48] Audit: netfilter: Log xt table replace behavior in proper " Gao feng
2013-05-07 2:20 ` [PATCH RFC 24/48] Audit: xt_AUDIT: Log audit message " Gao feng
2013-05-07 2:20 ` [PATCH RFC 25/48] Audit: send reply message to the auditd " Gao feng
2013-05-07 2:20 ` [PATCH RFC 26/48] Audit: make audit_inode_hash per " Gao feng
2013-05-07 2:20 ` [PATCH RFC 27/48] Audit: make tree_list " Gao feng
2013-05-07 2:20 ` [PATCH RFC 28/48] Audit: make audit filter list " Gao feng
2013-05-07 2:20 ` [PATCH RFC 29/48] Audit: make audit_krule belongs to " Gao feng
2013-05-07 2:20 ` [PATCH RFC 30/48] Audit: reply audit filter list request to proper " Gao feng
2013-05-07 2:20 ` [PATCH RFC 31/48] Audit: pass proper user namespace to audit_filter_syscall Gao feng
2013-05-07 2:20 ` [PATCH RFC 32/48] Audit: pass proper user namespace to audit_filter_inode_name Gao feng
2013-05-07 2:20 ` [PATCH RFC 33/48] Audit: Log filter related audit message to proper user namespace Gao feng
2013-05-07 2:20 ` [PATCH RFC 34/48] Log audit tree related message in " Gao feng
2013-05-07 2:20 ` [PATCH RFC 35/48] Audit: Log task related audit message to " Gao feng
2013-05-07 2:20 ` [PATCH RFC 36/48] Audit: Log watch " Gao feng
2013-05-07 2:20 ` [PATCH RFC 37/48] Audit: translate audit_log_start to audit_log_start_ns Gao feng
2013-05-07 2:20 ` [PATCH RFC 38/48] Audit: tty: " Gao feng
2013-05-07 2:21 ` [PATCH RFC 39/48] Audit: netlabel: " Gao feng
2013-05-07 2:21 ` [PATCH RFC 40/48] Audit: ima: " Gao feng
2013-05-07 2:21 ` [PATCH RFC 41/48] Audit: lsm: " Gao feng
2013-05-07 2:21 ` [PATCH RFC 42/48] Audit: selinux: " Gao feng
2013-05-07 2:21 ` [PATCH RFC 43/48] Audit: xfrm: " Gao feng
2013-05-07 2:21 ` [PATCH RFC 44/48] Audit: rename audit_log_start_ns to audit_log_start Gao feng
2013-05-07 2:21 ` [PATCH RFC 45/48] Audit: user audit_enabled_ns to replace audit_enabled Gao feng
2013-05-07 2:21 ` [PATCH RFC 46/48] Audit: rename audit_enabled_ns to audit_enabled Gao feng
2013-05-07 2:21 ` Gao feng [this message]
2013-05-07 2:21 ` [PATCH RFC 48/48] Audit: allow root user of un-init user namespace to set audit Gao feng
2013-05-08 16:55 ` [PATCH RFC 00/48] Add namespace support for audit Eric Paris
2013-05-09 1:13 ` Gao feng
2013-05-21 9:15 ` Gao feng
2013-06-06 21:52 ` Serge Hallyn
2013-06-06 22:47 ` Serge Hallyn
2013-06-10 1:54 ` Gao feng
2013-06-10 21:24 ` Serge E. Hallyn
2013-06-11 5:59 ` Gao feng
2013-06-11 13:49 ` Eric Paris
2013-06-11 14:15 ` Serge E. Hallyn
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1367893269-9308-48-git-send-email-gaofeng@cn.fujitsu.com \
--to=gaofeng@cn.fujitsu.com \
--cc=akpm@linux-foundation.org \
--cc=containers@lists.linux-foundation.org \
--cc=davem@davemloft.net \
--cc=ebiederm@xmission.com \
--cc=eparis@redhat.com \
--cc=linux-audit@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=serge.hallyn@ubuntu.com \
--cc=sgrubb@redhat.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®