lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[PATCH] PPID filtering fix

Browse Source 
On Thu, Sep 28, 2006 at 04:03:06PM -0400, Eric Paris wrote:
> After some looking I did not see a way to get into audit_log_exit
> without having set the ppid.  So I am dropping the set from there and
> only doing it at the beginning.
>
> Please comment/ack/nak as soon as possible.

Ehh...  That's one hell of an overhead to be had ;-/  Let's be lazy.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Alexander Viro
2006-09-29 00:08:50 -04:00
committed by Al Viro
parent 4b8a311bb1
commit 419c58f11f
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
kernel/auditsc.c
View File

@@ -278,8 +278,11 @@ static int audit_filter_rules(struct task_struct *tsk,
result = audit_comparator(tsk->pid, f->op, f->val); result = audit_comparator(tsk->pid, f->op, f->val);
break; break;
case AUDIT_PPID: case AUDIT_PPID:
if (ctx) if (ctx) {
if (!ctx->ppid)
ctx->ppid = sys_getppid();
result = audit_comparator(ctx->ppid, f->op, f->val); result = audit_comparator(ctx->ppid, f->op, f->val);
}
break; break;
case AUDIT_UID: case AUDIT_UID:
result = audit_comparator(tsk->uid, f->op, f->val); result = audit_comparator(tsk->uid, f->op, f->val);
@@ -795,7 +798,8 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
/* tsk == current */ /* tsk == current */
context->pid = tsk->pid; context->pid = tsk->pid;
context->ppid = sys_getppid(); /* sic. tsk == current in all cases */ if (!context->ppid)
context->ppid = sys_getppid();
context->uid = tsk->uid; context->uid = tsk->uid;
context->gid = tsk->gid; context->gid = tsk->gid;
context->euid = tsk->euid; context->euid = tsk->euid;
@@ -1137,6 +1141,7 @@ void audit_syscall_entry(int arch, int major,
context->ctime = CURRENT_TIME; context->ctime = CURRENT_TIME;
context->in_syscall = 1; context->in_syscall = 1;
context->auditable = !!(state == AUDIT_RECORD_CONTEXT); context->auditable = !!(state == AUDIT_RECORD_CONTEXT);
context->ppid = 0;
} }
/** /**