summaryrefslogtreecommitdiffstats
path: root/fs
diff options
context:
space:
mode:
authorRichard Guy Briggs <rgb@redhat.com>2013-10-30 18:05:24 -0400
committerEric Paris <eparis@redhat.com>2013-11-05 11:15:03 -0500
commit9410d228a4cf434305306746bb799fb7acdd8648 (patch)
tree93dc6f756af3c2557f2e1377bad52582fdd9fe19 /fs
parentd9cfea91e97d5d19f9d69beaa844f5fe56a6adc6 (diff)
downloadop-kernel-dev-9410d228a4cf434305306746bb799fb7acdd8648.zip
op-kernel-dev-9410d228a4cf434305306746bb799fb7acdd8648.tar.gz
audit: call audit_bprm() only once to add AUDIT_EXECVE information
Move the audit_bprm() call from search_binary_handler() to exec_binprm(). This allows us to get rid of the mm member of struct audit_aux_data_execve since bprm->mm will equal current->mm. This also mitigates the issue that ->argc could be modified by the load_binary() call in search_binary_handler(). audit_bprm() was being called to add an AUDIT_EXECVE record to the audit context every time search_binary_handler() was recursively called. Only one reference is necessary. Reported-by: Oleg Nesterov <onestero@redhat.com> Cc: Eric Paris <eparis@redhat.com> Signed-off-by: Richard Guy Briggs <rgb@redhat.com> Signed-off-by: Eric Paris <eparis@redhat.com> --- This patch is against 3.11, but was developed on Oleg's post-3.11 patches that introduce exec_binprm().
Diffstat (limited to 'fs')
-rw-r--r--fs/exec.c5
1 files changed, 1 insertions, 4 deletions
diff --git a/fs/exec.c b/fs/exec.c
index fd774c7..c5c24f2 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1383,10 +1383,6 @@ int search_binary_handler(struct linux_binprm *bprm)
if (retval)
return retval;
- retval = audit_bprm(bprm);
- if (retval)
- return retval;
-
/* Need to fetch pid before load_binary changes it */
old_pid = current->pid;
rcu_read_lock();
@@ -1408,6 +1404,7 @@ int search_binary_handler(struct linux_binprm *bprm)
bprm->recursion_depth = depth;
if (retval >= 0) {
if (depth == 0) {
+ audit_bprm(bprm);
trace_sched_process_exec(current, old_pid, bprm);
ptrace_event(PTRACE_EVENT_EXEC, old_vpid);
}
OpenPOWER on IntegriCloud