diff options
| author | Steve Grubb <sgrubb@redhat.com> | 2005-05-06 12:38:39 +0100 |
|---|---|---|
| committer | David Woodhouse <dwmw2@shinybook.infradead.org> | 2005-05-06 12:38:39 +0100 |
| commit | c2f0c7c356dc9ae15419f00c725a2fcc58eeff58 (patch) | |
| tree | 2b765b791115e0e85b45bc98800fd2650b23155b /kernel/signal.c | |
| parent | 2512809255d018744fe6c2f5e996c83769846c07 (diff) | |
| download | op-kernel-dev-c2f0c7c356dc9ae15419f00c725a2fcc58eeff58.zip op-kernel-dev-c2f0c7c356dc9ae15419f00c725a2fcc58eeff58.tar.gz | |
The attached patch addresses the problem with getting the audit daemon
shutdown credential information. It creates a new message type
AUDIT_TERM_INFO, which is used by the audit daemon to query who issued the
shutdown.
It requires the placement of a hook function that gathers the information. The
hook is after the DAC & MAC checks and before the function returns. Racing
threads could overwrite the uid & pid - but they would have to be root and
have policy that allows signalling the audit daemon. That should be a
manageable risk.
The userspace component will be released later in audit 0.7.2. When it
receives the TERM signal, it queries the kernel for shutdown information.
When it receives it, it writes the message and exits. The message looks
like this:
type=DAEMON msg=auditd(1114551182.000) auditd normal halt, sending pid=2650
uid=525, auditd pid=1685
Signed-off-by: Steve Grubb <sgrubb@redhat.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Diffstat (limited to 'kernel/signal.c')
| -rw-r--r-- | kernel/signal.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/kernel/signal.c b/kernel/signal.c index 8f3debc..293e189 100644 --- a/kernel/signal.c +++ b/kernel/signal.c @@ -24,6 +24,7 @@ #include <linux/ptrace.h> #include <linux/posix-timers.h> #include <linux/signal.h> +#include <linux/audit.h> #include <asm/param.h> #include <asm/uaccess.h> #include <asm/unistd.h> @@ -658,7 +659,11 @@ static int check_kill_permission(int sig, struct siginfo *info, && (current->uid ^ t->suid) && (current->uid ^ t->uid) && !capable(CAP_KILL)) return error; - return security_task_kill(t, info, sig); + + error = security_task_kill(t, info, sig); + if (!error) + audit_signal_info(sig, t); /* Let audit system see the signal */ + return error; } /* forward decl */ |
