lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

audit: add a new "type" field to audit_names struct

Browse Source 
For now, we just have two possibilities:

UNKNOWN: for a new audit_names record that we don't know anything about yet
NORMAL: for everything else

In later patches, we'll add other types so we can distinguish and update
records created under different circumstances.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Jeff Layton
2012-10-10 15:25:22 -04:00
committed by Al Viro
parent c43a25abba
commit 78e2e802a8
2 changed files with 15 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
include/linux/audit.h
View File

@@ -452,6 +452,11 @@ struct audit_field {
extern int __init audit_register_class(int class, unsigned *list); extern int __init audit_register_class(int class, unsigned *list);
extern int audit_classify_syscall(int abi, unsigned syscall); extern int audit_classify_syscall(int abi, unsigned syscall);
extern int audit_classify_arch(int arch); extern int audit_classify_arch(int arch);
/* audit_names->type values */
#define AUDIT_TYPE_UNKNOWN 0 /* we don't know yet */
#define AUDIT_TYPE_NORMAL 1 /* a "normal" audit record */
#ifdef CONFIG_AUDITSYSCALL #ifdef CONFIG_AUDITSYSCALL
/* These are defined in auditsc.c */ /* These are defined in auditsc.c */
/* Public API */ /* Public API */

15
kernel/auditsc.c
View File

@@ -120,6 +120,7 @@ struct audit_names {
struct audit_cap_data fcap; struct audit_cap_data fcap;
unsigned int fcap_ver; unsigned int fcap_ver;
int name_len; /* number of name's characters to log */ int name_len; /* number of name's characters to log */
unsigned char type; /* record type */
bool name_put; /* call __putname() for this name */ bool name_put; /* call __putname() for this name */
/* /*
* This was an allocated audit_names and not from the array of * This was an allocated audit_names and not from the array of
@@ -1995,7 +1996,8 @@ retry:
#endif #endif
} }
static struct audit_names *audit_alloc_name(struct audit_context *context) static struct audit_names *audit_alloc_name(struct audit_context *context,
unsigned char type)
{ {
struct audit_names *aname; struct audit_names *aname;
@@ -2010,6 +2012,7 @@ static struct audit_names *audit_alloc_name(struct audit_context *context)
} }
aname->ino = (unsigned long)-1; aname->ino = (unsigned long)-1;
aname->type = type;
list_add_tail(&aname->list, &context->names_list); list_add_tail(&aname->list, &context->names_list);
context->name_count++; context->name_count++;
@@ -2040,7 +2043,7 @@ void __audit_getname(const char *name)
return; return;
} }
n = audit_alloc_name(context); n = audit_alloc_name(context, AUDIT_TYPE_UNKNOWN);
if (!n) if (!n)
return; return;
@@ -2157,12 +2160,13 @@ void __audit_inode(const char *name, const struct dentry *dentry)
out_alloc: out_alloc:
/* unable to find the name from a previous getname() */ /* unable to find the name from a previous getname() */
n = audit_alloc_name(context); n = audit_alloc_name(context, AUDIT_TYPE_NORMAL);
if (!n) if (!n)
return; return;
out: out:
handle_path(dentry); handle_path(dentry);
audit_copy_inode(n, dentry, inode); audit_copy_inode(n, dentry, inode);
n->type = AUDIT_TYPE_NORMAL;
} }
/** /**
@@ -2219,6 +2223,7 @@ void __audit_inode_child(const struct inode *parent,
audit_copy_inode(n, dentry, inode); audit_copy_inode(n, dentry, inode);
else else
n->ino = (unsigned long)-1; n->ino = (unsigned long)-1;
n->type = AUDIT_TYPE_NORMAL;
found_child = n->name; found_child = n->name;
goto add_names; goto add_names;
} }
@@ -2226,14 +2231,14 @@ void __audit_inode_child(const struct inode *parent,
add_names: add_names:
if (!found_parent) { if (!found_parent) {
n = audit_alloc_name(context); n = audit_alloc_name(context, AUDIT_TYPE_NORMAL);
if (!n) if (!n)
return; return;
audit_copy_inode(n, NULL, parent); audit_copy_inode(n, NULL, parent);
} }
if (!found_child) { if (!found_child) {
n = audit_alloc_name(context); n = audit_alloc_name(context, AUDIT_TYPE_NORMAL);
if (!n) if (!n)
return; return;