[PATCH 1/2] audit: Use more current logging style

[PATCH 1/2] audit: Use more current logging style

[Joe Perches]

Add pr_fmt to prefix "audit: " to output
Convert printk(KERN_<LEVEL> to pr_<level>
Coalesce formats
Use pr_cont
Move a brace after switch

Signed-off-by: Joe Perches <joe@perches.com>
---
 kernel/audit.c | 38 ++++++++++++++++++--------------------
 1 file changed, 18 insertions(+), 20 deletions(-)

diff --git a/kernel/audit.c b/kernel/audit.c
index 2dc7573..f397ab2 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -41,6 +41,8 @@
  * Example user-space utilities: http://people.redhat.com/sgrubb/audit/
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/init.h>
 #include <asm/types.h>
 #include <linux/atomic.h>
@@ -194,13 +196,12 @@ static void audit_set_portid(struct audit_buffer *ab, __u32 portid)
 
 void audit_panic(const char *message)
 {
-	switch (audit_failure)
-	{
+	switch (audit_failure) {
 	case AUDIT_FAIL_SILENT:
 		break;
 	case AUDIT_FAIL_PRINTK:
 		if (printk_ratelimit())
-			printk(KERN_ERR "audit: %s\n", message);
+			pr_err("%s\n", message);
 		break;
 	case AUDIT_FAIL_PANIC:
 		/* test audit_pid since printk is always losey, why bother? */
@@ -271,9 +272,7 @@ void audit_log_lost(const char *message)
 
 	if (print) {
 		if (printk_ratelimit())
-			printk(KERN_WARNING
-				"audit: audit_lost=%d audit_rate_limit=%d "
-				"audit_backlog_limit=%d\n",
+			pr_warn("audit_lost=%d audit_rate_limit=%d audit_backlog_limit=%d\n",
 				atomic_read(&audit_lost),
 				audit_rate_limit,
 				audit_backlog_limit);
@@ -394,7 +393,7 @@ static void audit_printk_skb(struct sk_buff *skb)
 
 	if (nlh->nlmsg_type != AUDIT_EOE) {
 		if (printk_ratelimit())
-			printk(KERN_NOTICE "type=%d %s\n", nlh->nlmsg_type, data);
+			pr_notice("type=%d %s\n", nlh->nlmsg_type, data);
 		else
 			audit_log_lost("printk limit exceeded\n");
 	}
@@ -411,7 +410,7 @@ static void kauditd_send_skb(struct sk_buff *skb)
 	if (err < 0) {
 		BUG_ON(err != -ECONNREFUSED); /* Shouldn't happen */
 		if (audit_pid) {
-			printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n", audit_pid);
+			pr_err("*NO* daemon at audit_pid=%d\n", audit_pid);
 			audit_log_lost("auditd disappeared\n");
 			audit_pid = 0;
 			audit_sock = NULL;
@@ -1056,7 +1055,7 @@ static int __net_init audit_net_init(struct net *net)
 
 	struct audit_net *aunet = net_generic(net, audit_net_id);
 
-	pr_info("audit: initializing netlink socket in namespace\n");
+	pr_info("initializing netlink socket in namespace\n");
 
 	aunet->nlsk = netlink_kernel_create(net, NETLINK_AUDIT, &cfg);
 	if (aunet->nlsk == NULL)
@@ -1097,8 +1096,8 @@ static int __init audit_init(void)
 	if (audit_initialized == AUDIT_DISABLED)
 		return 0;
 
-	pr_info("audit: initializing netlink subsys (%s)\n",
-	       audit_default ? "enabled" : "disabled");
+	pr_info("initializing netlink subsys (%s)\n",
+		audit_default ? "enabled" : "disabled");
 	register_pernet_subsys(&audit_net_ops);
 
 	skb_queue_head_init(&audit_skb_queue);
@@ -1123,7 +1122,7 @@ static int __init audit_enable(char *str)
 	if (!audit_default)
 		audit_initialized = AUDIT_DISABLED;
 
-	pr_info("audit: %s\n", audit_default ?
+	pr_info("%s\n", audit_default ?
 		"enabled (after initialization)" : "disabled (until reboot)");
 
 	return 1;
@@ -1135,15 +1134,16 @@ __setup("audit=", audit_enable);
 static int __init audit_backlog_limit_set(char *str)
 {
 	long int audit_backlog_limit_arg;
+
 	pr_info("audit_backlog_limit: ");
 	if (kstrtol(str, 0, &audit_backlog_limit_arg)) {
-		printk("using default of %d, unable to parse %s\n",
-		       audit_backlog_limit, str);
+		pr_cont("using default of %d, unable to parse %s\n",
+			audit_backlog_limit, str);
 		return 1;
 	}
 	if (audit_backlog_limit_arg >= 0)
 		audit_backlog_limit = (int)audit_backlog_limit_arg;
-	printk("%d\n", audit_backlog_limit);
+	pr_cont("%d\n", audit_backlog_limit);
 
 	return 1;
 }
@@ -1325,11 +1325,9 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
 			}
 		}
 		if (audit_rate_check() && printk_ratelimit())
-			printk(KERN_WARNING
-			       "audit: audit_backlog=%d > "
-			       "audit_backlog_limit=%d\n",
-			       skb_queue_len(&audit_skb_queue),
-			       audit_backlog_limit);
+			pr_warn("audit_backlog=%d > audit_backlog_limit=%d\n",
+				skb_queue_len(&audit_skb_queue),
+				audit_backlog_limit);
 		audit_log_lost("backlog limit exceeded");
 		audit_backlog_wait_time = audit_backlog_wait_overflow;
 		wake_up(&audit_backlog_wait);
-- 
1.8.1.2.459.gbcd45b4.dirty

[PATCH 2/2] audit: Convert int limit uses to u32

[Joe Perches]

The equivalent uapi struct uses __u32 so make the kernel
uses u32 too.

This can prevent some oddities where the limit is
logged/emitted as a negative value.

Convert kstrtol to kstrtouint to disallow negative values.

Signed-off-by: Joe Perches <joe@perches.com>
---
 include/linux/audit.h |  2 +-
 kernel/audit.c        | 49 +++++++++++++++++++++++++------------------------
 kernel/audit.h        |  2 +-
 3 files changed, 27 insertions(+), 26 deletions(-)

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 52ee780..4b1669c 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -463,7 +463,7 @@ extern int audit_filter_user(int type);
 extern int audit_filter_type(int type);
 extern int  audit_receive_filter(int type, __u32 portid, int seq,
 				void *data, size_t datasz);
-extern int audit_enabled;
+extern u32 audit_enabled;
 #else /* CONFIG_AUDIT */
 static inline __printf(4, 5)
 void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type,
diff --git a/kernel/audit.c b/kernel/audit.c
index f397ab2..902c3aa 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -79,16 +79,16 @@ static int	audit_initialized;
 #define AUDIT_OFF	0
 #define AUDIT_ON	1
 #define AUDIT_LOCKED	2
-int		audit_enabled;
-int		audit_ever_enabled;
+u32		audit_enabled;
+u32		audit_ever_enabled;
 
 EXPORT_SYMBOL_GPL(audit_enabled);
 
 /* Default state when kernel boots without any parameters. */
-static int	audit_default;
+u32	audit_default;
 
 /* If auditing cannot proceed, audit_failure selects what happens. */
-static int	audit_failure = AUDIT_FAIL_PRINTK;
+static u32	audit_failure = AUDIT_FAIL_PRINTK;
 
 /*
  * If audit records are to be written to the netlink socket, audit_pid
@@ -101,14 +101,14 @@ static __u32	audit_nlk_portid;
 /* If audit_rate_limit is non-zero, limit the rate of sending audit records
  * to that number per second.  This prevents DoS attacks, but results in
  * audit records being dropped. */
-static int	audit_rate_limit;
+static u32	audit_rate_limit;
 
 /* Number of outstanding audit_buffers allowed.
  * When set to zero, this means unlimited. */
-static int	audit_backlog_limit = 64;
+static u32	audit_backlog_limit = 64;
 #define AUDIT_BACKLOG_WAIT_TIME (60 * HZ)
-static int	audit_backlog_wait_time = AUDIT_BACKLOG_WAIT_TIME;
-static int	audit_backlog_wait_overflow = 0;
+static u32	audit_backlog_wait_time = AUDIT_BACKLOG_WAIT_TIME;
+static u32	audit_backlog_wait_overflow = 0;
 
 /* The identity of the user shutting down the audit system. */
 kuid_t		audit_sig_uid = INVALID_UID;
@@ -272,7 +272,7 @@ void audit_log_lost(const char *message)
 
 	if (print) {
 		if (printk_ratelimit())
-			pr_warn("audit_lost=%d audit_rate_limit=%d audit_backlog_limit=%d\n",
+			pr_warn("audit_lost=%u audit_rate_limit=%u audit_backlog_limit=%u\n",
 				atomic_read(&audit_lost),
 				audit_rate_limit,
 				audit_backlog_limit);
@@ -280,7 +280,7 @@ void audit_log_lost(const char *message)
 	}
 }
 
-static int audit_log_config_change(char *function_name, int new, int old,
+static int audit_log_config_change(char *function_name, u32 new, u32 old,
 				   int allow_changes)
 {
 	struct audit_buffer *ab;
@@ -289,7 +289,7 @@ static int audit_log_config_change(char *function_name, int new, int old,
 	ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
 	if (unlikely(!ab))
 		return rc;
-	audit_log_format(ab, "%s=%d old=%d", function_name, new, old);
+	audit_log_format(ab, "%s=%u old=%u", function_name, new, old);
 	audit_log_session_info(ab);
 	rc = audit_log_task_context(ab);
 	if (rc)
@@ -299,9 +299,10 @@ static int audit_log_config_change(char *function_name, int new, int old,
 	return rc;
 }
 
-static int audit_do_config_change(char *function_name, int *to_change, int new)
+static int audit_do_config_change(char *function_name, u32 *to_change, u32 new)
 {
-	int allow_changes, rc = 0, old = *to_change;
+	int allow_changes, rc = 0;
+	u32 old = *to_change;
 
 	/* check if we are locked */
 	if (audit_enabled == AUDIT_LOCKED)
@@ -324,23 +325,23 @@ static int audit_do_config_change(char *function_name, int *to_change, int new)
 	return rc;
 }
 
-static int audit_set_rate_limit(int limit)
+static int audit_set_rate_limit(u32 limit)
 {
 	return audit_do_config_change("audit_rate_limit", &audit_rate_limit, limit);
 }
 
-static int audit_set_backlog_limit(int limit)
+static int audit_set_backlog_limit(u32 limit)
 {
 	return audit_do_config_change("audit_backlog_limit", &audit_backlog_limit, limit);
 }
 
-static int audit_set_backlog_wait_time(int timeout)
+static int audit_set_backlog_wait_time(u32 timeout)
 {
 	return audit_do_config_change("audit_backlog_wait_time",
 				      &audit_backlog_wait_time, timeout);
 }
 
-static int audit_set_enabled(int state)
+static int audit_set_enabled(u32 state)
 {
 	int rc;
 	if (state < AUDIT_OFF || state > AUDIT_LOCKED)
@@ -353,7 +354,7 @@ static int audit_set_enabled(int state)
 	return rc;
 }
 
-static int audit_set_failure(int state)
+static int audit_set_failure(u32 state)
 {
 	if (state != AUDIT_FAIL_SILENT
 	    && state != AUDIT_FAIL_PRINTK
@@ -687,7 +688,7 @@ static void audit_log_feature_change(int which, u32 old_feature, u32 new_feature
 		return;
 
 	ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_FEATURE_CHANGE);
-	audit_log_format(ab, "feature=%s old=%d new=%d old_lock=%d new_lock=%d res=%d",
+	audit_log_format(ab, "feature=%s old=%u new=%u old_lock=%u new_lock=%u res=%d",
 			 audit_feature_names[which], !!old_feature, !!new_feature,
 			 !!old_lock, !!new_lock, res);
 	audit_log_end(ab);
@@ -1133,16 +1134,16 @@ __setup("audit=", audit_enable);
  * audit_backlog_limit=<n> */
 static int __init audit_backlog_limit_set(char *str)
 {
-	long int audit_backlog_limit_arg;
+	u32 audit_backlog_limit_arg;
 
 	pr_info("audit_backlog_limit: ");
-	if (kstrtol(str, 0, &audit_backlog_limit_arg)) {
-		pr_cont("using default of %d, unable to parse %s\n",
+	if (kstrtouint(str, 0, &audit_backlog_limit_arg)) {
+		pr_cont("using default of %u, unable to parse %s\n",
 			audit_backlog_limit, str);
 		return 1;
 	}
-	if (audit_backlog_limit_arg >= 0)
-		audit_backlog_limit = (int)audit_backlog_limit_arg;
+
+	audit_backlog_limit = audit_backlog_limit_arg;
 	pr_cont("%d\n", audit_backlog_limit);
 
 	return 1;
diff --git a/kernel/audit.h b/kernel/audit.h
index 0719b45..57cc64d 100644
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -209,7 +209,7 @@ struct audit_context {
 #endif
 };
 
-extern int audit_ever_enabled;
+extern u32 audit_ever_enabled;
 
 extern void audit_copy_inode(struct audit_names *name,
 			     const struct dentry *dentry,
-- 
1.8.1.2.459.gbcd45b4.dirty

Re: [PATCH 2/2] audit: Convert int limit uses to u32

[Eric Paris]

On Tue, 2014-01-14 at 10:33 -0800, Joe Perches wrote:
> The equivalent uapi struct uses __u32 so make the kernel
> uses u32 too.
> 
> This can prevent some oddities where the limit is
> logged/emitted as a negative value.
> 
> Convert kstrtol to kstrtouint to disallow negative values.


> diff --git a/kernel/audit.c b/kernel/audit.c
> index f397ab2..902c3aa 100644
> --- a/kernel/audit.c
> +++ b/kernel/audit.c
> @@ -79,16 +79,16 @@ static int	audit_initialized;
>  #define AUDIT_OFF	0
>  #define AUDIT_ON	1
>  #define AUDIT_LOCKED	2
> -int		audit_enabled;
> -int		audit_ever_enabled;
> +u32		audit_enabled;
> +u32		audit_ever_enabled;
>  
>  EXPORT_SYMBOL_GPL(audit_enabled);
>  
>  /* Default state when kernel boots without any parameters. */
> -static int	audit_default;
> +u32	audit_default;

Can't figure out why you dropped the static...
I'm putting it back.

>  
>  /* If auditing cannot proceed, audit_failure selects what happens. */
> -static int	audit_failure = AUDIT_FAIL_PRINTK;
> +static u32	audit_failure = AUDIT_FAIL_PRINTK;
>  
>  /*
>   * If audit records are to be written to the netlink socket, audit_pid

Re: [PATCH 2/2] audit: Convert int limit uses to u32

[Joe Perches]

On Tue, 2014-01-14 at 14:07 -0500, Eric Paris wrote:
> On Tue, 2014-01-14 at 10:33 -0800, Joe Perches wrote:
> > The equivalent uapi struct uses __u32 so make the kernel
> > uses u32 too.
[]
> > diff --git a/kernel/audit.c b/kernel/audit.c
[]
> > @@ -79,16 +79,16 @@ static int	audit_initialized;
[]
> >  /* Default state when kernel boots without any parameters. */
> > -static int	audit_default;
> > +u32	audit_default;
> 
> Can't figure out why you dropped the static...

oops, typo.

> I'm putting it back.

thanks.