diff options
| author | Richard Guy Briggs <rgb@redhat.com> | 2013-10-30 18:05:24 -0400 |
|---|---|---|
| committer | Eric Paris <eparis@redhat.com> | 2013-11-05 11:15:03 -0500 |
| commit | 9410d228a4cf434305306746bb799fb7acdd8648 (patch) | |
| tree | 93dc6f756af3c2557f2e1377bad52582fdd9fe19 /include/linux | |
| parent | d9cfea91e97d5d19f9d69beaa844f5fe56a6adc6 (diff) | |
| download | op-kernel-dev-9410d228a4cf434305306746bb799fb7acdd8648.zip op-kernel-dev-9410d228a4cf434305306746bb799fb7acdd8648.tar.gz | |
audit: call audit_bprm() only once to add AUDIT_EXECVE information
Move the audit_bprm() call from search_binary_handler() to exec_binprm(). This
allows us to get rid of the mm member of struct audit_aux_data_execve since
bprm->mm will equal current->mm.
This also mitigates the issue that ->argc could be modified by the
load_binary() call in search_binary_handler().
audit_bprm() was being called to add an AUDIT_EXECVE record to the audit
context every time search_binary_handler() was recursively called. Only one
reference is necessary.
Reported-by: Oleg Nesterov <onestero@redhat.com>
Cc: Eric Paris <eparis@redhat.com>
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
---
This patch is against 3.11, but was developed on Oleg's post-3.11 patches that
introduce exec_binprm().
Diffstat (limited to 'include/linux')
| -rw-r--r-- | include/linux/audit.h | 9 |
1 files changed, 3 insertions, 6 deletions
diff --git a/include/linux/audit.h b/include/linux/audit.h index 08b38bf..a406419 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -238,11 +238,10 @@ static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid if (unlikely(!audit_dummy_context())) __audit_ipc_set_perm(qbytes, uid, gid, mode); } -static inline int audit_bprm(struct linux_binprm *bprm) +static inline void audit_bprm(struct linux_binprm *bprm) { if (unlikely(!audit_dummy_context())) __audit_bprm(bprm); - return 0; } static inline int audit_socketcall(int nargs, unsigned long *args) { @@ -369,10 +368,8 @@ static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp) static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode) { } -static inline int audit_bprm(struct linux_binprm *bprm) -{ - return 0; -} +static inline void audit_bprm(struct linux_binprm *bprm) +{ } static inline int audit_socketcall(int nargs, unsigned long *args) { return 0; |
